Promote staging -> main (2026-07-28)

.github/actions/setup/action.yml

@@ -206,7 +206,6 @@ runs:
         javascript_package_manager=none
         configured_package_manager=""
         config_file=.github/code-foundry.yml
-        [ -f "$config_file" ] || config_file=.github/template.yml
         if [ -f "$config_file" ]; then
           configured_package_manager="$(awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file")"
         fi
@@ -389,7 +388,7 @@ runs:
             if [ "$javascript" = true ] && task_language_needed javascript; then
               add_configured_tool node
               if { [ -f bun.lock ] || [ -f bun.lockb ] ||
-                config_file=.github/code-foundry.yml; [ -f "$config_file" ] || config_file=.github/template.yml; awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file" 2>/dev/null | grep -qx bun; }; then
+                config_file=.github/code-foundry.yml; awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file" 2>/dev/null | grep -qx bun; }; then
                 add_configured_tool bun
               fi
             fi
@@ -403,7 +402,7 @@ runs:
           javascript)
             configured_tool node && mise_tools+=(node)
             if { [ -f bun.lock ] || [ -f bun.lockb ] ||
-              config_file=.github/code-foundry.yml; [ -f "$config_file" ] || config_file=.github/template.yml; awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file" 2>/dev/null | grep -qx bun; } && configured_tool bun; then
+              config_file=.github/code-foundry.yml; awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file" 2>/dev/null | grep -qx bun; } && configured_tool bun; then
               mise_tools+=(bun)
             fi
             ;;
@@ -451,12 +450,12 @@ runs:
         (inputs.cache-installed == 'true' ||
         steps.profile.outputs.javascript_package_manager == 'pnpm' ||
         steps.profile.outputs.javascript_package_manager == 'yarn') &&
-        hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/.npmrc', '**/.yarnrc*', '**/.pnpmfile.cjs', '.github/code-foundry.yml', '.github/template.yml', '.mise.toml', 'mise.lock') != ''
+        hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/.npmrc', '**/.yarnrc*', '**/.pnpmfile.cjs', '.github/code-foundry.yml', '.mise.toml', 'mise.lock') != ''
       uses: actions/cache/restore@v5
       with:
         path: |
           **/node_modules
-        key: ${{ runner.os }}-javascript-installed-v3-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/.npmrc', '**/.yarnrc*', '**/.pnpmfile.cjs', '.github/code-foundry.yml', '.github/template.yml', '.mise.toml', 'mise.lock') }}
+        key: ${{ runner.os }}-javascript-installed-v3-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/.npmrc', '**/.yarnrc*', '**/.pnpmfile.cjs', '.github/code-foundry.yml', '.mise.toml', 'mise.lock') }}
     - name: Restore Bun dependencies
       id: javascript-bun-cache-restore
       if: >-
@@ -465,12 +464,12 @@ runs:
         inputs.cache-installed != 'false' &&
         steps.profile.outputs.javascript_dependencies == 'true' &&
         steps.profile.outputs.javascript_package_manager == 'bun' &&
-        hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/.npmrc', '.github/code-foundry.yml', '.github/template.yml', '.mise.toml', 'mise.lock') != ''
+        hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/.npmrc', '.github/code-foundry.yml', '.mise.toml', 'mise.lock') != ''
       uses: actions/cache/restore@v5
       with:
         path: |
           **/node_modules
-        key: ${{ runner.os }}-javascript-installed-v4-bun-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/.npmrc', '.github/code-foundry.yml', '.github/template.yml', '.mise.toml', 'mise.lock') }}
+        key: ${{ runner.os }}-javascript-installed-v4-bun-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/.npmrc', '.github/code-foundry.yml', '.mise.toml', 'mise.lock') }}
     - name: Detect Bun dependencies
       id: javascript-bun-dependencies
       if: >-
@@ -737,7 +736,7 @@ runs:
       with:
         path: |
           **/node_modules
-        key: ${{ runner.os }}-javascript-installed-v4-bun-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/.npmrc', '.github/code-foundry.yml', '.github/template.yml', '.mise.toml', 'mise.lock') }}
+        key: ${{ runner.os }}-javascript-installed-v4-bun-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/.npmrc', '.github/code-foundry.yml', '.mise.toml', 'mise.lock') }}
     - name: Save installed JavaScript dependencies
       if: >-
         inputs.cache-save == 'true' &&
@@ -753,7 +752,7 @@ runs:
       with:
         path: |
           **/node_modules
-        key: ${{ runner.os }}-javascript-installed-v3-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/.npmrc', '**/.yarnrc*', '**/.pnpmfile.cjs', '.github/code-foundry.yml', '.github/template.yml', '.mise.toml', 'mise.lock') }}
+        key: ${{ runner.os }}-javascript-installed-v3-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/.npmrc', '**/.yarnrc*', '**/.pnpmfile.cjs', '.github/code-foundry.yml', '.mise.toml', 'mise.lock') }}
     - name: Save JavaScript packages
       if: >-
         inputs.cache-save == 'true' &&

