code-foundry 0.31.13 → 0.31.16

package/.github/code-foundry.yml

@@ -4,6 +4,9 @@ profile: auto
 languages: typescript
 features: all
 codeql: auto
+codeql_rust_shards: '["all"]'
+codeql_rust_threads: 1
+codeql_rust_max_parallel: 1
 dependency_review: auto
 package_manager: bun
 toolchain: auto

package/.github/workflows/ci_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/.github/workflows/codeql.yml

@@ -18,6 +18,21 @@ on:
         required: false
         type: string
         default: ubuntu-latest
+      rust-shards:
+        description: JSON array of Rust scope sharding values. Use ["all"] for single-pass behavior.
+        required: false
+        type: string
+        default: '["all"]'
+      rust-threads:
+        description: Threads used for Rust extraction and analysis. Values above 1 opt into local parallelism.
+        required: false
+        type: string
+        default: '1'
+      rust-max-parallel:
+        description: Maximum Rust shard jobs allowed to run concurrently.
+        required: false
+        type: number
+        default: 1
 
 permissions:
   actions: read
@@ -280,6 +295,11 @@ jobs:
     if: >-
       needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.rust_available == 'true'
+    strategy:
+      fail-fast: false
+      max-parallel: ${{ inputs.rust-max-parallel }}
+      matrix:
+        shard: ${{ fromJson(inputs.rust-shards) }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -312,16 +332,78 @@ jobs:
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
-      - name: Analyze
+      - name: Configure Rust scope
         if: >-
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: ./.github/actions/codeql
+        id: scope
+        env:
+          RUST_SCOPE: ${{ matrix.shard }}
+        run: |
+          set -euo pipefail
+          scope="$RUST_SCOPE"
+          scope_id="$(node -e 'process.stdout.write(require("node:crypto").createHash("sha256").update(process.argv[1]).digest("hex").slice(0, 12))' "$scope")"
+          config_file="$RUNNER_TEMP/codeql-rust-$scope_id.yml"
+          cat > "$config_file" <<'EOF'
+          name: code-foundry-rust
+          EOF
+          if [ "$scope" != "all" ]; then
+            IFS=',' read -ra paths <<< "$scope"
+            if [ "${#paths[@]}" -eq 0 ]; then
+              echo "Empty Rust scope shard for CodeQL"
+              exit 1
+            fi
+            echo "paths:" >> "$config_file"
+            for path in "${paths[@]}"; do
+              path="${path#"${path%%[![:space:]]*}"}"
+              path="${path%"${path##*[![:space:]]}"}"
+              if [ -z "$path" ] ||
+                 [[ "$path" = /* ]] ||
+                 [[ "/$path/" = *"/../"* ]] ||
+                 [[ ! "$path" =~ ^[A-Za-z0-9._/@+\ -]+$ ]]; then
+                echo "Invalid Rust CodeQL shard path: $path" >&2
+                exit 1
+              fi
+              if ! git ls-files -- "$path" | grep -Eq '(^|/)(Cargo\.toml|[^/]+\.rs)$'; then
+                echo "Rust CodeQL shard path contains no tracked Rust source: $path" >&2
+                exit 1
+              fi
+              printf "  - '%s'\n" "$path" >> "$config_file"
+            done
+          fi
+          if [ -f Cargo.toml ] && grep -q '^paths:' "$config_file"; then
+            printf "  - 'Cargo.toml'\n" >> "$config_file"
+          fi
+          if [ -f Cargo.lock ] && grep -q '^paths:' "$config_file"; then
+            printf "  - 'Cargo.lock'\n" >> "$config_file"
+          fi
+          if [ -f rust-toolchain.toml ] && grep -q '^paths:' "$config_file"; then
+            printf "  - 'rust-toolchain.toml'\n" >> "$config_file"
+          fi
+          echo "config_file=$config_file" >> "$GITHUB_OUTPUT"
+          echo "scope_id=$scope_id" >> "$GITHUB_OUTPUT"
+      - name: Initialize
+        if: >-
+          needs.detect.outputs.enabled == 'true' &&
+          needs.detect.outputs.rust_available == 'true' &&
+          needs.detect.outputs.rust_changed == 'true'
+        uses: github/codeql-action/init@v4
         with:
-          language: rust
+          languages: rust
           build-mode: ${{ needs.detect.outputs.rust_build_mode }}
-          category: /language:rust
+          config-file: ${{ steps.scope.outputs.config_file }}
+          threads: ${{ inputs.rust-threads }}
+      - name: Analyze
+        if: >-
+          needs.detect.outputs.enabled == 'true' &&
+          needs.detect.outputs.rust_available == 'true' &&
+          needs.detect.outputs.rust_changed == 'true'
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:rust/${{ steps.scope.outputs.scope_id }}
+          upload-database: false
+          wait-for-processing: false
       - name: Not applicable
         if: >-
           needs.detect.outputs.enabled != 'true' ||

