code-foundry 0.26.0 → 0.27.1

package/src/commands/doctor.mjs

@@ -0,0 +1,70 @@
+// @ts-check
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { includesValue, readConfig } from '../lib/config.mjs'
+import { resolveProfile } from '../lib/profile.mjs'
+
+/** @param {string} root */
+export function doctor(root) {
+  const target = resolve(root)
+  const config = readConfig(join(target, '.github/code-foundry.yml'))
+  const profile = resolveProfile(target)
+  let errors = 0
+  /** @param {string} message */
+  const error = (message) => { console.error(`ERROR: ${message}`); errors += 1 }
+  /** @param {string} message */
+  const warn = (message) => console.warn(`WARN: ${message}`)
+
+  const toolchain = config.toolchain ?? 'auto'
+  if (!['auto', 'native', 'mise'].includes(toolchain)) error(`unsupported toolchain: ${toolchain}`)
+  if (toolchain === 'mise' && !existsSync(join(target, '.mise.toml'))) error('.mise.toml is required when toolchain: mise')
+  if (toolchain === 'auto') {
+    console.log(existsSync(join(target, '.mise.toml'))
+      ? 'Toolchain: mise (detected from existing .mise.toml).'
+      : 'Toolchain: native (mise not configured).')
+  }
+  const hooks = git(target, ['config', '--get', 'core.hooksPath'])
+  if (hooks !== '.githooks') warn('Git hooks are not enabled; run `npx code-foundry init`')
+
+  const packageFile = join(target, 'package.json')
+  if (existsSync(packageFile)) {
+    let packageJson
+    try { packageJson = JSON.parse(readFileSync(packageFile, 'utf8')) }
+    catch { error('package.json is not valid JSON'); packageJson = {} }
+    const lockfiles = ['bun.lock', 'bun.lockb', 'pnpm-lock.yaml', 'yarn.lock', 'package-lock.json'].filter((file) => existsSync(join(target, file)))
+    const groups = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+    if (!lockfiles.length && groups.some((key) => Object.keys(packageJson[key] ?? {}).length)) error('package.json exists but no supported lockfile was found')
+    if (lockfiles.length > 1) error('multiple JavaScript lockfiles found; keep one package manager')
+    if (packageJson.packageManager && lockfiles.length) {
+      const declared = String(packageJson.packageManager).split('@')[0]
+      const actual = lockfiles[0]?.startsWith('bun') ? 'bun' : lockfiles[0]?.split('-')[0].replace('.yaml', '')
+      if (actual && declared !== actual) error(`packageManager (${declared}) does not match ${actual} lockfile`)
+    }
+  }
+
+  if (profile.languages.split(',').includes('rust') && !commandExists('cargo')) error('Cargo is required for this repository')
+  if (profile.languages.split(',').includes('rust')) {
+    const metadata = spawnSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], { cwd: target, stdio: 'ignore' })
+    if (metadata.status !== 0) error('cargo metadata failed')
+  }
+  if (profile.languages.split(',').includes('python') && !commandExists('python') && !existsSync(join(target, '.venv/bin/python'))) error('Python is required for this repository')
+
+  for (const workflow of ['ci', 'codeql', 'security', 'test', 'draft-pr', 'release-pr', 'release']) {
+    if (includesValue(config.features ?? 'all', workflow) && !existsSync(join(target, `.github/workflows/${workflow}.yml`))) error(`missing enabled workflow: ${workflow}.yml`)
+  }
+  console.log('Remote CI, Test, Security, CodeQL, and release runtimes are loaded by reusable workflow wrappers.')
+  if (errors) throw new Error(`Repository doctor found ${errors} error(s).`)
+  console.log('Repository doctor passed.')
