code-foundry 0.32.4 → 0.33.0

package/.github/CONTRIBUTING.md

@@ -48,7 +48,7 @@ docs/*  test/*  refactor/*         │              │
 | `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
 | `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
 
-The default Git workflow is `staging-release`: topic branches merge into `staging` (typically after rebasing), then a promotion PR moves validated changes into `main`, followed by the versioned release PR. The default release merge strategy is `merge`, matching your preference for merge-commit promotions from staging to main. Configure `merge_strategy` as `rebase` or `squash` in `.github/code-foundry.yml` if a repository intentionally differs. Re-align `staging` with `main` after a release when needed.
+The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.
 
 ## Before you start
 
@@ -107,7 +107,7 @@ For maintainers, trusted contributors, and automation agents:
 
 8. Push the branch and open a pull request into `staging`.
 9. Address review feedback and failed checks on the same branch.
-10. Merge using the repository's configured `merge_strategy` after required checks pass and the change is ready.
+10. Merge with a squash after required checks pass and the change is ready; feature PRs land on `staging` with squash merges.
 
 ### Internal agent handoff
 
@@ -153,15 +153,17 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 ## Workflow and check behavior
 
-| Event                            | Expected automation                      |
-| -------------------------------- | ---------------------------------------- |
-| Push to `main` or `staging`      | CI, Test, Security, and CodeQL workflows |
-| Pull request targeting `staging` | CI, Test, Security, and CodeQL workflows |
-| Push to a working branch         | Draft PR workflow                        |
-| Push to `staging`                | Release PR workflow                      |
-| Version tag such as `v1.2.3`     | Release workflow                         |
+| Event | Expected automation |
+| --- | --- |
+| Pull request targeting `staging` | Fast validation: CI plus unit tests, ending in `Validation / Gate` |
+| Ordinary pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |
+| Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate` |
+| Scheduled or manual validation | Full audit tier |
+| Push to a working branch | Draft PR workflow |
+| Push to `staging` | Promotion PR workflow; canonical validation waits for the PR event |
+| Push to `main` | Release workflow; canonical validation already ran on the merged PR |
 
-The workflows use separate concurrency groups keyed by the commit under test. A newer run for the same commit cancels a duplicate event-triggered run, while newer commits cancel older runs and independent CI, Test, Security, and CodeQL workflows continue in parallel.
+The single validation caller keys concurrency by event and pull-request head. A newer update to the same pull request cancels its superseded validation run; scheduled and manual audits remain independent. The mode-aware orchestrator fans out only the jobs required by that event and always concludes with the stable aggregate gate.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 
@@ -173,10 +175,11 @@ Security checks can be skipped when repository visibility or the GitHub plan doe
 
 ## Review and merge protocol
 
-| Change            | Target    | Merge gate                                                |
-| ----------------- | --------- | --------------------------------------------------------- |
-| Working branch    | `staging` | All applicable required checks pass                       |
-| `staging` release | `main`    | Current staging checks, release review, and rollout notes |
+| Change | Target | Merge method | Merge gate |
+| ----------------- | --------- | ------------------------------------------------------- | --------------------------------------------------------- |
+| Working branch    | `staging` | Squash                                                  | All applicable required checks pass                       |
+| `staging` → `main` promotion | `main` | Rebase (`merge_strategy`)                   | Current staging checks, release review, and rollout notes |
+| Release Please version PR | `main` | Squash (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                  |
 
 Reviewers focus on correctness, security, maintainability, test coverage, operational impact, and compatibility. Authors remain responsible for responding to feedback and verifying the final commit.
 

package/.github/workflows/ci.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: string
         default: ubuntu-latest
+    secrets:
+      TURBO_TOKEN:
+        required: false
+      NEXTAUTH_SECRET:
+        required: false
 
 permissions:
   contents: read
@@ -44,10 +49,13 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -84,10 +92,13 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -119,10 +130,13 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -159,10 +173,13 @@ jobs:
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET || 'code-foundry-ci-placeholder-0123456789' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry

