code-foundry 0.26.0 → 0.27.1

package/.github/scripts/codeql-languages.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-languages=()
-changed_files=""
-
-# Scheduled and manually dispatched scans are always full scans. For pushes
-# and pull requests, a shallow commit diff lets the matrix skip analyzers for
-# languages untouched by the change while keeping every matrix check visible.
-case "${GITHUB_EVENT_NAME:-}" in
-  schedule|workflow_dispatch) ;;
-  *)
-    base_sha="${CODEQL_BASE_SHA:-}"
-    if [ -n "$base_sha" ] && [ "$base_sha" != "0000000000000000000000000000000000000000" ]; then
-      if ! git cat-file -e "$base_sha^{commit}" 2>/dev/null; then
-        git fetch --no-tags --filter=blob:none --depth=1 origin "$base_sha" >/dev/null 2>&1 || true
-      fi
-      changed_files="$(git diff --name-only "$base_sha" "${GITHUB_SHA:-HEAD}" 2>/dev/null || true)"
-    fi
-    [ -n "$changed_files" ] || changed_files="$(git diff --name-only HEAD^ HEAD 2>/dev/null || true)"
-    ;;
-esac
-
-if find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -print -quit | grep -q .; then languages+=(actions); fi
-configured=""
-if [ -x .github/scripts/profile.sh ]; then
-  configured="$(bash .github/scripts/profile.sh get languages 2>/dev/null || true)"
-else
-  config_file=.github/code-foundry.yml
-  if [ -f "$config_file" ]; then
-    configured="$(awk -F': ' '/^languages:/ {print $2; exit}' "$config_file")"
-  fi
-fi
-
-if [ "$configured" = auto ] || [ "$configured" = all ] || [ -z "$configured" ]; then
-  tracked_files="$(git ls-files)"
-  if printf '%s\n' "$tracked_files" | grep -Eq '(^|/)([^/]+\.(ts|tsx|js|jsx)|package\.json|tsconfig[^/]*\.json)$'; then
-    languages+=(javascript-typescript)
-  fi
-  if printf '%s\n' "$tracked_files" | awk '!/^\.github\// && /(^|\/)([^\/]+\.py|pyproject\.toml|requirements[^\/]*\.txt|setup\.py)$/ { found=1; exit } END { exit !found }'; then
-    languages+=(python)
-  fi
-  if printf '%s\n' "$tracked_files" | grep -Eq '(^|/)([^/]+\.rs|Cargo\.toml|Cargo\.lock)$'; then
-    languages+=(rust)
-  fi
-else
-  case ",$configured," in *,typescript,*) languages+=(javascript-typescript) ;; esac
-  case ",$configured," in *,python,*) languages+=(python) ;; esac
-  case ",$configured," in *,rust,*) languages+=(rust) ;; esac
-fi
-
-changed_json="$(printf '%s\n' "$changed_files" | jq -Rsc 'split("\n") | map(select(length > 0))')"
-json=$(printf '%s\n' "${languages[@]}" | jq -Rsc --argjson changed "$changed_json" '
-  split("\n")
-  | map(select(length > 0) | {
-      language: .,
-      name: (if . == "javascript-typescript" then "TypeScript" elif . == "actions" then "Actions" else (. | ascii_upcase[0:1] + .[1:]) end),
-      "build-mode": "none",
-      changed: (
-        if ($changed | length) == 0 then true
-        elif . == "actions" then any($changed[]; test("(^|/)(\\.github/workflows/|action\\.yml$)"))
-        elif . == "javascript-typescript" then any($changed[]; test("(^|/)(.*\\.(js|jsx|mjs|cjs|ts|tsx|mts|cts)|package\\.json|tsconfig[^/]*\\.json|((bun|pnpm|yarn|package-lock)\\.lock))$"))
-        elif . == "python" then any($changed[]; test("(^|/)(.*\\.py|pyproject\\.toml|requirements[^/]*\\.txt|setup\\.py|Pipfile\\.lock|poetry\\.lock)$"))
-        elif . == "rust" then any($changed[]; test("(^|/)(.*\\.rs|Cargo\\.toml|Cargo\\.lock)$"))
-        else true
-        end
-      )
-    })
-')
-printf 'languages=%s\n' "$json" >> "$GITHUB_OUTPUT"
-
-# Expose stable, shell-friendly outputs for explicit analyzer jobs. Keeping
-# these separate from the JSON matrix lets workflow-level conditions avoid
-# allocating a runner for languages that are absent or unchanged.