package/.github/workflows/codeql_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   schedule:
     - cron: '31 6 * * 1'
   workflow_dispatch:
@@ -23,4 +23,7 @@ jobs:
       runtime-repository: 0xPlayerOne/code-foundry
       runtime-ref: ${{ github.sha }}
       runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1
     secrets: inherit

package/.github/workflows/opencode-security_self-ci.yml

@@ -2,7 +2,7 @@ name: Code Foundry
 
 on:
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/.github/workflows/release-pr.yml

@@ -25,6 +25,12 @@ jobs:
       group: code-foundry-release-pr-${{ github.repository }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          filter: blob:none
+
       - name: Check
         id: check-pr
         run: |
@@ -44,16 +50,73 @@ jobs:
           fi
           COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
           TOTAL_COMMITS=$(gh api "$COMPARE_URL?per_page=1" --jq '.total_commits // 0')
+
+          MAIN_IS_ANCESTOR=false
+          if git merge-base --is-ancestor origin/main origin/staging; then
+            MAIN_IS_ANCESTOR=true
+          fi
+          DIRECT_FILES="$RUNNER_TEMP/release-direct-files.txt"
+          git diff --name-only origin/staging origin/main > "$DIRECT_FILES"
+          RELEASE_ONLY=false
+          if [ "$MAIN_IS_ANCESTOR" != true ] && [ -s "$DIRECT_FILES" ]; then
+            if node - "$DIRECT_FILES" <<'NODE'
+          const { existsSync, readFileSync } = require('node:fs')
+          const directFiles = readFileSync(process.argv[2], 'utf8').split(/\r?\n/).filter(Boolean)
+          const defaults = [
+            '.release-please-manifest.json', 'CHANGELOG.md', 'Cargo.lock', 'Cargo.toml',
+            'bun.lock', 'bun.lockb', 'package-lock.json', 'package.json', 'pnpm-lock.yaml',
+            'pyproject.toml', 'uv.lock', 'version.txt', 'yarn.lock',
+          ]
+          const allowed = new Set(defaults)
+          let config = {}
+          if (existsSync('release-please-config.json')) {
+            try { config = JSON.parse(readFileSync('release-please-config.json', 'utf8')) } catch {}
+          }
+          const addPath = (prefix, file) => {
+            const clean = file.replace(/^\.\//, '').replace(/\\/g, '/')
+            allowed.add(prefix ? `${prefix}/${clean}` : clean)
+          }
+          const addExtras = (entries, prefix = '') => {
+            if (!Array.isArray(entries)) return
+            for (const entry of entries) {
+              const file = typeof entry === 'string' ? entry : entry && typeof entry === 'object' ? entry.path : ''
+              if (typeof file === 'string' && file) addPath(prefix, file)
+            }
+          }
+          addExtras(config['extra-files'])
+          if (config.packages && typeof config.packages === 'object' && !Array.isArray(config.packages)) {
+            for (const [directory, value] of Object.entries(config.packages)) {
+              const prefix = directory === '.' ? '' : directory.replace(/\/$/, '')
+              for (const file of defaults) addPath(prefix, file)
+              if (value && typeof value === 'object' && !Array.isArray(value)) addExtras(value['extra-files'], prefix)
+            }
+          }
+          const unexpected = directFiles.filter((file) => !allowed.has(file))
+          if (unexpected.length) {
+            console.error(`Direct branch diff includes non-release paths: ${unexpected.join(', ')}`)
+            process.exit(1)
+          }
+          NODE
+            then
+              RELEASE_ONLY=true
+            fi
+          fi
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
           echo "commits=$TOTAL_COMMITS" >> "$GITHUB_OUTPUT"
           echo "tree_equal=$TREE_EQUAL" >> "$GITHUB_OUTPUT"
+          echo "release_only=$RELEASE_ONLY" >> "$GITHUB_OUTPUT"
 