+}
+
+/** @param {string} root @param {string[]} args */
+function git(root, args) {
+  return spawnSync('git', args, { cwd: root, encoding: 'utf8' }).stdout?.trim() ?? ''
+}
+
+/** @param {string} command */
+function commandExists(command) {
+  return spawnSync(command, ['--version'], { stdio: 'ignore' }).status === 0
+}

package/src/commands/sync.mjs

@@ -0,0 +1,224 @@
+// @ts-check
+
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { detectLanguages, detectPackageManager, detectProfile } from '../lib/profile.mjs'
+import { configured, includesValue, readConfig } from '../lib/config.mjs'
+
+const standardFiles = [
+  '.editorconfig', '.gitattributes', '.gitignore', 'release-please-config.json',
+  '.githooks/pre-commit', 'AGENTS.md', 'LICENSE', 'NOTICE', 'ruff.toml', '.prettierrc',
+  '.github/CODEOWNERS', '.github/CODE_OF_CONDUCT.md', '.github/CONTRIBUTING.md',
+  '.github/PULL_REQUEST_TEMPLATE.md', '.github/SECURITY.md', '.github/dependabot.yml',
+  '.github/ISSUE_TEMPLATE/bug_report.yml', '.github/ISSUE_TEMPLATE/config.yml',
+  '.github/ISSUE_TEMPLATE/feature_request.yml',
+  '.github/workflows/ci.yml', '.github/workflows/codeql.yml', '.github/workflows/draft-pr.yml',
+  '.github/workflows/release-pr.yml', '.github/workflows/release.yml',
+  '.github/workflows/security.yml', '.github/workflows/test.yml',
+]
+
+const protectedFiles = new Set([
+  'AGENTS.md', '.github/CODE_OF_CONDUCT.md', '.github/CONTRIBUTING.md',
+  '.github/PULL_REQUEST_TEMPLATE.md', '.github/SECURITY.md', 'NOTICE',
+])
+
+const legacyFiles = [
+  '.github/code-foundry.yml.example', '.github/template.yml', '.github/template.yml.example',
+  '.github/scripts/bootstrap.sh', '.github/scripts/changed-files.sh', '.github/scripts/ci.sh',
+  '.github/scripts/codeql-languages.sh', '.github/scripts/doctor.sh', '.github/scripts/format-fast-path.sh',
+  '.github/scripts/init-repo.sh', '.github/scripts/pre-commit.sh', '.github/scripts/profile.sh',
+  '.github/scripts/security.sh', '.github/scripts/sitecustomize.py', '.github/scripts/sync-codeowners.sh',
+  '.github/scripts/sync-protection.sh', '.github/scripts/sync-template.sh', '.github/scripts/turbo-cache-probe.sh',
+  '.github/licenses/MIT.txt',
+  '.github/licenses/GPL-3.0-or-later.txt', '.github/licenses/AGPL-3.0-or-later.txt',
+]
+
+/** @typedef {{ target: string, source: string, dryRun?: boolean, force?: boolean, init?: boolean }} SyncOptions */
+
+/** @param {SyncOptions} options */
+export function syncRepository(options) {
+  const target = resolve(options.target)
+  const source = resolve(options.source)
+  const dryRun = options.dryRun ?? false
+  const force = options.force ?? false
+  const configPath = join(target, '.github/code-foundry.yml')
+  const existingConfig = readConfig(configPath)
+  if (!Object.keys(existingConfig).length && !options.init) throw new Error('Missing .github/code-foundry.yml; run init first.')
+  const defaults = createDefaultConfig(target, source)
+  let config = { ...defaults, ...existingConfig }
+  if (!Object.keys(existingConfig).length) {
+    writeOrReport(configPath, renderConfig(config), dryRun)
+  } else {
+    const missing = Object.keys(defaults).filter((key) => !(key in existingConfig))
+    if (missing.length) {
+      const current = readFileSync(configPath, 'utf8').trimEnd()
+      const additions = missing.map((key) => `${key}: ${defaults[key]}`).join('\n')
+      writeOrReport(configPath, `${current}\n${additions}\n`, dryRun)
+    }
+  }
+
+  const languages = configured(config.languages, detectLanguages(target).join(','))
+  const features = configured(config.features, 'all')
+  const runtimeRepository = configured(config.runtime_repository, '0xPlayerOne/code-foundry')
+  const runtimeRef = configured(config.runtime_ref, `v${readPackageVersion(source)}`)
+  const toolchain = configured(config.toolchain, 'auto')
+  if (!['auto', 'native', 'mise'].includes(toolchain)) {
+    throw new Error(`Unsupported toolchain: ${toolchain}; use auto, native, or mise.`)
+  }