-for codeql_language in actions javascript-typescript python rust; do
-  output_prefix="$codeql_language"
-  case "$codeql_language" in
-    javascript-typescript) output_prefix="javascript" ;;
-  esac
-
-  entry="$(jq -c --arg language "$codeql_language" '.[] | select(.language == $language)' <<< "$json")"
-  if [ -n "$entry" ]; then
-    printf '%s_available=true\n' "$output_prefix" >> "$GITHUB_OUTPUT"
-    printf '%s_changed=%s\n' "$output_prefix" "$(jq -r '.changed' <<< "$entry")" >> "$GITHUB_OUTPUT"
-    printf '%s_build_mode=%s\n' "$output_prefix" "$(jq -r '."build-mode"' <<< "$entry")" >> "$GITHUB_OUTPUT"
-  else
-    printf '%s_available=false\n' "$output_prefix" >> "$GITHUB_OUTPUT"
-    printf '%s_changed=false\n' "$output_prefix" >> "$GITHUB_OUTPUT"
-    printf '%s_build_mode=none\n' "$output_prefix" >> "$GITHUB_OUTPUT"
-  fi
-done

package/.github/scripts/doctor.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-errors=0
-
-configured_features="all"
-config_file=.github/code-foundry.yml
-if [ -f "$config_file" ]; then
-  configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' "$config_file")"
-  [ -n "$configured_features" ] || configured_features="all"
-fi
-
-feature_enabled() {
-  [ "$configured_features" = all ] && return 0
-  case " $(printf '%s' "$configured_features" | tr ',' ' ') " in
-    *" $1 "*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-error() {
-  printf 'ERROR: %s\n' "$1" >&2
-  errors=$((errors + 1))
-}
-
-warn() {
-  printf 'WARN: %s\n' "$1" >&2
-}
-
-if [ ! -f .mise.toml ]; then
-  error ".mise.toml is missing"
-fi
-
-if [ "$(git config --get core.hooksPath || true)" != ".githooks" ]; then
-  warn "Git hooks are not enabled; run bash .github/scripts/bootstrap.sh"
-fi
-
-if [ -f package.json ]; then
-  node -e 'JSON.parse(require("fs").readFileSync("package.json", "utf8"))'
-  lockfiles=0
-  for lockfile in bun.lock bun.lockb pnpm-lock.yaml yarn.lock package-lock.json; do
-    if [ -f "$lockfile" ]; then lockfiles=$((lockfiles + 1)); fi
-  done
-  if [ "$lockfiles" -eq 0 ]; then
-    if node -e 'const p=require("./package.json"); const groups=[p.dependencies,p.devDependencies,p.optionalDependencies,p.peerDependencies]; process.exit(groups.some((g)=>g && Object.keys(g).length) ? 0 : 1)' 2>/dev/null; then
-      error "package.json exists but no supported lockfile was found"
-    else
-      printf '%s\n' "INFO: package.json has no dependencies; a lockfile is optional"
-    fi
-  elif [ "$lockfiles" -gt 1 ]; then
-    error "multiple JavaScript lockfiles found; keep one package manager"
-  fi
-  if node -e 'const p=require("./package.json"); process.exit(p.packageManager ? 0 : 1)' 2>/dev/null; then
-    declared="$(node -p 'require("./package.json").packageManager.split("@")[0]')"
-    actual=""
-    [ -f bun.lock ] || [ -f bun.lockb ] && actual="bun"
-    [ -f pnpm-lock.yaml ] && actual="pnpm"