.github/code-foundry.yml

@@ -1,12 +1,11 @@
 # Canonical Code Foundry repository configuration.
 version: 1
-template: code-foundry@latest
 profile: auto
 languages: typescript
 features: all
 package_manager: bun
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v0.22.0
+runtime_ref: v0.22.2
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later

.github/code-foundry.yml.example

@@ -1,5 +1,5 @@
-# Copy this file to .github/code-foundry.yml, edit the values you need, and run:
-#   npx code-foundry init --config .github/code-foundry.yml
+# `npx code-foundry init` creates this file automatically. Edit it and run
+# `npx code-foundry sync` whenever you want to change the baseline.
 # Omitted keys use automatic detection and the standard defaults. See
 # docs/CONFIGURATION.md for the complete visual reference.
 

.github/scripts/bootstrap.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 git config core.hooksPath .githooks
 
 if command -v mise >/dev/null 2>&1; then
+  mise trust --yes .mise.toml >/dev/null 2>&1 || true
   if [ -f .mise.toml ] && [ ! -f mise.lock ]; then
     if MISE_TRUSTED_CONFIG_PATHS="$PWD" mise lock >/dev/null 2>&1; then
       printf '%s\n' 'Initialized mise.lock for deterministic CI tool installs.'

.github/scripts/changed-files.sh

@@ -72,7 +72,7 @@ repo_foundry_pr_dependencies_unchanged() {
   while IFS= read -r file; do
     case "$file" in
       .github/workflows/security.yml|.github/scripts/security.sh|.github/scripts/changed-files.sh|\
-      .github/actions/setup/action.yml|.github/code-foundry.yml|.github/template.yml|.mise.toml|mise.lock|\
+      .github/actions/setup/action.yml|.github/code-foundry.yml|.mise.toml|mise.lock|\
       .github/security-audit-allowlist.txt)
         return 1
         ;;

.github/scripts/ci.sh

@@ -95,7 +95,6 @@ package_manager() {
     configured="$(bash .github/scripts/profile.sh get package_manager 2>/dev/null || true)"
   else
     config_file=.github/code-foundry.yml
-    [ -f "$config_file" ] || config_file=.github/template.yml
     if [ -f "$config_file" ]; then
       configured="$(awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file")"
     fi

.github/scripts/codeql-languages.sh

@@ -27,7 +27,6 @@ if [ -x .github/scripts/profile.sh ]; then
   configured="$(bash .github/scripts/profile.sh get languages 2>/dev/null || true)"
 else
   config_file=.github/code-foundry.yml
-  [ -f "$config_file" ] || config_file=.github/template.yml
   if [ -f "$config_file" ]; then
     configured="$(awk -F': ' '/^languages:/ {print $2; exit}' "$config_file")"
   fi

.github/scripts/doctor.sh

@@ -5,7 +5,6 @@ errors=0
 
 configured_features="all"
 config_file=.github/code-foundry.yml
-[ -f "$config_file" ] || config_file=.github/template.yml
 if [ -f "$config_file" ]; then
   configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' "$config_file")"
   [ -n "$configured_features" ] || configured_features="all"

