code-foundry 0.31.3 → 0.31.5

package/.github/workflows/ci.yml

@@ -35,7 +35,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ env:
   REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
 
 concurrency:
-  group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-codeql-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/draft-pr.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     concurrency:
-      group: ${{ github.workflow_ref }}-${{ github.ref }}
+      group: code-foundry-draft-pr-${{ github.repository }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
       - name: Check

package/.github/workflows/promotion_self-ci.yml

@@ -0,0 +1,58 @@
+name: Code Foundry
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+  pull-requests: read
+  security-events: write
+
+jobs:
+  ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+    secrets: inherit
+
+  test:
+    name: Test
+    uses: ./.github/workflows/test.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+      unit-runner: ubuntu-slim
+    secrets: inherit
+
+  security:
+    name: Security
+    uses: ./.github/workflows/security.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-slim
+    secrets: inherit
+
+  codeql:
+    name: CodeQL
+    uses: ./.github/workflows/codeql.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+    secrets: inherit
+
+  release-pr:
+    name: Release PR / Create
+    runs-on: ubuntu-slim
+    steps:
+      - name: Validate promotion
+        run: echo 'Main promotion validation is handled by this workflow; version release remains a post-merge action.'

package/.github/workflows/release-pr.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     concurrency:
-      group: ${{ github.workflow_ref }}-${{ github.ref }}
+      group: code-foundry-release-pr-${{ github.repository }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
       - name: Check
@@ -91,9 +91,23 @@ jobs:
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 
-          gh pr create \
+          if ! gh pr create \
             --repo "$GITHUB_REPOSITORY" \
             --base main \
             --head staging \
             --title "Promote staging -> main ($DATE)" \
-            --body-file "$BODY_FILE"
+            --body-file "$BODY_FILE"; then
+            EXISTING_NUMBER=$(gh pr list \
+              --repo "$GITHUB_REPOSITORY" \
+              --limit 1 \
+              --base main \
+              --head staging \
+              --state open \
+              --json number \
+              --jq '.[0].number // empty')
+            if [ -z "$EXISTING_NUMBER" ]; then
+              echo 'Pull request creation failed and no existing promotion PR was found.' >&2
+              exit 1
+            fi
+            echo "Promotion PR #$EXISTING_NUMBER already exists; treating the create race as success."
+          fi

package/.github/workflows/release-pr_self-ci.yml

@@ -3,6 +3,7 @@ name: Code Foundry
 on:
   push:
     branches: [staging]
+  workflow_dispatch:
 
 permissions:
   contents: read

package/.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
     concurrency:
-      group: ${{ github.workflow_ref }}-${{ github.ref }}
+      group: code-foundry-release-${{ github.repository }}-${{ github.ref }}
       cancel-in-progress: false
     outputs:
       release_created: ${{ steps.release.outputs.release_created || 'false' }}

package/.github/workflows/security.yml

@@ -31,7 +31,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/test.yml

@@ -40,7 +40,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: ${{ github.workflow_ref }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-test-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.31.5](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.4...v0.31.5) (2026-07-30)
+
+
+### Bug Fixes
+
+* **ci:** isolate reusable workflow concurrency ([330a939](https://github.com/0xPlayerOne/code-foundry/commit/330a9396390aef11a482bf370dbbbee22151759e))
+* **ci:** use stable workflow concurrency keys ([a7eca35](https://github.com/0xPlayerOne/code-foundry/commit/a7eca35836f24f9fb240234b999462f95fa4e7da))
+* **ci:** validate main promotion pull requests ([00377bb](https://github.com/0xPlayerOne/code-foundry/commit/00377bb6e54288e296245efa1466e8e61477f25a))
+* **release:** allow manual promotion validation ([aaa453f](https://github.com/0xPlayerOne/code-foundry/commit/aaa453f3bc63c4e256352f094468f983dad236a9))
+* **release:** promote staging runtime safeguards ([e53df8c](https://github.com/0xPlayerOne/code-foundry/commit/e53df8cca59e59a8ffd7aad3f05effc915ba2196))
+
+## [0.31.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.3...v0.31.4) (2026-07-29)
+
+
+### Bug Fixes
+
+* harden fleet pins and github doctor ([c6efa7a](https://github.com/0xPlayerOne/code-foundry/commit/c6efa7a436308959950d958c5897574193cd763b))
+
 ## [0.31.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.2...v0.31.3) (2026-07-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.3",
+  "version": "0.31.5",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/fleet.mjs