-    [ -f yarn.lock ] && actual="yarn"
-    [ -f package-lock.json ] && actual="npm"
-    [ -n "$actual" ] && [ "$declared" != "$actual" ] && error "packageManager ($declared) does not match $actual lockfile"
-  fi
-  if git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' | grep -q .; then
-    if ! node -e 'const p=require("./package.json"); const s=p.scripts||{}; process.exit(s.test||s["test:unit"]||s["test:integration"] ? 0 : 1)' 2>/dev/null; then
-      warn "JavaScript/TypeScript sources found but no test or test:unit/test:integration script is defined"
-    fi
-  fi
-  if [ -f bunfig.toml ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.["test:coverage"] ? 0 : 1)' 2>/dev/null; then
-    if ! grep -q 'coverageThreshold' bunfig.toml; then
-      printf '%s\n' "INFO: shared CI enforces the Bun aggregate coverage threshold"
-    fi
-  fi
-fi
-
-if [ -f Cargo.toml ]; then
-  command -v cargo >/dev/null 2>&1 || error "Cargo is required for this repository"
-  cargo metadata --no-deps --format-version 1 >/dev/null
-fi
-
-if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ]; then
-  if ! command -v python >/dev/null 2>&1 && [ ! -x .venv/bin/python ]; then
-    error "Python is required for this repository"
-  fi
-fi
-
-for workflow in ci codeql security test draft-pr release-pr release; do
-  if feature_enabled "$workflow"; then
-    [ -f ".github/workflows/$workflow.yml" ] || error "missing enabled workflow: $workflow.yml"
-  fi
-done
-
-printf '%s\n' 'Remote CI, Test, Security, CodeQL, and release runtimes are loaded by reusable workflow wrappers.'
-
-if [ "$errors" -gt 0 ]; then
-  printf '%s\n' "Repository doctor found $errors error(s)." >&2
-  exit 1
-fi
-
-printf '%s\n' "Repository doctor passed."

package/.github/scripts/format-fast-path.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Bootstrap only the formatter for Bun projects whose repository-owned format
-# script directly invokes Prettier. The workflow keeps a full-install fallback
-# because formatter configs may import arbitrary repository dependencies.
-
-set_output() {
-  printf '%s=%s\n' "$1" "$2" >> "${GITHUB_OUTPUT:-/dev/null}"
-}
-
-set_output hit false
-
-[ -f package.json ] || exit 0
-[ -f bun.lock ] || [ -f bun.lockb ] || exit 0
-
-project_profile="$(node <<'NODE'
-const fs = require('node:fs');
-const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-process.stdout.write(Array.isArray(packageJson.workspaces) ||
-  (packageJson.workspaces && typeof packageJson.workspaces === 'object') ? 'workspace' : 'standalone');
-NODE
-)"
-lock_file='bun.lock'
-[ -f "$lock_file" ] || lock_file='bun.lockb'
-lock_bytes="$(wc -c < "$lock_file")"
-# A temporary npm formatter install has fixed overhead. For small standalone
-# projects, the normal Bun install is usually faster; workspace graphs and
-# larger lockfiles still benefit materially from avoiding their full tree.
