code-foundry 0.27.9 → 0.27.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/.github/workflows/ci.yml +1 -1
  2. package/.github/workflows/ci_self-ci.yml +1 -1
  3. package/.github/workflows/codeql.yml +90 -17
  4. package/.github/workflows/codeql_self-ci.yml +1 -1
  5. package/.github/workflows/draft-pr.yml +1 -1
  6. package/.github/workflows/draft-pr_self-ci.yml +1 -1
  7. package/.github/workflows/release-pr.yml +1 -1
  8. package/.github/workflows/release-pr_self-ci.yml +1 -1
  9. package/.github/workflows/release.yml +1 -1
  10. package/.github/workflows/release_self-ci.yml +1 -1
  11. package/.github/workflows/security.yml +1 -1
  12. package/.github/workflows/security_self-ci.yml +1 -1
  13. package/.github/workflows/test.yml +1 -1
  14. package/.github/workflows/test_self-ci.yml +1 -1
  15. package/CHANGELOG.md +15 -0
  16. package/package.json +1 -1
  17. package/src/commands/sync.mjs +1 -0
package/.github/workflows/ci.yml CHANGED
@@ -35,7 +35,7 @@ env:
35
35
  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
36
36
 
37
37
  concurrency:
38
- group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
38
+ group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
39
39
  cancel-in-progress: true
40
40
 
41
41
  jobs:
package/.github/workflows/ci_self-ci.yml CHANGED
@@ -1,4 +1,4 @@
1
- name: CI
1
+ name: Code Foundry
2
2
 
3
3
  on:
4
4
  push:
package/.github/workflows/codeql.yml CHANGED
@@ -25,13 +25,14 @@ permissions:
25
25
  packages: read
26
26
  security-events: write
27
27
 
28
+ # Every analyzer emits a successful check, including when its language is not applicable.
28
29
  env:
29
30
  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
30
31
  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
31
32
  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
32
33
 
33
34
  concurrency:
34
- group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
35
+ group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
35
36
  cancel-in-progress: true
36
37
 
37
38
  jobs:
@@ -110,16 +111,20 @@ jobs:
110
111
  analyze-actions:
111
112
  name: Analyze (Actions)
112
113
  needs: detect
113
- if: >-
114
- needs.detect.outputs.enabled == 'true' &&
115
- needs.detect.outputs.actions_available == 'true' &&
116
- needs.detect.outputs.actions_changed == 'true'
117
114
  runs-on: ${{ inputs.runner }}
118
115
  timeout-minutes: 30
119
116
  steps:
120
117
  - name: Checkout
118
+ if: >-
119
+ needs.detect.outputs.enabled == 'true' &&
120
+ needs.detect.outputs.actions_available == 'true' &&
121
+ needs.detect.outputs.actions_changed == 'true'
121
122
  uses: actions/checkout@v7
122
123
  - name: Runtime
124
+ if: >-
125
+ needs.detect.outputs.enabled == 'true' &&
126
+ needs.detect.outputs.actions_available == 'true' &&
127
+ needs.detect.outputs.actions_changed == 'true'
123
128
  uses: actions/checkout@v7
124
129
  with:
125
130
  repository: ${{ inputs.runtime-repository }}
@@ -130,29 +135,47 @@ jobs:
130
135
  src/lib
131
136
  src/runtime.mjs
132
137
  - name: Install runtime
138
+ if: >-
139
+ needs.detect.outputs.enabled == 'true' &&
140
+ needs.detect.outputs.actions_available == 'true' &&
141
+ needs.detect.outputs.actions_changed == 'true'
133
142
  run: |
134
143
  mkdir -p .github/actions
135
144
  cp -R .code-foundry/.github/actions/. .github/actions/
136
145
  - name: Analyze
146
+ if: >-
147
+ needs.detect.outputs.enabled == 'true' &&
148
+ needs.detect.outputs.actions_available == 'true' &&
149
+ needs.detect.outputs.actions_changed == 'true'
137
150
  uses: ./.github/actions/codeql
138
151
  with:
139
152
  language: actions
140
153
  build-mode: ${{ needs.detect.outputs.actions_build_mode }}
141
154
  category: /language:actions
155
+ - name: Not applicable
156
+ if: >-
157
+ needs.detect.outputs.enabled != 'true' ||
158
+ needs.detect.outputs.actions_available != 'true' ||
159
+ needs.detect.outputs.actions_changed != 'true'
160
+ run: echo "CodeQL Actions analysis is not applicable to this change."
142
161
 