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { existsSync, mkdtempSync, readFileSync, readdirSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { spawnSync } from 'node:child_process'
@@ -73,6 +73,17 @@ function upgradeRepository(repository, source, version) {
     const add = spawnSync('git', ['-C', repository.path, 'worktree', 'add', '-b', branch, temporary, baseline.stdout.trim()], { encoding: 'utf8' })
     if (add.status !== 0) return { path: repository.path, status: 'skipped', reason: add.stderr.trim() || 'unable to create isolated worktree' }
     const result = syncRepository({ target: temporary, source, force: false })
+    const configFile = join(temporary, '.github/code-foundry.yml')
+    if (existsSync(configFile)) {
+      const current = readFileSync(configFile, 'utf8')
+      const updated = current.match(/^runtime_ref:\s*.*$/m)
+        ? current.replace(/^runtime_ref:\s*.*$/m, `runtime_ref: ${version}`)
+        : `${current.trimEnd()}\nruntime_ref: ${version}\n`
+      if (updated !== current) {
+        writeFileSync(configFile, updated)
+        if (!result.changed.includes('.github/code-foundry.yml')) result.changed.push('.github/code-foundry.yml')
+      }
+    }
     if (!result.changed.length) return { path: repository.path, status: 'unchanged', branch }
     spawnSync('git', ['-C', temporary, 'add', '-A'], { stdio: 'ignore' })
     const commit = spawnSync('git', ['-C', temporary, 'commit', '-m', `chore(code-foundry): upgrade runtime to ${version}`], { encoding: 'utf8' })

package/src/lib/github-doctor.mjs

@@ -55,6 +55,16 @@ export function doctorGithub(root) {
   if (['workflow-dispatch', 'dispatch'].includes(config.post_release_mode) && config.post_release !== 'false' && !details.secrets.releasePleaseTokenPresent) {
     errors.push('post-release workflow-dispatch mode requires RELEASE_PLEASE_TOKEN to be present.')
   }
+  const credentialChecks = {
+    npmTokenPresent: secretNames.includes('NPM_TOKEN'),
+    turboTokenPresent: secretNames.includes('TURBO_TOKEN'),
+    turboTeamPresent: Boolean(ghJson(['variable', 'list', '--repo', repository, '--json', 'name'])?.some(/** @param {{ name?: string }} variable */ (variable) => variable.name === 'TURBO_TEAM')),
+    opencodeApiKeyPresent: secretNames.includes('OPENCODE_API_KEY'),
+  }
+  details.credentials = credentialChecks
+  if (config.npm_publish === 'true' && !credentialChecks.npmTokenPresent) warnings.push('npm_publish is enabled but NPM_TOKEN is not configured; npm trusted publishing must be configured for tokenless publication.')
+  if (['true', 'auto'].includes(config.turbo_remote ?? 'false') && (!credentialChecks.turboTokenPresent || !credentialChecks.turboTeamPresent)) warnings.push('turbo_remote is enabled but TURBO_TOKEN and/or TURBO_TEAM is not configured; remote caching will be skipped.')
+  if (['true', 'auto'].includes(config.opencode_security ?? 'false') && !credentialChecks.opencodeApiKeyPresent) warnings.push('opencode_security is enabled but OPENCODE_API_KEY is not configured; the optional scan will be skipped.')
 
   const prs = ghJson(['pr', 'list', '--repo', repository, '--state', 'open', '--base', 'main', '--json', 'number,title,headRefName'])
   const openPrs = Array.isArray(prs) ? prs : []

package/src/runtime.mjs

@@ -20,6 +20,20 @@ function hasLanguage(language) {
   return languages.includes(language) || languages.includes('all')
 }
 
+function hasRootJavascriptProject() {
+  return Boolean(readPackage()) && packageManager !== 'none'
+}
+
+function hasRootPythonProject() {
+  return existsSync(resolve(root, 'pyproject.toml')) ||
+    existsSync(resolve(root, 'uv.lock')) ||
+    capture('git', ['ls-files', '*requirements*.txt']) !== ''
+}
+
+function hasRootRustProject() {
+  return existsSync(resolve(root, 'Cargo.toml'))
+}
+
 /** @param {string} name */
 function hasScript(name) {
   return readPackage()?.scripts?.[name] !== undefined
@@ -130,8 +144,24 @@ function relevant(task) {
   const js = hasLanguage('typescript') || hasLanguage('javascript')
   const python = hasLanguage('python')
   const rust = hasLanguage('rust')
-  if (task === 'format' || task === 'lint' || task === 'type_check' || task === 'build') return js || python || rust
-  if (['unit', 'integration', 'e2e', 'smoke'].includes(task)) return js || python || rust || hasLanguage('solidity')
+  const scripted = {
+    format: ['format:check', 'format', 'fmt'],
+    lint: ['lint'],
+    type_check: ['type-check', 'typecheck', 'type:check'],
+    build: ['build'],
+    unit: ['test:unit', 'test:coverage', 'test'],
+    integration: ['test:integration'],
+    e2e: ['test:e2e', 'e2e'],
+    smoke: ['test:smoke', 'smoke'],
+  }[task]
+  if (scripted && scripted.some((candidate) => hasScript(candidate))) return packageManager !== 'none'
+  if (task === 'format' || task === 'lint' || task === 'type_check' || task === 'build') {
+    return (js && hasRootJavascriptProject()) || (python && hasRootPythonProject()) || (rust && hasRootRustProject())
+  }
+  if (['unit', 'integration', 'e2e', 'smoke'].includes(task)) {
+    return (js && hasRootJavascriptProject()) || (python && hasRootPythonProject()) ||
+      (rust && hasRootRustProject()) || (hasLanguage('solidity') && hasRootJavascriptProject())
+  }
   return true
 }
 