+  const license = configured(config.license, existsSync(join(target, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later')
+  const changed = []
+
+  for (const file of standardFiles) {
+    if (!shouldInclude(file, languages, features)) continue
+    const sourceFile = sourcePath(source, file)
+    if (!existsSync(sourceFile)) throw new Error(`Template file missing: ${file}`)
+    const destination = join(target, file)
+    if (!force && protectedFiles.has(file) && existsSync(destination)) {
+      const existing = readFileSync(destination, 'utf8')
+      if (!isLegacyManagedDoc(file, existing)) continue
+    }
+    if ((file === 'LICENSE' || file === 'NOTICE') && license === 'preserve' && existsSync(destination)) continue
+    if ((file === 'LICENSE' || file === 'NOTICE') && license === 'none') continue
+    if (file === '.github/CODEOWNERS' && existsSync(destination)) continue
+    let content = readFileSync(sourceFile)
+    if (file.endsWith('.yml') && file.startsWith('.github/workflows/')) {
+      content = Buffer.from(renderWorkflow(content.toString('utf8'), config, runtimeRepository, runtimeRef))
+    }
+    if (file === '.gitignore' && existsSync(destination)) {
+      content = Buffer.from(mergeGitignore(content.toString('utf8'), readFileSync(destination, 'utf8')))
+    }
+    if (!existsSync(destination) || !buffersEqual(content, readFileSync(destination))) {
+      changed.push(file)
+      writeOrReport(destination, content, dryRun)
+    }
+  }
+
+  if (license !== 'preserve' && license !== 'none') {
+    const licenseFile = license === 'mit' ? 'MIT.txt' : license === 'agpl-3.0-or-later' ? 'AGPL-3.0-or-later.txt' : 'GPL-3.0-or-later.txt'
+    const sourceLicense = join(source, '.github/licenses', licenseFile)
+    if (!existsSync(sourceLicense)) throw new Error(`License template missing: ${sourceLicense}`)
+    writeOrReport(join(target, 'LICENSE'), readFileSync(sourceLicense), dryRun)
+    if (!existsSync(join(target, 'NOTICE'))) writeOrReport(join(target, 'NOTICE'), readFileSync(join(source, 'NOTICE')), dryRun)
+  }
+
+  for (const file of legacyFiles) {
+    const destination = join(target, file)
+    if (existsSync(destination)) {
+      changed.push(file)
+      if (dryRun) console.log(`Would remove ${file}`)
+      else rmSync(destination, { force: true })
+    }
+  }
+  for (const file of ['ruff.toml', '.prettierrc', '.prettierignore']) {
+    const relevant = file === 'ruff.toml' ? includesValue(languages, 'python') : includesValue(languages, 'typescript')
+    if (!relevant && existsSync(join(target, file))) {
+      changed.push(file)
+      if (dryRun) console.log(`Would remove irrelevant language configuration ${file}`)
+      else rmSync(join(target, file), { force: true })
+    }
+  }
+  if (!dryRun && existsSync(join(target, '.githooks/pre-commit'))) {
+    chmodSync(join(target, '.githooks/pre-commit'), 0o755)
+    git(target, ['config', 'core.hooksPath', '.githooks'])
+  }
+  console.log(`${changed.length} baseline file(s) differ.`)
+  return { changed, config }
+}
+
+/** @param {string} file @param {string} languages @param {string} features */
+function shouldInclude(file, languages, features) {
+  if (file === 'ruff.toml') return includesValue(languages, 'python')
+  if (file === '.prettierrc') return includesValue(languages, 'typescript')
+  if (file === '.github/dependabot.yml') return includesValue(features, 'dependabot')
+  const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
+  return !workflow || includesValue(features, workflow)
+}
+
+/** @param {string} source @param {string} file */
+function sourcePath(source, file) {
+  if (file.startsWith('.github/workflows/')) {
+    const name = file.slice('.github/workflows/'.length, -4)
+    return join(source, '.github/workflows', `${name}_self-ci.yml`)
+  }
+  return join(source, file)
+}
+
+/** @param {string} content @param {Record<string,string>} config @param {string} repository @param {string} ref */
+function renderWorkflow(content, config, repository, ref) {