143
162
  analyze-typescript:
144
163
  name: Analyze (TypeScript)
145
164
  needs: detect
146
- if: >-
147
- needs.detect.outputs.enabled == 'true' &&
148
- needs.detect.outputs.javascript_available == 'true' &&
149
- needs.detect.outputs.javascript_changed == 'true'
150
165
  runs-on: ${{ inputs.runner }}
151
166
  timeout-minutes: 30
152
167
  steps:
153
168
  - name: Checkout
169
+ if: >-
170
+ needs.detect.outputs.enabled == 'true' &&
171
+ needs.detect.outputs.javascript_available == 'true' &&
172
+ needs.detect.outputs.javascript_changed == 'true'
154
173
  uses: actions/checkout@v7
155
174
  - name: Runtime
175
+ if: >-
176
+ needs.detect.outputs.enabled == 'true' &&
177
+ needs.detect.outputs.javascript_available == 'true' &&
178
+ needs.detect.outputs.javascript_changed == 'true'
156
179
  uses: actions/checkout@v7
157
180
  with:
158
181
  repository: ${{ inputs.runtime-repository }}
@@ -163,29 +186,47 @@ jobs:
163
186
  src/lib
164
187
  src/runtime.mjs
165
188
  - name: Install runtime
189
+ if: >-
190
+ needs.detect.outputs.enabled == 'true' &&
191
+ needs.detect.outputs.javascript_available == 'true' &&
192
+ needs.detect.outputs.javascript_changed == 'true'
166
193
  run: |
167
194
  mkdir -p .github/actions
168
195
  cp -R .code-foundry/.github/actions/. .github/actions/
169
196
  - name: Analyze
197
+ if: >-
198
+ needs.detect.outputs.enabled == 'true' &&
199
+ needs.detect.outputs.javascript_available == 'true' &&
200
+ needs.detect.outputs.javascript_changed == 'true'
170
201
  uses: ./.github/actions/codeql
171
202
  with:
172
203
  language: javascript-typescript
173
204
  build-mode: ${{ needs.detect.outputs.javascript_build_mode }}
174
205
  category: /language:javascript-typescript
206
+ - name: Not applicable
207
+ if: >-
208
+ needs.detect.outputs.enabled != 'true' ||
209
+ needs.detect.outputs.javascript_available != 'true' ||
210
+ needs.detect.outputs.javascript_changed != 'true'
211
+ run: echo "CodeQL TypeScript analysis is not applicable to this change."
175
212
 
176
213
  analyze-python:
177
214
  name: Analyze (Python)
178
215
  needs: detect
179
- if: >-
180
- needs.detect.outputs.enabled == 'true' &&
181
- needs.detect.outputs.python_available == 'true' &&
182
- needs.detect.outputs.python_changed == 'true'
183
216
  runs-on: ${{ inputs.runner }}
184
217
  timeout-minutes: 30
185
218
  steps:
186
219
  - name: Checkout
220
+ if: >-
221
+ needs.detect.outputs.enabled == 'true' &&
222
+ needs.detect.outputs.python_available == 'true' &&
223
+ needs.detect.outputs.python_changed == 'true'
187
224
  uses: actions/checkout@v7
188
225
  - name: Runtime
226
+ if: >-
227
+ needs.detect.outputs.enabled == 'true' &&
228
+ needs.detect.outputs.python_available == 'true' &&
229
+ needs.detect.outputs.python_changed == 'true'
189
230
  uses: actions/checkout@v7
190
231
  with:
191
232
  repository: ${{ inputs.runtime-repository }}
@@ -196,29 +237,47 @@ jobs:
196
237
  src/lib
197
238
  src/runtime.mjs
198
239
  - name: Install runtime
240
+ if: >-
241
+ needs.detect.outputs.enabled == 'true' &&
242
+ needs.detect.outputs.python_available == 'true' &&
243
+ needs.detect.outputs.python_changed == 'true'
199
244
  run: |
200
245
  mkdir -p .github/actions
201
246
  cp -R .code-foundry/.github/actions/. .github/actions/
202
247
  - name: Analyze
248
+ if: >-
249
+ needs.detect.outputs.enabled == 'true' &&
250
+ needs.detect.outputs.python_available == 'true' &&
251
+ needs.detect.outputs.python_changed == 'true'
203
252
  uses: ./.github/actions/codeql
204
253
  with:
205
254
  language: python
206
255
  build-mode: ${{ needs.detect.outputs.python_build_mode }}
207
256
  category: /language:python
257
+ - name: Not applicable
258
+ if: >-
259
+ needs.detect.outputs.enabled != 'true' ||
260
+ needs.detect.outputs.python_available != 'true' ||
261
+ needs.detect.outputs.python_changed != 'true'
262
+ run: echo "CodeQL Python analysis is not applicable to this change."
208
263
 