.github/scripts/init-repo.sh

@@ -3,7 +3,6 @@ set -euo pipefail
 
 source="${REPO_FOUNDRY_SOURCE:-https://github.com/${GITHUB_REPOSITORY_OWNER:-OWNER}/code-foundry.git}"
 ref="main"
-config_file="${REPO_FOUNDRY_CONFIG:-}"
 profile="${REPO_FOUNDRY_PROFILE:-auto}"
 protection=false
 dry_run=false
@@ -67,7 +66,6 @@ Initialize or synchronize a repository from the shared baseline.
 Options:
   --source PATH_OR_URL       Template source (default: REPO_FOUNDRY_SOURCE or GitHub owner)
   --ref REF                  Template branch or tag (default: main)
-  --config PATH              Use a .github/code-foundry.yml configuration file
   --profile NAME             auto, application, monorepo, or minimal
   --languages LIST           auto or comma-separated: typescript,rust,python,solidity
   --features LIST            all or comma-separated optional features:
@@ -97,7 +95,6 @@ while [ "$#" -gt 0 ]; do
   case "$1" in
     --source) source="${2:?missing source path or URL}"; shift 2 ;;
     --ref) ref="${2:?missing ref}"; shift 2 ;;
-    --config) config_file="${2:?missing config path}"; shift 2 ;;
     --profile) profile="${2:?missing profile}"; profile_set=true; shift 2 ;;
     --languages) languages="${2:?missing language list}"; languages_set=true; shift 2 ;;
     --features) features="${2:?missing feature list}"; features_set=true; shift 2 ;;
@@ -121,16 +118,7 @@ while [ "$#" -gt 0 ]; do
   esac
 done
 
-if [ -n "$config_file" ]; then
-  [ -f "$config_file" ] || { printf 'Configuration file not found: %s\n' "$config_file" >&2; exit 1; }
-  mkdir -p .github
-  if [ "$(cd -- "$(dirname -- "$config_file")" && pwd)/$(basename -- "$config_file")" != "$(pwd)/.github/code-foundry.yml" ]; then
-    cp "$config_file" .github/code-foundry.yml
-  fi
-fi
-
 config_path=.github/code-foundry.yml
-[ -f "$config_path" ] || config_path=.github/template.yml
 if [ -f "$config_path" ]; then
   config_value() {
     awk -F': ' -v key="$1" '$1 == key { value=$2; sub(/[[:space:]]+#.*/, "", value); gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); print value; exit }' "$config_path"
@@ -210,7 +198,7 @@ if [ -n "$license_file" ]; then sync_args+=(--license-file "$license_file"); fi
 if [ "$dry_run" = true ]; then sync_args+=(--check); else sync_args+=(--apply); fi
 if [ "$prune" = true ]; then sync_args+=(--prune); fi
 if [ "$force" = true ]; then sync_args+=(--force); fi
-bash "$sync_script" "${sync_args[@]}"
+REPO_FOUNDRY_INIT=true bash "$sync_script" "${sync_args[@]}"
 
 if [ "$dry_run" = true ]; then
   printf '%s\n' 'Dry run complete; no files were changed.'
@@ -221,7 +209,6 @@ mkdir -p .github
 config_value() {
   awk -F': ' -v key="$1" '$1 == key { value=$2; sub(/[[:space:]]+#.*/, "", value); gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); print value; exit }' .github/code-foundry.yml
 }
-template_ref="$(config_value template 2>/dev/null || true)"
 profile="$(config_value profile 2>/dev/null || true)"
 languages="$(config_value languages 2>/dev/null || true)"
 features="$(config_value features 2>/dev/null || true)"
@@ -233,9 +220,6 @@ npm_publish="$(config_value npm_publish 2>/dev/null || true)"
 license="$(config_value license 2>/dev/null || true)"
 {
   printf 'version: 1\n'
-  if [ -n "$template_ref" ]; then
-    printf 'template: %s\n' "$template_ref"
-  fi
   printf 'profile: %s\n' "$profile"
   printf 'languages: %s\n' "$languages"
   printf 'features: %s\n' "$features"
@@ -263,11 +247,6 @@ license="$(config_value license 2>/dev/null || true)"
   printf 'turbo_remote: %s\n' "$turbo_remote"
 } > .github/code-foundry.yml
 