       - name: No changes
-        if: steps.check-pr.outputs.existing == '0' && (steps.check-pr.outputs.commits == '0' || steps.check-pr.outputs.tree_equal == 'true')
-        run: echo 'staging is already aligned with main; no promotion PR is needed.'
+        if: steps.check-pr.outputs.existing == '0' && (steps.check-pr.outputs.commits == '0' || steps.check-pr.outputs.tree_equal == 'true' || steps.check-pr.outputs.release_only == 'true')
+        run: |
+          if [ "${{ steps.check-pr.outputs.release_only }}" = true ]; then
+            echo 'Only approved release metadata differs between rebased branch histories; reconciliation from main to staging is pending, so no promotion PR is needed.'
+          else
+            echo 'staging is already aligned with main; no promotion PR is needed.'
+          fi
 
       - name: Create
-        if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true'
+        if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
         run: |
           DATE=$(date +%Y-%m-%d)
           BODY_FILE="$RUNNER_TEMP/release-pr.md"

package/.github/workflows/release-pr_self-ci.yml

@@ -8,11 +8,8 @@ on:
   workflow_dispatch:
 
 permissions:
-  actions: read
   contents: read
   pull-requests: write
-  packages: read
-  security-events: write
 
 jobs:
   release-pr:
@@ -25,44 +22,3 @@ jobs:
     with:
       runner: ubuntu-slim
     secrets: inherit
-
-  ci:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: CI
-    uses: ./.github/workflows/ci.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-    secrets: inherit
-
-  test:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: Test
-    uses: ./.github/workflows/test.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-      unit-runner: ubuntu-slim
-    secrets: inherit
-
-  security:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: Security
-    uses: ./.github/workflows/security.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-slim
-    secrets: inherit
-
-  codeql:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: CodeQL
-    uses: ./.github/workflows/codeql.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-    secrets: inherit

package/.github/workflows/security_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/.github/workflows/test_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.31.16](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.15...v0.31.16) (2026-07-30)
+
+
+### Bug Fixes
+
+* **release:** avoid duplicate release PR checks ([42d7354](https://github.com/0xPlayerOne/code-foundry/commit/42d735404cd7b77d5a30a03a4fb8856096e931b0))
+* **workflows:** validate main promotion PRs ([4f41f90](https://github.com/0xPlayerOne/code-foundry/commit/4f41f90a3e4a5eec8e80d46c21083c1380655341))
+
+## [0.31.15](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.14...v0.31.15) (2026-07-30)
+
+
+### Bug Fixes
+
+* **release:** suppress release-only promotion loops ([fb35a6f](https://github.com/0xPlayerOne/code-foundry/commit/fb35a6f6e03a8ab4da65eeaeeeec579389b508b3))
+
+## [0.31.14](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.13...v0.31.14) (2026-07-30)
+
+
+### Bug Fixes
+
+* **codeql:** make Rust parallelism safe and configurable ([545454f](https://github.com/0xPlayerOne/code-foundry/commit/545454fa42a8bb4e6970ff858af186f1cba09900))
+
 ## [0.31.13](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.12...v0.31.13) (2026-07-30)
 