package/.github/workflows/codeql.yml

@@ -33,7 +33,6 @@ on:
         required: false
         type: number
         default: 1
-
 permissions:
   actions: read
   contents: read
@@ -76,17 +75,19 @@ jobs:
         id: security
         env:
           GH_TOKEN: ${{ github.token }}
+          REPOSITORY_VISIBILITY: ${{ github.event.repository.visibility }}
         run: |
           status="disabled"
-          if [ "${{ github.event.repository.visibility }}" = "public" ]; then
+          if [ "$REPOSITORY_VISIBILITY" = "public" ]; then
             status="enabled"
           else
             status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
           fi
           printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           fetch-depth: 2
           filter: blob:none
           sparse-checkout: |
@@ -101,8 +102,9 @@ jobs:
             package-lock.json
           sparse-checkout-cone-mode: false
       - name: Runtime
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -138,14 +140,17 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.actions_available == 'true' &&
           needs.detect.outputs.actions_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
         if: >-
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.actions_available == 'true' &&
           needs.detect.outputs.actions_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -193,14 +198,17 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.javascript_available == 'true' &&
           needs.detect.outputs.javascript_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
         if: >-
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.javascript_available == 'true' &&
           needs.detect.outputs.javascript_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -248,14 +256,17 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.python_available == 'true' &&
           needs.detect.outputs.python_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
         if: >-
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.python_available == 'true' &&
           needs.detect.outputs.python_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -308,14 +319,17 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Runtime
         if: >-
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
           path: .github/.code-foundry
@@ -388,7 +402,7 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
         with:
           languages: rust
           build-mode: ${{ needs.detect.outputs.rust_build_mode }}
@@ -399,7 +413,7 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
         with:
           category: /language:rust/${{ steps.scope.outputs.scope_id }}
           upload-database: false

package/.github/workflows/draft-pr.yml

@@ -8,13 +8,18 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+    secrets:
+      CODE_FOUNDRY_TOKEN:
+        required: false
+      RELEASE_PLEASE_TOKEN:
+        required: false
 
 permissions:
   contents: read
   pull-requests: write
 
 env:
-  GH_TOKEN: ${{ github.token }}
+  HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' || secrets.RELEASE_PLEASE_TOKEN != '' }}
 
 jobs:
   create-draft-pr:
@@ -27,15 +32,21 @@ jobs:
     steps:
       - name: Check
         id: check-pr
+        env:
+          HEAD_REF: ${{ github.ref_name }}
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
         run: |
-          BRANCH="${{ github.ref_name }}"
+          BRANCH="$HEAD_REF"
           EXISTING=$(gh pr list --repo "$GITHUB_REPOSITORY" --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
 
       - name: Create
         if: steps.check-pr.outputs.existing == '0'
+        env:
+          HEAD_REF: ${{ github.ref_name }}
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
         run: |
-          BRANCH="${{ github.ref_name }}"
+          BRANCH="$HEAD_REF"
           PREFIX="${BRANCH%%/*}"
           SUFFIX="${BRANCH#*/}"
           PR_TITLE=""
@@ -60,23 +71,19 @@ jobs:
             PR_TITLE="$BRANCH"
           fi
 
+          DRAFT_ARGS=()
+          if [ "$HAS_AUTOMATION_TOKEN" = true ]; then
+            BODY_NOTICE="This PR is ready for review and merging once required validation passes."
+          else
+            DRAFT_ARGS+=(--draft)
+            BODY_NOTICE="This PR was created automatically and is currently in draft mode."
+            echo "::notice title=Manual PR readiness required::No automation token is configured; this PR may remain draft until manually marked ready for validation and merge."
+          fi
+
           gh pr create \
             --repo "$GITHUB_REPOSITORY" \
             --base staging \
             --head "$BRANCH" \
-            --draft \
+            "${DRAFT_ARGS[@]}" \
             --title "$PR_TITLE" \
-            --body "Draft PR created automatically by CI.
-
-            This PR is a draft and should not be merged until CI passes and a reviewer (or the Daily Review agent) marks it ready.
-
-            **CI Status:** Pending — this workflow triggered on push to \`$BRANCH\`."
-
-      - name: Mark ready
-        if: steps.check-pr.outputs.existing == '0'
-        run: |
-          BRANCH="${{ github.ref_name }}"
-          PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]")[0]?.number || ""))')
-          if [ -n "$PR_NUMBER" ]; then
-            gh pr ready "$PR_NUMBER" --repo "$GITHUB_REPOSITORY"
-          fi
+            --body "CI PR created automatically by this workflow.\n\n            $BODY_NOTICE\n\n            **CI Status:** Pending \u2014 this workflow triggered on push to \`$BRANCH\`."

package/.github/workflows/draft-pr_self-ci.yml

@@ -21,4 +21,6 @@ jobs:
     uses: ./.github/workflows/draft-pr.yml
     with:
       runner: ubuntu-slim
-    secrets: inherit
+    secrets:
+      CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+      RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}

package/.github/workflows/opencode-security_self-ci.yml

@@ -20,7 +20,9 @@ jobs:
       token: ${{ steps.detect.outputs.token }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Detect configuration and token
         id: detect
         env:
@@ -37,7 +39,7 @@ jobs:
     name: OpenCode Security / Scan
     needs: detect
     if: needs.detect.outputs.enabled == 'true' && needs.detect.outputs.token == 'true'
-    uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@main
+    uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@b3dce823322672b285fbe99b870ea984c01826cb # main
     with:
       source_ref: ${{ github.event.pull_request.head.ref || 'main' }}
       runner: ubuntu-latest

package/.github/workflows/release-pr.yml

@@ -8,13 +8,18 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+    secrets:
+      CODE_FOUNDRY_TOKEN:
+        required: false
+      RELEASE_PLEASE_TOKEN:
+        required: false
 
 permissions:
   contents: read
   pull-requests: write
 
 env:
-  GH_TOKEN: ${{ github.token }}
+  HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' || secrets.RELEASE_PLEASE_TOKEN != '' }}
 
 jobs:
   create-release-pr:
@@ -26,13 +31,16 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           filter: blob:none
 