-if [ "$config_path" = .github/template.yml ] && [ -f .github/template.yml ]; then
-  rm .github/template.yml
-  printf '%s\n' 'Migrated .github/template.yml to .github/code-foundry.yml.'
-fi
-
 if [ "$bootstrap" = false ]; then
   printf '%s\n' 'Bootstrap skipped.'
   exit 0

.github/scripts/profile.sh

@@ -3,8 +3,7 @@ set -euo pipefail
 
 # Resolve repository settings with this precedence:
 # explicit REPO_FOUNDRY_* values (CLI callers can export them), then
-# .github/code-foundry.yml, then detected defaults. A legacy
-# .github/template.yml is accepted during migration.
+# .github/code-foundry.yml, then detected defaults.
 
 root="${REPO_FOUNDRY_ROOT:-$PWD}"
 command="detect"
@@ -33,7 +32,6 @@ done
 
 cd "$root"
 template_file=.github/code-foundry.yml
-[ -f "$template_file" ] || template_file=.github/template.yml
 
 config_value() {
   local key="$1"

.github/scripts/security.sh

@@ -107,7 +107,6 @@ package_manager() {
     configured="$(bash .github/scripts/profile.sh get package_manager 2>/dev/null || true)"
   else
     config_file=.github/code-foundry.yml
-    [ -f "$config_file" ] || config_file=.github/template.yml
     if [ -f "$config_file" ]; then
       configured="$(awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file")"
     fi

.github/scripts/sync-protection.sh

@@ -8,7 +8,6 @@ configured_features="all"
 configured_languages="auto"
 
 config_file=.github/code-foundry.yml
-[ -f "$config_file" ] || config_file=.github/template.yml
 if [ -f "$config_file" ]; then
   configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' "$config_file")"
   configured_languages="$(awk -F': ' '/^languages:/ {print $2; exit}' "$config_file")"

.github/scripts/sync-template.sh

@@ -13,7 +13,6 @@ Options:
   --languages LIST  auto or comma-separated: typescript,rust,python,solidity
   --features LIST   all or comma-separated standard features
   --package-manager NAME  auto, bun, pnpm, yarn, or npm
-  --config PATH  Use a .github/code-foundry.yml configuration file
   --runtime-repository OWNER/REPO  Reusable workflow runtime repository
   --runtime-ref REF  Reusable workflow runtime tag or branch
   --license NAME     preserve, agpl-3.0-or-later, mit, or none
@@ -28,7 +27,6 @@ EOF
 source_ref="main"
 mode="check"
 source=""
-config_file="${REPO_FOUNDRY_CONFIG:-}"
 temp_dir=""
 profile="${REPO_FOUNDRY_PROFILE:-auto}"
 languages="${REPO_FOUNDRY_LANGUAGES:-auto}"
@@ -51,7 +49,6 @@ runtime_repository_set=false
 [ -n "${REPO_FOUNDRY_RUNTIME_REPOSITORY:-}" ] && runtime_repository_set=true
 runtime_ref_set=false
 [ -n "${REPO_FOUNDRY_RUNTIME_REF:-}" ] && runtime_ref_set=true
-template_ref=""
 release_type="${REPO_FOUNDRY_RELEASE_TYPE:-auto}"
 npm_publish="${REPO_FOUNDRY_NPM_PUBLISH:-false}"
 prune_standard="${REPO_FOUNDRY_PRUNE_STANDARD:-false}"
@@ -127,7 +124,6 @@ while [ "$#" -gt 0 ]; do
   case "$1" in
     --source) source="${2:?missing source path or URL}"; shift 2 ;;
     --ref) source_ref="${2:?missing ref}"; shift 2 ;;
-    --config) config_file="${2:?missing config path}"; shift 2 ;;
     --profile) profile="${2:?missing profile}"; profile_set=true; shift 2 ;;
     --languages) languages="${2:?missing language list}"; languages_set=true; shift 2 ;;
     --features) features="${2:?missing feature list}"; features_set=true; shift 2 ;;
@@ -146,15 +142,11 @@ while [ "$#" -gt 0 ]; do
 done
 