 

package/docs/CONFIGURATION.md

@@ -37,6 +37,9 @@ repository manifests and source
 | `toolchain` | `auto`, `native`, `mise` | Environment setup policy; defaults to `auto` |
 | `features` | `all` or a list | Standard workflow callers |
 | `codeql` | `auto`, `true`, `false` | CodeQL policy; public repositories default to enabled, non-public repositories default to disabled |
+| `codeql_rust_shards` | JSON array of paths | Rust scan scopes; `["all"]` keeps the safe single full scan |
+| `codeql_rust_threads` | integer, 1-64 | Threads per Rust CodeQL job; values above 1 opt into local parallelism |
+| `codeql_rust_max_parallel` | integer, 1-8 | Maximum Rust shard jobs allowed to run concurrently |
 | `dependency_review` | `auto`, `true`, `false` | Dependency Review policy; public repositories default to enabled, non-public repositories default to disabled |
 | `prune_standard` | `true` or `false` | Remove disabled standard callers |
 | `runtime_repository` | `OWNER/REPO` | Reusable workflow source |
@@ -59,3 +62,17 @@ short and replaceable; custom workflows and project documentation are kept.
 
 The generated configuration includes all defaults so humans and agents can
 understand the repository without memorizing flags or environment variables.
+
+Rust CodeQL defaults to one full scan with one worker. Large multi-crate
+repositories can opt into bounded parallelism, for example:
+
+```yaml
+codeql_rust_shards: '["crates/api","crates/worker"]'
+codeql_rust_threads: 2
+codeql_rust_max_parallel: 2
+```
+
+Each scoped shard must contain tracked Rust source. Code Foundry rejects
+absolute paths, parent traversal, duplicates, empty scopes, and more than eight
+shards. Do not split a single crate by arbitrary non-Rust directories: use
+`["all"]` when complete, non-overlapping source scopes are not available.

