codejson-core Refactor

.github/pull_request_template.md

@@ -0,0 +1,66 @@
+<!--
+Thank you for sending the PR! We appreciate you spending the time to work on
+these changes.
+Help us understand your motivation by explaining why you decided to make this change.
+Happy contributing!
+- Comments should be formatted to a width no greater than 80 columns.
+- Files should be exempt of trailing spaces.
+- We adhere to a specific format for commit messages. Please write your commit
+messages along these guidelines. Please keep the line width no greater than 80
+columns (You can use `fmt -n -p -w 80` to accomplish this).
+-->
+
+## module-name: One line description of your change (less than 72 characters)
+
+## Problem
+
+Explain the context and why you're making that change. What is the problem
+you're trying to solve? In some cases there is not a problem and this can be
+thought of being the motivation for your change.
+
+## Solution
+
+Describe the modifications you've done.
+
+## AI Usage
+- [ ] Generated AI was used in this contribution
+
+If checked, please provide an explanation on how AI was used in the development of this pull request:
+
+- **Description:** 
+  - _Include a high level description of Gen AI utilization_
+- **Type of Assistance:**
+  - [ ] Code generation
+  - [ ] Documentation
+  - [ ] Debugging
+  - [ ] Testing
+  - [ ] Refactoring
+  - [ ] Other: 
+- **AI System Used:** 
+  - [ ] ChatGPT
+  - [ ] Claude
+  - [ ] Gemini
+  - [ ] GitHub Copilot
+- **Level of Modification:**
+  - [ ] As-is
+  - [ ] Modified
+  - [ ] Used as inspiration
+
+## Result
+
+What will change as a result of your pull request? Note that sometimes this
+section is unnecessary because it is self-explanatory based on the solution.
+
+Some important notes regarding the summary line:
+
+* Describe what was done; not the result 
+* Use the active voice 
+* Use the present tense 
+* Capitalize properly 
+* Do not end in a period — this is a title/subject 
+* Prefix the subject with its scope
+
+## Test Plan
+
+(Write your test plan here. If you changed any code, please provide us with
+clear instructions on how you verified your changes work.)