-if [ "$project_profile" = standalone ] && [ "$lock_bytes" -le 524288 ]; then
-  exit 0
-fi
-
-format_script="$(node <<'NODE'
-const fs = require('node:fs');
-const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-console.log(packageJson.scripts?.['format:check'] || packageJson.scripts?.format || '');
-NODE
-)"
-if ! grep -Eiq '(^|[[:space:];&|])prettier([[:space:]]|$)' <<<"$format_script" ||
-  grep -Eiq '(^|[[:space:];&|])turbo([[:space:]]|$)' <<<"$format_script"; then
-  exit 0
-fi
-
-prettier_version="$(node <<'NODE'
-const fs = require('node:fs');
-const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-for (const group of [packageJson.devDependencies, packageJson.dependencies, packageJson.optionalDependencies]) {
-  const value = group?.prettier;
-  const match = typeof value === 'string' && value.match(/(\d+\.\d+\.\d+)/);
-  if (match) {
-    console.log(match[1]);
-    break;
-  }
-}
-NODE
-)"
-[ -n "$prettier_version" ] || exit 0
-
-tool_home="${RUNNER_TEMP:-/tmp}/repo-foundry-format"
-install_log="$(mktemp)"
-cleanup() { rm -f "$install_log"; }
-trap cleanup EXIT
-
-if ! npm install --prefix "$tool_home" --no-save --ignore-scripts --no-audit --no-fund \
-  "prettier@${prettier_version}" >"$install_log" 2>&1; then
-  echo 'Format Probe: formatter bootstrap unavailable; using full install'
-  exit 0
-fi
-
-tool_bin="$tool_home/node_modules/.bin"
-if [ ! -x "$tool_bin/prettier" ]; then
-  echo 'Format Probe: formatter binary unavailable; using full install'
-  exit 0
-fi
-
-echo "$tool_bin" >> "${GITHUB_PATH:-/dev/null}"
-printf 'REPO_FOUNDRY_FORMAT_FAST=true\n' >> "${GITHUB_ENV:-/dev/null}"
-echo "Format Probe: using Prettier ${prettier_version} without project install"
-set_output hit true

package/.github/scripts/init-repo.sh

@@ -1,268 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-source="${REPO_FOUNDRY_SOURCE:-https://github.com/${GITHUB_REPOSITORY_OWNER:-OWNER}/code-foundry.git}"
-ref="main"
-profile="${REPO_FOUNDRY_PROFILE:-auto}"
-protection=false
-dry_run=false
-prune=false
-force=false
-languages="${REPO_FOUNDRY_LANGUAGES:-auto}"
-features="${REPO_FOUNDRY_FEATURES:-all}"
-package_manager="${REPO_FOUNDRY_PACKAGE_MANAGER:-auto}"
-runtime_repository="${REPO_FOUNDRY_RUNTIME_REPOSITORY:-}"
-runtime_ref="${REPO_FOUNDRY_RUNTIME_REF:-}"
-bootstrap=true
-release_type="${REPO_FOUNDRY_RELEASE_TYPE:-auto}"
-npm_publish="${REPO_FOUNDRY_NPM_PUBLISH:-false}"
-prune_standard="${REPO_FOUNDRY_PRUNE_STANDARD:-false}"
-license="${REPO_FOUNDRY_LICENSE:-gpl-3.0-or-later}"
-license_file="${REPO_FOUNDRY_LICENSE_FILE:-}"
-runner="${REPO_FOUNDRY_RUNNER:-ubuntu-latest}"
-unit_runner="${REPO_FOUNDRY_UNIT_RUNNER:-ubuntu-slim}"
-ci_runner="${REPO_FOUNDRY_CI_RUNNER:-ubuntu-latest}"
-test_runner="${REPO_FOUNDRY_TEST_RUNNER:-ubuntu-latest}"
-security_runner="${REPO_FOUNDRY_SECURITY_RUNNER:-ubuntu-slim}"
-codeql_runner="${REPO_FOUNDRY_CODEQL_RUNNER:-ubuntu-latest}"
-pr_runner="${REPO_FOUNDRY_PR_RUNNER:-ubuntu-slim}"
-release_runner="${REPO_FOUNDRY_RELEASE_RUNNER:-ubuntu-slim}"
-cache_packages="${REPO_FOUNDRY_CACHE_PACKAGES:-auto}"
-cache_build="${REPO_FOUNDRY_CACHE_BUILD:-auto}"
-coverage_minimum="${REPO_FOUNDRY_COVERAGE_MINIMUM:-80}"
-turbo_remote="${REPO_FOUNDRY_TURBO_REMOTE:-auto}"
-
-profile_set=false
-languages_set=false
-features_set=false
-package_manager_set=false
-runtime_repository_set=false
-runtime_ref_set=false
-release_type_set=false
-npm_publish_set=false
-license_set=false
-[ -n "${REPO_FOUNDRY_PROFILE:-}" ] && profile_set=true