package/docs/WORKFLOWS.md

@@ -8,7 +8,7 @@ The default standard callers use:
 push:
   branches: [main, staging]
 pull_request:
-  branches: [staging]
+  branches: [main, staging]
 ```
 
 Draft PR automation may additionally listen to supported topic branches.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.13",
+  "version": "0.31.16",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -68,6 +68,7 @@ export function syncRepository(options) {
   let runtimeRef = configured(config.runtime_ref, sourceRuntimeRef)
   const toolchain = configured(config.toolchain, 'auto')
   const overlays = overlayPolicy(target, config)
+  const rustCodeql = validateRustCodeqlConfig(config)
   if (!['auto', 'native', 'mise'].includes(toolchain)) {
     throw new Error(`Unsupported toolchain: ${toolchain}; use auto, native, or mise.`)
   }
@@ -103,7 +104,7 @@ export function syncRepository(options) {
       content = Buffer.from(renderReleaseConfig(target, sourceFile))
     }
     if (file.endsWith('.yml') && file.startsWith('.github/workflows/')) {
-      content = Buffer.from(renderWorkflow(content.toString('utf8'), config, runtimeRepository, runtimeRef))
+      content = Buffer.from(renderWorkflow(content.toString('utf8'), config, runtimeRepository, runtimeRef, rustCodeql))
     }
     if (file === '.gitignore' && existsSync(destination)) {
       content = Buffer.from(mergeGitignore(content.toString('utf8'), readFileSync(destination, 'utf8')))
@@ -198,8 +199,14 @@ function sourcePath(source, file) {
   return join(source, file)
 }
 
-/** @param {string} content @param {Record<string,string>} config @param {string} repository @param {string} ref */
-function renderWorkflow(content, config, repository, ref) {
+/**
+ * @param {string} content
+ * @param {Record<string,string>} config
+ * @param {string} repository
+ * @param {string} ref
+ * @param {{ shards: string, threads: string, maxParallel: string }} rustCodeql
+ */
+function renderWorkflow(content, config, repository, ref, rustCodeql) {
   const localPrefix = 'uses: ./.github/workflows/'
   const remotePrefix = `uses: ${repository}/.github/workflows/`
   let rendered = content.replaceAll(localPrefix, remotePrefix)
@@ -218,9 +225,60 @@ function renderWorkflow(content, config, repository, ref) {
   const workflow = content.match(/\.github\/workflows\/([^/]+)\.yml/)?.[1]
   const runner = workflow ? runners[workflow] : undefined
   if (runner) rendered = rendered.replace(/^(\s+runner:)\s+.*$/m, `$1 ${runner}`)
+  if (workflow === 'codeql') {
+    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/m, `$1 '${rustCodeql.shards}'`)
+    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/m, `$1 '${rustCodeql.threads}'`)
+    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/m, `$1 ${rustCodeql.maxParallel}`)
+  }
   return rendered
 }
 
+/** @param {Record<string,string>} config */
+function validateRustCodeqlConfig(config) {
+  const threads = configured(config.codeql_rust_threads, '1')
+  const maxParallel = configured(config.codeql_rust_max_parallel, '1')
+  if (!/^(?:[1-9]|[1-5][0-9]|6[0-4])$/.test(threads)) {
+    throw new Error('Unsupported codeql_rust_threads; use an integer from 1 to 64.')
+  }
+  if (!/^(?:[1-8])$/.test(maxParallel)) {
+    throw new Error('Unsupported codeql_rust_max_parallel; use an integer from 1 to 8.')
+  }
+
+  const rawShards = configured(config.codeql_rust_shards, '["all"]')
+  let shards
+  try {
+    shards = JSON.parse(rawShards)
+  } catch {
+    throw new Error('Invalid codeql_rust_shards; use a JSON array of relative Rust source paths.')
+  }
+  if (!Array.isArray(shards) || shards.length === 0 || shards.length > 8) {
+    throw new Error('Invalid codeql_rust_shards; configure between 1 and 8 shards.')
+  }
+  const seen = new Set()
+  for (const shard of shards) {
+    if (typeof shard !== 'string' || shard.length === 0 || shard.length > 512 || seen.has(shard)) {
+      throw new Error('Invalid codeql_rust_shards; shards must be unique non-empty strings.')
+    }
+    seen.add(shard)
+    if (shard === 'all') continue
+    for (const candidate of shard.split(',')) {
+      const path = candidate.trim()
+      if (
+        !path ||
+        path.startsWith('/') ||
+        path.split('/').includes('..') ||
+        !/^[A-Za-z0-9._/@+ -]+$/.test(path)
+      ) {
+        throw new Error(`Invalid Rust CodeQL shard path: ${path || '(empty)'}`)
+      }
+    }
+  }
+  if (seen.has('all') && shards.length !== 1) {
+    throw new Error('Invalid codeql_rust_shards; "all" cannot be combined with scoped shards.')
+  }
+  return { shards: JSON.stringify(shards), threads, maxParallel }
+}
+
 /** @param {string} value */
 function escapeRegExp(value) { return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') }
 
@@ -269,6 +327,7 @@ function createDefaultConfig(root, source) {
   const runners = recommendRunners(root)
   return {
     version: '1', profile: detectProfile(root), languages, features: 'all', codeql: 'auto', dependency_review: 'auto', package_manager: packageManager,
+    codeql_rust_shards: '["all"]', codeql_rust_threads: '1', codeql_rust_max_parallel: '1',
     runtime_repository: '0xPlayerOne/code-foundry', runtime_ref: `v${readPackageVersion(source)}`,
     ...runners,
     toolchain: 'auto',

package/src/lib/release-policy.mjs

@@ -70,6 +70,26 @@ export function unexpectedReleasePaths(paths, allowed) {
     .filter((path) => !allowed.has(path))
 }
 
+/**
+ * Detect release-only divergence after a rebased staging promotion. A normal
+ * main-ancestor relationship must always remain promotable, even when the new
+ * staging commit happens to touch only release metadata.
+ * @param {{ mainIsAncestor: boolean, directChangedPaths?: string[], allowed?: Set<string> }} input
+ */
+export function classifyPromotion(input) {
+  const {
+    mainIsAncestor,
+    directChangedPaths = [],
+    allowed = approvedReleaseFiles(),
+  } = input
+  const paths = [...new Set(directChangedPaths.map((path) => path.trim()).filter(Boolean))]
+  const unexpected = unexpectedReleasePaths(paths, allowed)
+  return {
+    releaseOnly: !mainIsAncestor && paths.length > 0 && unexpected.length === 0,
+    unexpected,
+  }
+}
+
 /** @param {{ releasePleaseToken?: string, githubToken?: string }} input */
 export function selectReleaseCredential(input) {
   if (input.releasePleaseToken) return { token: input.releasePleaseToken, source: 'release-please-token', autoMerge: true }