209
264
  analyze-rust:
210
265
  name: Analyze (Rust)
211
266
  needs: detect
212
- if: >-
213
- needs.detect.outputs.enabled == 'true' &&
214
- needs.detect.outputs.rust_available == 'true' &&
215
- needs.detect.outputs.rust_changed == 'true'
216
267
  runs-on: ${{ inputs.runner }}
217
268
  timeout-minutes: 30
218
269
  steps:
219
270
  - name: Checkout
271
+ if: >-
272
+ needs.detect.outputs.enabled == 'true' &&
273
+ needs.detect.outputs.rust_available == 'true' &&
274
+ needs.detect.outputs.rust_changed == 'true'
220
275
  uses: actions/checkout@v7
221
276
  - name: Runtime
277
+ if: >-
278
+ needs.detect.outputs.enabled == 'true' &&
279
+ needs.detect.outputs.rust_available == 'true' &&
280
+ needs.detect.outputs.rust_changed == 'true'
222
281
  uses: actions/checkout@v7
223
282
  with:
224
283
  repository: ${{ inputs.runtime-repository }}
@@ -229,12 +288,26 @@ jobs:
229
288
  src/lib
230
289
  src/runtime.mjs
231
290
  - name: Install runtime
291
+ if: >-
292
+ needs.detect.outputs.enabled == 'true' &&
293
+ needs.detect.outputs.rust_available == 'true' &&
294
+ needs.detect.outputs.rust_changed == 'true'
232
295
  run: |
233
296
  mkdir -p .github/actions
234
297
  cp -R .code-foundry/.github/actions/. .github/actions/
235
298
  - name: Analyze
299
+ if: >-
300
+ needs.detect.outputs.enabled == 'true' &&
301
+ needs.detect.outputs.rust_available == 'true' &&
302
+ needs.detect.outputs.rust_changed == 'true'
236
303
  uses: ./.github/actions/codeql
237
304
  with:
238
305
  language: rust
239
306
  build-mode: ${{ needs.detect.outputs.rust_build_mode }}
240
307
  category: /language:rust
308
+ - name: Not applicable
309
+ if: >-
310
+ needs.detect.outputs.enabled != 'true' ||
311
+ needs.detect.outputs.rust_available != 'true' ||
312
+ needs.detect.outputs.rust_changed != 'true'
313
+ run: echo "CodeQL Rust analysis is not applicable to this change."
package/.github/workflows/codeql_self-ci.yml CHANGED
@@ -1,4 +1,4 @@
1
- name: CodeQL
1
+ name: Code Foundry
2
2
 
3
3
  on:
4
4
  push:
package/.github/workflows/draft-pr.yml CHANGED
@@ -22,7 +22,7 @@ jobs:
22
22
  runs-on: ${{ inputs.runner }}
23
23
  timeout-minutes: 10
24
24
  concurrency:
25
- group: ${{ github.workflow }}-${{ github.ref }}
25
+ group: ${{ github.workflow_ref }}-${{ github.ref }}
26
26
  cancel-in-progress: true
27
27
  steps:
28
28
  - name: Check
package/.github/workflows/draft-pr_self-ci.yml CHANGED
@@ -1,4 +1,4 @@
1
- name: Draft PR
1
+ name: Code Foundry
2
2
 