-[ -n "${REPO_FOUNDRY_LANGUAGES:-}" ] && languages_set=true
-[ -n "${REPO_FOUNDRY_FEATURES:-}" ] && features_set=true
-[ -n "${REPO_FOUNDRY_PACKAGE_MANAGER:-}" ] && package_manager_set=true
-[ -n "${REPO_FOUNDRY_RUNTIME_REPOSITORY:-}" ] && runtime_repository_set=true
-[ -n "${REPO_FOUNDRY_RUNTIME_REF:-}" ] && runtime_ref_set=true
-[ -n "${REPO_FOUNDRY_RELEASE_TYPE:-}" ] && release_type_set=true
-[ -n "${REPO_FOUNDRY_NPM_PUBLISH:-}" ] && npm_publish_set=true
-[ -n "${REPO_FOUNDRY_LICENSE:-}" ] && license_set=true
-tool_dir=""
-
-cleanup() {
-  if [ -n "$tool_dir" ]; then rm -rf "$tool_dir"; fi
-}
-trap cleanup EXIT
-
-usage() {
-  cat <<'EOF'
-Usage: init-repo.sh [options]
-
-Initialize or synchronize a repository from the shared baseline.
-
-Options:
-  --source PATH_OR_URL       Template source (default: REPO_FOUNDRY_SOURCE or GitHub owner)
-  --ref REF                  Template branch or tag (default: main)
-  --profile NAME             auto, application, monorepo, or minimal
-  --languages LIST           auto or comma-separated: typescript,rust,python,solidity
-  --features LIST            all or comma-separated optional features:
-                             ci,codeql,security,test,draft-pr,release-pr,release,dependabot
-  --package-manager NAME     auto, bun, pnpm, yarn, or npm
-  --runtime-repository OWNER/REPO  Reusable workflow runtime repository (auto from source)
-  --runtime-ref REF           Reusable workflow runtime tag or branch
-  --release-type NAME        auto, node, python, rust, or simple
-  --license NAME             gpl-3.0-or-later, agpl-3.0-or-later, mit, preserve, or none
-  --license-file PATH        Use an exact custom license file
-  --npm-publish              Enable npm publication in the release workflow
-  --dry-run                  Preview changes without writing files
-  --force                    Replace protected standard docs/templates
-  --prune                    Remove disabled standard workflows (never custom workflows)
-  --protection               Synchronize main branch required checks
-  --no-bootstrap             Skip mise/hooks/doctor bootstrap after init
-  -h, --help                 Show this help
-
-Examples:
-  bash .github/scripts/init-repo.sh --languages typescript,python
-  bash .github/scripts/init-repo.sh --languages rust --features ci,codeql,security,test
-  bash .github/scripts/init-repo.sh --features all --dry-run
-EOF
-}
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --source) source="${2:?missing source path or URL}"; shift 2 ;;
-    --ref) ref="${2:?missing ref}"; shift 2 ;;
-    --profile) profile="${2:?missing profile}"; profile_set=true; shift 2 ;;
-    --languages) languages="${2:?missing language list}"; languages_set=true; shift 2 ;;
-    --features) features="${2:?missing feature list}"; features_set=true; shift 2 ;;
-    --package-manager) package_manager="${2:?missing package manager}"; package_manager_set=true; shift 2 ;;
-    --runtime-repository) runtime_repository="${2:?missing runtime repository}"; runtime_repository_set=true; shift 2 ;;
-    --runtime-ref) runtime_ref="${2:?missing runtime ref}"; runtime_ref_set=true; shift 2 ;;
-    --release-type) release_type="${2:?missing release type}"; release_type_set=true; shift 2 ;;
-    --license) license="${2:?missing license}"; license_set=true; shift 2 ;;
-    --license-file) license_file="${2:?missing license file}"; shift 2 ;;
-    --npm-publish) npm_publish=true; shift ;;
-    --dry-run) dry_run=true; shift ;;