+  const localPrefix = 'uses: ./.github/workflows/'
+  const remotePrefix = `uses: ${repository}/.github/workflows/`
+  let rendered = content.replaceAll(localPrefix, remotePrefix)
+  rendered = rendered.replace(new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'), `$&@${ref}`)
+  /** @type {Record<string, string|undefined>} */
+  const runners = {
+    ci: config.ci_runner ?? config.runner,
+    test: config.test_runner ?? config.runner,
+    security: config.security_runner ?? config.runner,
+    codeql: config.codeql_runner ?? config.runner,
+    'draft-pr': config.pr_runner ?? config.runner,
+    'release-pr': config.pr_runner ?? config.runner,
+    release: config.release_runner ?? config.runner,
+  }
+  const workflow = content.match(/\.github\/workflows\/([^/]+)\.yml/)?.[1]
+  const runner = workflow ? runners[workflow] : undefined
+  if (runner) rendered = rendered.replace(/^(\s+runner:)\s+.*$/m, `$1 ${runner}`)
+  return rendered
+}
+
+/** @param {string} value */
+function escapeRegExp(value) { return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') }
+
+/** @param {string} baseline @param {string} existing */
+function mergeGitignore(baseline, existing) {
+  const marker = '# Repository-specific rules'
+  const custom = existing.includes(marker) ? existing.slice(existing.indexOf(marker) + marker.length).trim() : ''
+  return custom ? `${baseline.trimEnd()}\n\n${marker}\n${custom}\n` : baseline
+}
+
+/** @param {string} file @param {string} content */
+function isLegacyManagedDoc(file, content) {
+  if (file === 'AGENTS.md') {
+    return content.includes('.github/scripts/bootstrap.sh') && content.includes('bash .github/scripts/ci.sh')
+  }
+  if (file === '.github/CONTRIBUTING.md') {
+    return content.includes('.github/scripts/bootstrap.sh') && content.includes('.github/template.yml')
+  }
+  return false
+}
+
+/** @param {string} target @param {string[]} args */
+function git(target, args) { spawnSync('git', args, { cwd: target, stdio: 'ignore' }) }
+
+/** @param {string} file @param {Buffer|string} content @param {boolean} dryRun */
+function writeOrReport(file, content, dryRun) {
+  if (dryRun) { console.log(`Would sync ${file}`); return }
+  mkdirSync(dirname(file), { recursive: true })
+  writeFileSync(file, content)
+}
+
+/** @param {Buffer} a @param {Buffer} b */
+function buffersEqual(a, b) { return a.equals(b) }
+
+/** @param {string} root @param {string} source @returns {Record<string,string>} */
+function createDefaultConfig(root, source) {
+  const languages = detectLanguages(root).join(',')
+  const packageManager = detectPackageManager(root)
+  return {
+    version: '1', profile: detectProfile(root), languages, features: 'all', codeql: 'auto', dependency_review: 'auto', package_manager: packageManager,
+    runtime_repository: '0xPlayerOne/code-foundry', runtime_ref: `v${readPackageVersion(source)}`,
+    runner: 'ubuntu-latest', unit_runner: 'ubuntu-slim', ci_runner: 'ubuntu-latest', test_runner: 'ubuntu-latest',
+    toolchain: 'auto',
+    security_runner: 'ubuntu-slim', codeql_runner: 'ubuntu-latest', pr_runner: 'ubuntu-slim', release_runner: 'ubuntu-slim',
+    prune_standard: 'false', cache_packages: 'auto', cache_build: 'auto', coverage_minimum: '80', turbo_remote: 'auto',
+    release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node', npm_publish: 'false',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase',
+  }
+}
+
+/** @param {Record<string,string>} config */
+function renderConfig(config) { return `${Object.entries(config).map(([key, value]) => `${key}: ${value}`).join('\n')}\n` }
+/** @param {string} root */
+function readPackageVersion(root) {
+  try { return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')).version ?? '0.0.0' } catch { return '0.0.0' }
+}

package/src/lib/config.mjs

@@ -0,0 +1,38 @@
+// @ts-check
+
+import { existsSync, readFileSync } from 'node:fs'
+
+/**
+ * Read the intentionally small YAML subset used by code-foundry.yml.
+ * Values are scalar strings; this keeps the CLI dependency-free.