 [ -n "$source" ] || { usage >&2; exit 2; }
-if [ -n "$config_file" ]; then
-  [ -f "$config_file" ] || { printf 'Configuration file not found: %s\n' "$config_file" >&2; exit 1; }
-  mkdir -p .github
-  if [ "$(cd -- "$(dirname -- "$config_file")" && pwd)/$(basename -- "$config_file")" != "$(pwd)/.github/code-foundry.yml" ]; then
-    cp "$config_file" .github/code-foundry.yml
-  fi
-fi
 config_path=.github/code-foundry.yml
-[ -f "$config_path" ] || config_path=.github/template.yml
+[ -f "$config_path" ] || [ "${REPO_FOUNDRY_INIT:-false}" = true ] || {
+  printf '%s\n' 'Missing .github/code-foundry.yml; run `npx code-foundry init` first.' >&2
+  exit 1
+}
 if [ -f "$config_path" ]; then
   config_value() {
     awk -F': ' -v key="$1" '$1 == key { value=$2; sub(/[[:space:]]+#.*/, "", value); gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); print value; exit }' "$config_path"
@@ -180,7 +172,6 @@ if [ -f "$config_path" ]; then
   if [ "$runtime_ref_set" = false ]; then
     runtime_ref="$(config_value runtime_ref)"
   fi
-  template_ref="$(config_value template)"
   if [ "$release_type_set" != true ]; then
     configured_release_type="$(config_value release_type)"
     [ -n "$configured_release_type" ] && release_type="$configured_release_type"
@@ -280,7 +271,6 @@ fi
 # Prefer an explicit CLI/environment value, then the target's saved contract,
 # then the source template's contract, and finally the stable public runtime.
 source_config="$template_root/.github/code-foundry.yml"
-[ -f "$source_config" ] || source_config="$template_root/.github/template.yml"
 if [ -z "$runtime_ref" ] && [ -f "$source_config" ]; then
   runtime_ref="$(awk -F': ' '/^runtime_ref:/ {print $2; exit}' "$source_config")"
 fi
@@ -311,11 +301,6 @@ if [ -f "$template_root/.github/scripts/profile.sh" ]; then
   npm_publish="$(printf '%s\n' "$profile_output" | awk -F= '$1 == "npm_publish" {print substr($0, index($0, "=") + 1)}')"
 fi
 
-if [ -f "$template_root/package.json" ]; then
-  template_version="$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' "$template_root/package.json")"
-  [ -n "$template_version" ] && template_ref="code-foundry@$template_version"
-fi
-
 files=(
   .editorconfig
   .gitattributes
@@ -472,7 +457,6 @@ done
 source_runtime_repository=""
 source_runtime_ref=""
 source_config="$template_root/.github/code-foundry.yml"
-[ -f "$source_config" ] || source_config="$template_root/.github/template.yml"
 if [ -f "$source_config" ]; then
   source_runtime_repository="$(awk -F': ' '/^runtime_repository:/ {print $2; exit}' "$source_config")"
   source_runtime_ref="$(awk -F': ' '/^runtime_ref:/ {print $2; exit}' "$source_config")"
@@ -671,9 +655,6 @@ if [ "$mode" = "apply" ]; then
   mkdir -p .github
   {
     printf 'version: 1\n'
-    if [ -n "$template_ref" ]; then
-      printf 'template: %s\n' "$template_ref"
-    fi
     printf 'profile: %s\n' "$profile"
     printf 'languages: %s\n' "$languages"
     printf 'features: %s\n' "$features"
@@ -702,10 +683,6 @@ if [ "$mode" = "apply" ]; then
       printf 'license_file: %s\n' "$license_file"
     fi
   } > .github/code-foundry.yml
-  if [ "$config_path" = .github/template.yml ] && [ -f .github/template.yml ]; then
-    rm .github/template.yml
-    printf '%s\n' 'Migrated .github/template.yml to .github/code-foundry.yml.'
-  fi
 fi
 
 if [ "$prune" = true ]; then

.github/workflows/reusable-release.yml

@@ -48,7 +48,6 @@ jobs:
             npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
           else
             config_file=.github/code-foundry.yml
-            [ -f "$config_file" ] || config_file=.github/template.yml
             release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
             npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
           fi