-    --force) force=true; shift ;;
-    --prune) prune=true; shift ;;
-    --protection) protection=true; shift ;;
-    --no-bootstrap) bootstrap=false; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *)
-      printf 'Unknown option: %s\n' "$1" >&2
-      exit 2
-      ;;
-  esac
-done
-
-config_path=.github/code-foundry.yml
-if [ -f "$config_path" ]; then
-  config_value() {
-    awk -F': ' -v key="$1" '$1 == key { value=$2; sub(/[[:space:]]+#.*/, "", value); gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); print value; exit }' "$config_path"
-  }
-  if [ "$profile_set" = false ]; then profile="$(config_value profile)"; fi
-  if [ "$languages_set" = false ]; then languages="$(config_value languages)"; fi
-  if [ "$features_set" = false ]; then features="$(config_value features)"; fi
-  if [ "$package_manager_set" = false ]; then package_manager="$(config_value package_manager)"; fi
-  if [ "$runtime_repository_set" = false ]; then runtime_repository="$(config_value runtime_repository)"; fi
-  if [ "$runtime_ref_set" = false ]; then runtime_ref="$(config_value runtime_ref)"; fi
-  if [ "$release_type_set" = false ]; then release_type="$(config_value release_type)"; fi
-  if [ "$npm_publish_set" = false ]; then npm_publish="$(config_value npm_publish)"; fi
-  if [ "$license_set" = false ]; then license="$(config_value license)"; fi
-  [ -n "$license_file" ] || license_file="$(config_value license_file)"
-  prune_standard="$(config_value prune_standard)"
-  [ -n "${REPO_FOUNDRY_RUNNER:-}" ] || runner="$(config_value runner)"
-  [ -n "${REPO_FOUNDRY_UNIT_RUNNER:-}" ] || unit_runner="$(config_value unit_runner)"
-  [ -n "${REPO_FOUNDRY_CI_RUNNER:-}" ] || ci_runner="$(config_value ci_runner)"
-  [ -n "${REPO_FOUNDRY_TEST_RUNNER:-}" ] || test_runner="$(config_value test_runner)"
-  [ -n "${REPO_FOUNDRY_SECURITY_RUNNER:-}" ] || security_runner="$(config_value security_runner)"
-  [ -n "${REPO_FOUNDRY_CODEQL_RUNNER:-}" ] || codeql_runner="$(config_value codeql_runner)"
-  [ -n "${REPO_FOUNDRY_PR_RUNNER:-}" ] || pr_runner="$(config_value pr_runner)"
-  [ -n "${REPO_FOUNDRY_RELEASE_RUNNER:-}" ] || release_runner="$(config_value release_runner)"
-  [ -n "${REPO_FOUNDRY_CACHE_PACKAGES:-}" ] || cache_packages="$(config_value cache_packages)"
-  [ -n "${REPO_FOUNDRY_CACHE_BUILD:-}" ] || cache_build="$(config_value cache_build)"
-  [ -n "${REPO_FOUNDRY_COVERAGE_MINIMUM:-}" ] || coverage_minimum="$(config_value coverage_minimum)"
-  [ -n "${REPO_FOUNDRY_TURBO_REMOTE:-}" ] || turbo_remote="$(config_value turbo_remote)"
-  [ -n "$runner" ] || runner=ubuntu-latest
-  [ -n "$unit_runner" ] || unit_runner=ubuntu-slim
-  [ -n "$ci_runner" ] || ci_runner="$runner"
-  [ -n "$test_runner" ] || test_runner="$runner"
-  [ -n "$security_runner" ] || security_runner=ubuntu-slim
-  [ -n "$codeql_runner" ] || codeql_runner="$runner"
-  [ -n "$pr_runner" ] || pr_runner=ubuntu-slim
-  [ -n "$release_runner" ] || release_runner=ubuntu-slim
-  [ -n "$cache_packages" ] || cache_packages=auto
-  [ -n "$cache_build" ] || cache_build=auto
-  [ -n "$coverage_minimum" ] || coverage_minimum=80
-  [ -n "$turbo_remote" ] || turbo_remote=auto
-  [ -n "$prune_standard" ] || prune_standard=false
-  [ "$prune_standard" = true ] && prune=true
-elif [ -f LICENSE ] && [ -z "${REPO_FOUNDRY_LICENSE:-}" ] && [ "$license_set" = false ]; then
-  # Existing projects keep their authored license unless the user explicitly
-  # selects a replacement in the generated configuration.