       - name: Check
         id: check-pr
+        env:
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
         run: |
           set -euo pipefail
           EXISTING=$(gh pr list \
@@ -101,15 +109,19 @@ jobs:
               RELEASE_ONLY=true
             fi
           fi
-          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
-          echo "commits=$TOTAL_COMMITS" >> "$GITHUB_OUTPUT"
-          echo "tree_equal=$TREE_EQUAL" >> "$GITHUB_OUTPUT"
-          echo "release_only=$RELEASE_ONLY" >> "$GITHUB_OUTPUT"
+          {
+            echo "existing=$EXISTING"
+            echo "commits=$TOTAL_COMMITS"
+            echo "tree_equal=$TREE_EQUAL"
+            echo "release_only=$RELEASE_ONLY"
+          } >> "$GITHUB_OUTPUT"
 
       - name: No changes
         if: steps.check-pr.outputs.existing == '0' && (steps.check-pr.outputs.commits == '0' || steps.check-pr.outputs.tree_equal == 'true' || steps.check-pr.outputs.release_only == 'true')
+        env:
+          RELEASE_ONLY: ${{ steps.check-pr.outputs.release_only }}
         run: |
-          if [ "${{ steps.check-pr.outputs.release_only }}" = true ]; then
+          if [ "$RELEASE_ONLY" = true ]; then
             echo 'Only approved release metadata differs between rebased branch histories; reconciliation from main to staging is pending, so no promotion PR is needed.'
           else
             echo 'staging is already aligned with main; no promotion PR is needed.'
@@ -117,6 +129,8 @@ jobs:
 
       - name: Create
         if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
         run: |
           DATE=$(date +%Y-%m-%d)
           BODY_FILE="$RUNNER_TEMP/release-pr.md"
@@ -128,7 +142,7 @@ jobs:
             LAST_PAGE=$(( (TOTAL_COMMITS + 99) / 100 ))
             gh api "$COMPARE_URL?per_page=100&page=$LAST_PAGE" > "$COMPARE_FILE"
           fi
-          COMMITS=$(node -e 'const d=require(process.argv[1]); for (const c of d.commits || []) console.log(`- ${c.commit.message.split("\\n")[0]} (${c.sha.slice(0, 7)})`)' "$COMPARE_FILE")
+          COMMITS=$(node -e "const d=require(process.argv[1]); for (const c of d.commits || []) console.log('- ' + c.commit.message.split('\\n')[0] + ' (' + c.sha.slice(0, 7) + ')')" "$COMPARE_FILE")
           if [ -z "$COMMITS" ]; then
             COMMITS='- No commits found since main.'
           fi
@@ -157,14 +171,22 @@ jobs:
           ### Validation
 
           - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge using the repository's configured \`merge_strategy\` (default: **rebase**).
+          - Merge using the repository's configured \`merge_strategy\` (**rebase**).
+          - The promotion topology requires rebase; never merge a promotion PR with a merge commit.
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 
+          DRAFT_ARGS=()
+          if [ "$HAS_AUTOMATION_TOKEN" != true ]; then
+            DRAFT_ARGS+=(--draft)
+            echo "::notice title=Manual PR readiness required::Created draft promotion PR because no automation token is configured. Configure CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN, or mark this PR ready manually to trigger validation."
+          fi
+
           if ! gh pr create \
             --repo "$GITHUB_REPOSITORY" \
             --base main \
             --head staging \
+            "${DRAFT_ARGS[@]}" \
             --title "Promote staging -> main ($DATE)" \
             --body-file "$BODY_FILE"; then
             EXISTING_NUMBER=$(gh pr list \

package/.github/workflows/release-pr_self-ci.yml

@@ -3,8 +3,6 @@ name: Code Foundry
 on:
   push:
     branches: [staging]
-  pull_request:
-    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -13,12 +11,11 @@ permissions:
 
 jobs:
   release-pr:
-    if: >-
-      github.event_name == 'push' ||
-      github.event_name == 'workflow_dispatch' ||
-      startsWith(github.head_ref, 'release-please--branches--main')
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     name: Release PR
     uses: ./.github/workflows/release-pr.yml
     with:
       runner: ubuntu-slim
-    secrets: inherit
+    secrets:
+      CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+      RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}