@@ -151,7 +181,7 @@ function hasDependencyManifest(ecosystem) {
 function ci(task) {
   if (task === 'install') return install()
   if (task === 'should_run' || task === 'task_profile') {
-    const selected = process.argv[3]
+    const selected = process.argv[4]
     writeOutput('applicable', relevant(selected) ? 'true' : 'false')
     writeOutput('javascript', (hasLanguage('typescript') || hasLanguage('javascript')) ? 'true' : 'false')
     writeOutput('python', hasLanguage('python') ? 'true' : 'false')
@@ -160,27 +190,27 @@ function ci(task) {
   }
   if (task === 'format') {
     const scripted = runScript(['format:check', 'format', 'fmt'])
-    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript'))) runTool('prettier', ['--check', '.'])
-    if (hasLanguage('python')) runTool('ruff', ['format', '--check', '.'])
-    if (hasLanguage('rust')) run('cargo', ['fmt', '--check'])
+    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript')) && hasRootJavascriptProject()) runTool('prettier', ['--check', '.'])
+    if (hasLanguage('python') && hasRootPythonProject()) runTool('ruff', ['format', '--check', '.'])
+    if (hasLanguage('rust') && hasRootRustProject()) run('cargo', ['fmt', '--check'])
     return
   }
   if (task === 'lint') {
     const scripted = runScript(['lint'])
-    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript'))) runTool('eslint', ['.'])
-    if (hasLanguage('python')) runTool('ruff', ['check', '.'])
-    if (hasLanguage('rust')) run('cargo', ['clippy', '--all-targets', '--', '-D', 'warnings'])
+    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript')) && hasRootJavascriptProject()) runTool('eslint', ['.'])
+    if (hasLanguage('python') && hasRootPythonProject()) runTool('ruff', ['check', '.'])
+    if (hasLanguage('rust') && hasRootRustProject()) run('cargo', ['clippy', '--all-targets', '--', '-D', 'warnings'])
     return
   }
   if (task === 'type_check') {
     const scripted = runScript(['type-check', 'typecheck', 'type:check'])
     if (!scripted && existsSync(resolve(root, 'tsconfig.json'))) runTool('tsc', ['--noEmit'])
-    if (hasLanguage('rust')) run('cargo', ['check', '--all-targets'])
+    if (hasLanguage('rust') && hasRootRustProject()) run('cargo', ['check', '--all-targets'])
     return
   }
   if (task === 'build') {
     const scripted = runScript(['build'])
-    if (!scripted && hasLanguage('rust')) run('cargo', ['build', '--all-targets'])
+    if (!scripted && hasLanguage('rust') && hasRootRustProject()) run('cargo', ['build', '--all-targets'])
     return
   }
   /** @type {Record<string, string[]>} */
@@ -192,8 +222,8 @@ function ci(task) {
   }
   const scripts = scriptsByTask[task]
   if (scripts) runScript(scripts)
-  if (hasLanguage('rust')) run('cargo', ['test'])
-  if (hasLanguage('python')) {
+  if (hasLanguage('rust') && hasRootRustProject()) run('cargo', ['test'])
+  if (hasLanguage('python') && hasRootPythonProject()) {
     const python = existsSync(resolve(root, '.venv/bin/python')) ? resolve(root, '.venv/bin/python') : 'python'
     const integrationTests = resolve(root, 'tests/integration')
     if (task !== 'integration' || existsSync(integrationTests)) {
@@ -291,7 +321,7 @@ function codeql() {
 /** @param {string} command */
 function printProfile(command) {
   if (command === 'get') {
-    const key = process.argv[3]
+    const key = process.argv[4]
     console.log(config[key] ?? (key === 'languages' ? languages.join(',') : key === 'package_manager' ? packageManager : ''))
     return
   }