-  license=preserve
-fi
-
-case "$package_manager" in
-  auto|none|bun|pnpm|yarn|npm) ;;
-  *) printf 'Unsupported package manager: %s\n' "$package_manager" >&2; exit 2 ;;
-esac
-case "$release_type" in
-  auto|node|python|rust|simple|none) ;;
-  *) printf 'Unsupported release type: %s\n' "$release_type" >&2; exit 2 ;;
-esac
-
-script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd || true)"
-if [ -f "$script_dir/sync-template.sh" ]; then
-  sync_script="$script_dir/sync-template.sh"
-elif [ -d "$source" ] && [ -f "$source/.github/scripts/sync-template.sh" ]; then
-  sync_script="$source/.github/scripts/sync-template.sh"
-else
-  command -v git >/dev/null 2>&1 || { echo "git is required" >&2; exit 1; }
-  tool_dir="$(mktemp -d)"
-  git clone --quiet --depth 1 --branch "$ref" "$source" "$tool_dir/template-repo"
-  sync_script="$tool_dir/template-repo/.github/scripts/sync-template.sh"
-fi
-
-sync_args=(
-  --source "$source"
-  --ref "$ref"
-  --profile "$profile"
-  --languages "$languages"
-  --features "$features"
-  --package-manager "$package_manager"
-  --license "$license"
-)
-if [ -n "$runtime_repository" ]; then sync_args+=(--runtime-repository "$runtime_repository"); fi
-if [ -n "$runtime_ref" ]; then sync_args+=(--runtime-ref "$runtime_ref"); fi
-if [ -n "$license_file" ]; then sync_args+=(--license-file "$license_file"); fi
-if [ "$dry_run" = true ]; then sync_args+=(--check); else sync_args+=(--apply); fi
-if [ "$prune" = true ]; then sync_args+=(--prune); fi
-if [ "$force" = true ]; then sync_args+=(--force); fi
-REPO_FOUNDRY_INIT=true bash "$sync_script" "${sync_args[@]}"
-
-if [ "$dry_run" = true ]; then
-  printf '%s\n' 'Dry run complete; no files were changed.'
-  exit 0
-fi
-
-mkdir -p .github
-config_value() {
-  awk -F': ' -v key="$1" '$1 == key { value=$2; sub(/[[:space:]]+#.*/, "", value); gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); print value; exit }' .github/code-foundry.yml
-}
-profile="$(config_value profile 2>/dev/null || true)"
-languages="$(config_value languages 2>/dev/null || true)"
-features="$(config_value features 2>/dev/null || true)"
-package_manager="$(config_value package_manager 2>/dev/null || true)"
-runtime_repository="$(config_value runtime_repository 2>/dev/null || true)"
-runtime_ref="$(config_value runtime_ref 2>/dev/null || true)"
-release_type="$(config_value release_type 2>/dev/null || true)"
-npm_publish="$(config_value npm_publish 2>/dev/null || true)"
-license="$(config_value license 2>/dev/null || true)"
-{
-  printf 'version: 1\n'
-  printf 'profile: %s\n' "$profile"
-  printf 'languages: %s\n' "$languages"
-  printf 'features: %s\n' "$features"
-  printf 'package_manager: %s\n' "$package_manager"
-  printf 'runtime_repository: %s\n' "$runtime_repository"
-  printf 'runtime_ref: %s\n' "$runtime_ref"
-  printf 'runner: %s\n' "$runner"
-  printf 'unit_runner: %s\n' "$unit_runner"
-  printf 'ci_runner: %s\n' "$ci_runner"
-  printf 'test_runner: %s\n' "$test_runner"
-  printf 'security_runner: %s\n' "$security_runner"
-  printf 'codeql_runner: %s\n' "$codeql_runner"
-  printf 'pr_runner: %s\n' "$pr_runner"
-  printf 'release_runner: %s\n' "$release_runner"
-  printf 'release_type: %s\n' "$release_type"
-  printf 'npm_publish: %s\n' "$npm_publish"
-  printf 'license: %s\n' "$license"
-  if [ -n "$license_file" ]; then
-    printf 'license_file: %s\n' "$license_file"
-  fi
-  printf 'prune_standard: %s\n' "$prune_standard"
-  printf 'cache_packages: %s\n' "$cache_packages"
-  printf 'cache_build: %s\n' "$cache_build"
-  printf 'coverage_minimum: %s\n' "$coverage_minimum"
-  printf 'turbo_remote: %s\n' "$turbo_remote"
-} > .github/code-foundry.yml
-
-if [ "$bootstrap" = false ]; then
-  printf '%s\n' 'Bootstrap skipped.'