3
3
  on:
4
4
  push:
package/.github/workflows/release-pr.yml CHANGED
@@ -22,7 +22,7 @@ jobs:
22
22
  runs-on: ${{ inputs.runner }}
23
23
  timeout-minutes: 10
24
24
  concurrency:
25
- group: ${{ github.workflow }}-${{ github.ref }}
25
+ group: ${{ github.workflow_ref }}-${{ github.ref }}
26
26
  cancel-in-progress: true
27
27
  steps:
28
28
  - name: Check
package/.github/workflows/release-pr_self-ci.yml CHANGED
@@ -1,4 +1,4 @@
1
- name: Release PR
1
+ name: Code Foundry
2
2
 
3
3
  on:
4
4
  push:
package/.github/workflows/release.yml CHANGED
@@ -28,7 +28,7 @@ jobs:
28
28
  runs-on: ${{ inputs.runner }}
29
29
  timeout-minutes: 20
30
30
  concurrency:
31
- group: ${{ github.workflow }}-${{ github.ref }}
31
+ group: ${{ github.workflow_ref }}-${{ github.ref }}
32
32
  cancel-in-progress: false
33
33
  outputs:
34
34
  release_created: ${{ steps.release.outputs.release_created || 'false' }}
package/.github/workflows/release_self-ci.yml CHANGED
@@ -1,4 +1,4 @@
1
- name: Release
1
+ name: Code Foundry
2
2
 
3
3
  on:
4
4
  push:
package/.github/workflows/security.yml CHANGED
@@ -31,7 +31,7 @@ env:
31
31
  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
32
32
 
33
33
  concurrency:
34
- group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
34
+ group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
35
35
  cancel-in-progress: true
36
36
 
37
37
  jobs:
package/.github/workflows/security_self-ci.yml CHANGED
@@ -1,4 +1,4 @@
1
- name: Security
1
+ name: Code Foundry
2
2
 
3
3
  on:
4
4
  push:
package/.github/workflows/test.yml CHANGED
@@ -40,7 +40,7 @@ env:
40
40
  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
41
41
 
42
42
  concurrency:
43
- group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
43
+ group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
44
44
  cancel-in-progress: true
45
45
 
46
46
  jobs:
package/.github/workflows/test_self-ci.yml CHANGED
@@ -1,4 +1,4 @@
1
- name: Test
1
+ name: Code Foundry
2
2
 
3
3
  on:
4
4
  push:
package/CHANGELOG.md CHANGED
@@ -1,5 +1,20 @@
1
1
  # Changelog
2
2
 
3
+ ## [0.27.11](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.10...v0.27.11) (2026-07-29)
4
+
5
+
6
+ ### Bug Fixes
7
+
8
+ * **ci:** isolate reusable workflow concurrency ([ddfc3a6](https://github.com/0xPlayerOne/code-foundry/commit/ddfc3a6b8860629a12494ffd8ef273dfb2c354b4))
9
+ * **workflows:** clarify Code Foundry job hierarchy ([124327e](https://github.com/0xPlayerOne/code-foundry/commit/124327ec3f8f5907eca478580a62b7485e0cfd98))
10
+
11
+ ## [0.27.10](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.9...v0.27.10) (2026-07-28)
12
+
13
+
14
+ ### Bug Fixes
15
+
16
+ * **codeql:** make analyzer checks protection-safe ([5ab240e](https://github.com/0xPlayerOne/code-foundry/commit/5ab240e6ce62c2d87acf92f8776a107cffefd860))
17
+
3
18
  ## [0.27.9](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.8...v0.27.9) (2026-07-28)
4
19
 
5
20
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "code-foundry",
3
- "version": "0.27.9",
3
+ "version": "0.27.11",
4
4
  "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
5
5
  "type": "module",
6
6
  "license": "AGPL-3.0-or-later",
package/src/commands/sync.mjs CHANGED
@@ -157,6 +157,7 @@ function renderWorkflow(content, config, repository, ref) {
157
157
  const remotePrefix = `uses: ${repository}/.github/workflows/`
158
158
  let rendered = content.replaceAll(localPrefix, remotePrefix)
159
159
  rendered = rendered.replace(new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'), `$&@${ref}`)
160
+ rendered = rendered.replace(/^(\s+runtime-ref:)\s+.*$/m, `$1 ${ref}`)
160
161
  /** @type {Record<string, string|undefined>} */
161
162
  const runners = {
162
163
  ci: config.ci_runner ?? config.runner,