+ * @param {string} file
+ * @returns {Record<string, string>}
+ */
+export function readConfig(file) {
+  if (!existsSync(file)) return {}
+
+  /** @type {Record<string, string>} */
+  const config = {}
+  for (const line of readFileSync(file, 'utf8').split(/\r?\n/)) {
+    const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*?)\s*$/)
+    if (!match) continue
+    const value = match[2].replace(/\s+#.*$/, '').trim().replace(/^['"]|['"]$/g, '')
+    config[match[1]] = value
+  }
+  return config
+}
+
+/** @param {string} value @param {string} fallback */
+export function configured(value, fallback) {
+  return value === undefined || value === '' ? fallback : value
+}
+
+/** @param {string} value @returns {string[]} */
+export function listValue(value) {
+  return value.split(',').map((item) => item.trim()).filter(Boolean)
+}
+
+/** @param {string} value @param {string} item */
+export function includesValue(value, item) {
+  return value === 'all' || listValue(value).includes(item)
+}

package/src/lib/profile.mjs

@@ -0,0 +1,114 @@
+// @ts-check
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+import { configured, includesValue, readConfig } from './config.mjs'
+
+const ignoredDirectories = new Set([
+  '.git',
+  '.code-foundry',
+  '.kilo',
+  '.mise',
+  '.next',
+  '.nuxt',
+  '.venv',
+  'node_modules',
+  'target',
+  'vendor',
+])
+
+/** @param {string} root @returns {string[]} */
+function sourceFiles(root) {
+  /** @type {string[]} */
+  const files = []
+  /** @param {string} directory */
+  function visit(directory) {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isDirectory() && ignoredDirectories.has(entry.name)) continue
+      const path = join(directory, entry.name)
+      if (entry.isDirectory()) visit(path)
+      else files.push(path)
+    }
+  }
+  visit(root)
+  return files
+}
+
+/** @param {string} root @param {RegExp} pattern */
+function hasSource(root, pattern) {
+  return sourceFiles(root).some((file) => pattern.test(file))
+}
+
+/** @param {string} root */
+export function detectLanguages(root) {
+  const files = sourceFiles(root)
+  /** @type {string[]} */
+  const languages = []
+  if (
+    existsSync(join(root, 'package.json')) ||
+    files.some((file) => /\.(?:js|jsx|mjs|cjs|ts|tsx|mts|cts)$/.test(file)) ||
+    files.some((file) => /(?:bun\.lockb?|pnpm-lock\.yaml|yarn\.lock|package-lock\.json)$/.test(file))
+  ) languages.push('typescript')
+  if (existsSync(join(root, 'Cargo.toml')) || hasSource(root, /\.rs$/)) languages.push('rust')
+  if (
+    existsSync(join(root, 'pyproject.toml')) ||
+    existsSync(join(root, 'requirements.txt')) ||
+    existsSync(join(root, 'requirements-dev.txt')) ||
+    hasSource(root, /\.py$/)
+  ) languages.push('python')
+  if (files.some((file) => file.endsWith('.sol'))) languages.push('solidity')
+  return languages.length ? languages : ['none']
+}
+
+/** @param {string} root */
+export function detectPackageManager(root) {
+  if (existsSync(join(root, 'bun.lock')) || existsSync(join(root, 'bun.lockb'))) return 'bun'
+  if (existsSync(join(root, 'pnpm-lock.yaml'))) return 'pnpm'
+  if (existsSync(join(root, 'yarn.lock'))) return 'yarn'
+  if (existsSync(join(root, 'package-lock.json'))) return 'npm'
+  if (existsSync(join(root, 'package.json'))) return 'bun'
+  return 'none'
+}
+
+/** @param {string} root */
+export function detectProfile(root) {
+  if (existsSync(join(root, 'turbo.json')) || existsSync(join(root, 'pnpm-workspace.yaml'))) return 'monorepo'
+  if (existsSync(join(root, 'package.json'))) {
+    try {
+      const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+      if (Array.isArray(packageJson.workspaces) || typeof packageJson.workspaces === 'object') return 'monorepo'
+    } catch {
+      // Doctor reports malformed package.json separately.
+    }
+  }
+  if (existsSync(join(root, 'package.json')) || existsSync(join(root, 'pyproject.toml')) || existsSync(join(root, 'Cargo.toml'))) return 'application'
+  return 'minimal'
+}
+
+/** @param {string} root */
+export function resolveProfile(root) {
+  const config = readConfig(join(root, '.github/code-foundry.yml'))
+  const languages = configured(config.languages, 'auto')
+  const profile = configured(config.profile, 'auto')
+  const packageManager = configured(config.package_manager, 'auto')
+  return {
+    profile: profile === 'auto' ? detectProfile(root) : profile,
+    languages: languages === 'auto' ? detectLanguages(root).join(',') : languages,
+    package_manager: packageManager === 'auto' ? detectPackageManager(root) : packageManager,
+    features: configured(config.features, 'all'),
+    release_type: configured(config.release_type, detectReleaseType(root)),
+    npm_publish: configured(config.npm_publish, 'false'),
+    runner: configured(config.runner, 'ubuntu-latest'),
+  }
+}
+
+/** @param {string} root */
+function detectReleaseType(root) {
+  if (existsSync(join(root, 'package.json'))) return 'node'
+  if (existsSync(join(root, 'pyproject.toml'))) return 'python'
+  if (existsSync(join(root, 'Cargo.toml'))) return 'rust'
+  if (existsSync(join(root, 'version.txt'))) return 'simple'
+  return 'none'
+}
+
+export { includesValue }