-  exit 0
-fi
-
-bootstrap_script="$script_dir/bootstrap.sh"
-[ -x "$bootstrap_script" ] || { echo "Package is missing bootstrap.sh" >&2; exit 1; }
-bash "$bootstrap_script"
-
-if [ "$protection" = true ]; then
-  remote="$(git remote get-url origin 2>/dev/null || true)"
-  repo="$(printf '%s\n' "$remote" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?$#\1#')"
-  [ -n "$repo" ] || { echo 'Could not determine GitHub repository from origin' >&2; exit 1; }
-  bash .github/scripts/sync-protection.sh --repo "$repo" --apply
-fi

package/.github/scripts/pre-commit.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-git diff --cached --check
-changed=$(git diff --cached --name-only)
-
-has_script() {
-  [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.[process.argv[1]] ? 0 : 1)' "$1"
-}
-
-package_manager() {
-  if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
-  elif [ -f pnpm-lock.yaml ]; then echo pnpm
-  elif [ -f yarn.lock ]; then echo yarn
-  else echo npm
-  fi
-}
-
-run_lint_staged() {
-  if ! has_script lint-staged; then return 1; fi
-  case "$(package_manager)" in
-    bun) bun run lint-staged ;;
-    pnpm) corepack pnpm run lint-staged ;;
-    yarn) corepack yarn run lint-staged ;;
-    npm) npm run lint-staged ;;
-  esac
-}
-
-if printf '%s\n' "$changed" | grep -Eq '\.(js|jsx|ts|tsx|json|md|mdx|yml|yaml)$'; then
-  if ! run_lint_staged; then
-    bash .github/scripts/ci.sh format
-    bash .github/scripts/ci.sh lint
-  fi
-fi
-
-if printf '%s\n' "$changed" | grep -Eq '\.rs$|(^|/)Cargo\.toml$'; then
-  cargo fmt --check
-  cargo clippy --all-targets -- -D warnings
-fi
-
-python_files=()
-python_config=false
-while IFS= read -r file; do
-  case "$file" in
-    *.py)
-      [ -f "$file" ] && python_files+=("$file")
-      ;;
-    pyproject.toml|requirements.txt|requirements-dev.txt)
-      python_config=true
-      ;;
-  esac
-done <<< "$changed"
-
-if [ "$python_config" = true ] || [ "${#python_files[@]}" -gt 0 ]; then
-  ruff_targets=(.)
-  [ "$python_config" = true ] || ruff_targets=("${python_files[@]}")
-  if [ -x .venv/bin/ruff ]; then
-    .venv/bin/ruff format --check "${ruff_targets[@]}"
-    .venv/bin/ruff check "${ruff_targets[@]}"
-  elif command -v ruff >/dev/null 2>&1; then
-    ruff format --check "${ruff_targets[@]}"
-    ruff check "${ruff_targets[@]}"
-  else
-    echo "Python files changed but Ruff is not installed; run the template setup first." >&2
-    exit 1
-  fi
-fi