CONTRIBUTING.md

@@ -38,17 +38,27 @@ npm run bundle
 npm test
 ```
 
-## Validation
+## Schema and Validation
 
-The action uses [Zod](https://zod.dev/) for schema validation, automatically validating code.json in two scenarios:
+The code.json schema, its validation rules, and the logic that merges freshly observed metadata into an existing file are owned by [codejson-core](https://github.com/DSACMS/codejson-core). This repository binds to that library's CMS profile in a single module, `src/codejson.ts`, and owns nothing else about the schema.
 
-### 1. Before Generation
+That means there is no schema to regenerate here. When `gov-codejson` publishes a new schema version, `codejson-core` cuts a release and Dependabot opens the bump.
 
-Every time the action generates or updates code.json (via schedule or workflow_dispatch), it validates the output before creating a PR or pushing. If validation fails, no changes are made.
+`src/codejson.ts` exposes three things to the rest of the action:
+
+- `assembleDraft` — merges observed metadata over the existing file. It runs against a permissive schema so it never rejects an incomplete file (see below).
+- `validateCodeJSON` — strict validation against the full CMS schema. An empty array means valid.
+- `draftBaseline` — the skeleton written for a repository that has no code.json yet.
+
+Validation runs in two scenarios:
+
+### 1. After Generation
+
+Every time the action generates or updates code.json (via schedule or workflow_dispatch), it validates the result and logs anything still missing as a warning. It **does not** fail the run: a newly generated file is a draft, with unobservable fields such as `status` and `longDescription` left blank on purpose for a human to complete from the pull request diff. Failing here would mean no repository could ever be bootstrapped.
 
 ### 2. On PR Edits
 
-When the `pull_request` trigger is configured, the action validates code.json whenever it's edited in a PR. This ensures users cannot accidentally merge invalid JSON.
+When the `pull_request` trigger is configured, the action validates code.json whenever it's edited in a PR and **fails the check** if it is invalid. This is the gate that keeps invalid files off your main branch.
 
 ### Workflow and Branching
 

README.md

@@ -13,6 +13,7 @@ This project provides a GitHub Action that helps federal agencies maintain their
 **Automatic Generation**
 
 - The action calculates metadata and creates a PR or pushes directly
+- Fields that cannot be observed are left blank and reported in the action log
 - Users can then fill in manual fields by editing the PR
 
 **PR Validation**
@@ -231,6 +232,12 @@ The automated code.json generator calculates specific fields by analyzing your r
 
 **reusedCode**: The generator scans your `package.json` and `requirements.txt` for dependencies published by federal agencies and lists them here, each linked to the agency repository it comes from. It matches against a curated list of federal packages (see below). Entries already in your code.json are preserved. No configuration needed.
 
+## Schema and Validation
+
+The code.json schema, its validation rules, and the logic that merges newly observed metadata into an existing file all live in [codejson-core](https://github.com/DSACMS/codejson-core), a standalone library shared by every tool that produces or validates code.json. This action binds to its CMS variant (`cmsProfile`) and owns only the parts core deliberately leaves out: reading your repository through GitHub's API, running SCC, scanning dependency manifests, and opening the pull request.
+
+The schema is version-pinned by the `codejson-core` release, so schema updates reach this action as a dependency bump rather than a code change. Dependabot opens those automatically.
+
 ## Federal Dependency List
 
 The `reusedCode` field is matched against a curated list of federal npm and PyPI packages in `src/gov-dependencies.data.ts`, each mapped to the agency and repository it comes from.
@@ -304,14 +311,16 @@ An up-to-date list of core team members can be found in [MAINTAINERS.md](MAINTAI
 ```
 .
 ├── src/
-│   ├── model.ts          # TypeScript interfaces for code.json schema
-│   ├── validation.ts     # Zod schema definitions and validation logic
-│   ├── main.ts           # Main action logic
-│   ├── helper.ts         # Helper functions for GitHub API interactions
-│   └── index.ts          # Action entrypoint
+│   ├── index.ts             # Action entrypoint
+│   ├── main.ts              # Main action logic
+│   ├── codejson.ts          # codejson-core bindings: schema, validation, assembly
+│   ├── helper.ts            # GitHub API, SCC, manifest reads, PR and push
+│   ├── create-deps.ts       # Wires the production dependencies
+│   ├── gov-dependencies.ts  # Lookup table of government-made dependencies
+│   └── types/               # Shared interfaces
 ├── .github/
-│   └── workflows/        # GitHub Actions workflow definitions
-└── action.yml            # Action metadata file
+│   └── workflows/           # GitHub Actions workflow definitions
+└── action.yml               # Action metadata file
 ```
 
 ## Development and Software Delivery Lifecycle

package.json

@@ -34,17 +34,15 @@
     "package:watch": "npm run package -- --watch",
     "test": "NODE_OPTIONS=--experimental-vm-modules NODE_NO_WARNINGS=1 npx jest",
     "all": "npm run format:write && npm run lint && npm run test && npm run coverage && npm run package",
-    "generate-schema": "npx tsx src/scripts/generate-schema.ts",
     "update-gov-dependencies": "npx tsx src/gov-update/run.ts"
   },
   "license": "MIT",
   "dependencies": {
     "@actions/core": "^3.0.0",
     "@octokit/action": "^7.0.0",
-    "json-schema-to-zod": "^2.7.0",
+    "codejson-core": "^0.1.1",
     "octokit-plugin-create-pull-request": "^6.0.1",
-    "zod": "^4.2.1",
-    "zod-validation-error": "^5.0.0"
+    "zod": "^4.2.1"
   },
   "devDependencies": {
     "@github/local-action": "^7.0.0",