code-foundry 0.37.5 → 0.38.0

package/.github/workflows/ci.yml

@@ -46,6 +46,7 @@ concurrency:
 jobs:
   format:
     name: Format
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
@@ -89,6 +90,7 @@ jobs:
 
   lint:
     name: Lint
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
@@ -127,6 +129,7 @@ jobs:
 
   type-check:
     name: Type-Check
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
@@ -165,6 +168,7 @@ jobs:
 
   build:
     name: Build
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     env:
       # Framework builds may validate server-side configuration at build time.

package/.github/workflows/codeql.yml

@@ -52,6 +52,7 @@ concurrency:
 jobs:
   detect:
     name: Detect
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     outputs:
@@ -130,6 +131,7 @@ jobs:
     name: Analyze (Actions)
     needs: detect
     if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
       needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.actions_available == 'true'
     runs-on: ${{ inputs.runner }}
@@ -188,6 +190,7 @@ jobs:
     name: Analyze (TypeScript)
     needs: detect
     if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
       needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.javascript_available == 'true'
     runs-on: ${{ inputs.runner }}
@@ -246,6 +249,7 @@ jobs:
     name: Analyze (Python)
     needs: detect
     if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
       needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.python_available == 'true'
     runs-on: ${{ inputs.runner }}
@@ -304,6 +308,7 @@ jobs:
     name: Analyze (Rust)
     needs: detect
     if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
       needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.rust_available == 'true'
     strategy:

package/.github/workflows/draft-pr.yml

@@ -26,6 +26,7 @@ permissions:
 jobs:
   create-draft-pr:
     name: Create
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     concurrency:

package/.github/workflows/draft-pr_self-ci.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   draft-pr:
     name: Draft PR
+    if: vars.CI_BILLING_PAUSED != 'true'
     uses: ./.github/workflows/draft-pr.yml
     with:
       runner: ubuntu-slim

package/.github/workflows/opencode-security_self-ci.yml

@@ -12,8 +12,9 @@ jobs:
   detect:
     name: OpenCode Security / Detect
     if: >-
-      github.event_name == 'workflow_dispatch' ||
-      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')
+      vars.CI_BILLING_PAUSED != 'true' &&
+      (github.event_name == 'workflow_dispatch' ||
+      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}
@@ -38,7 +39,7 @@ jobs:
   scan:
     name: OpenCode Security / Scan
     needs: detect
-    if: needs.detect.outputs.enabled == 'true' && needs.detect.outputs.token == 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && needs.detect.outputs.enabled == 'true' && needs.detect.outputs.token == 'true'
     uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@b3dce823322672b285fbe99b870ea984c01826cb # main
     with:
       # This is the scanner checkout ref, not the consumer PR ref. The

package/.github/workflows/release-pr.yml

@@ -24,6 +24,7 @@ env:
 jobs:
   create-release-pr:
     name: Create
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     concurrency:

package/.github/workflows/release-pr_self-ci.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   release-pr:
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     name: Release PR
     uses: ./.github/workflows/release-pr.yml
     with:

package/.github/workflows/release.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: string
         default: v0.31.12
+      billing-pause-bypass:
+        description: Allow this explicitly dispatched release to run while other CI remains paused.
+        required: false
+        type: boolean
+        default: false
     secrets:
       CODE_FOUNDRY_TOKEN:
         required: false
@@ -45,6 +50,7 @@ env:
 jobs:
   release:
     name: Version
+    if: vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
     concurrency:
@@ -313,7 +319,7 @@ jobs:
     # creating a release. Reconciliation is only meaningful after a release
     # commit/tag is actually created; otherwise the promotion's source changes
     # are incorrectly rejected as non-metadata commits.
-    if: needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
+    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:
@@ -401,7 +407,7 @@ jobs:
   post-release:
     name: Post Hook
     needs: release
-    if: needs.release.outputs.release_created == 'true'
+    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     concurrency:
@@ -460,7 +466,7 @@ jobs:
   npm:
     name: Publish npm
     needs: release
-    if: needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
+    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:

package/.github/workflows/release_self-ci.yml

@@ -4,6 +4,12 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+    inputs:
+      release-while-paused:
+        description: Run only the release pipeline while the shared CI billing pause remains active.
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   actions: write
@@ -15,8 +21,10 @@ permissions:
 jobs:
   release:
     name: Release
+    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
     uses: ./.github/workflows/release.yml
     with:
+      billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
       runner: ubuntu-slim
       runtime-repository: 0xPlayerOne/code-foundry
       runtime-ref: ${{ github.sha }}

package/.github/workflows/security.yml

@@ -36,6 +36,7 @@ concurrency:
 jobs:
   profile:
     name: Profile
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     outputs:
@@ -102,7 +103,7 @@ jobs:
   dependency-audit-javascript:
     name: Dependency Audit (JavaScript)
     needs: profile
-    if: ${{ needs.profile.result == 'success' && needs.profile.outputs.javascript == 'true' }}
+    if: ${{ vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success' && needs.profile.outputs.javascript == 'true' }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
     steps:
@@ -157,7 +158,7 @@ jobs:
   dependency-audit-rust:
     name: Dependency Audit (Rust)
     needs: profile
-    if: ${{ needs.profile.result == 'success' && needs.profile.outputs.rust == 'true' }}
+    if: ${{ vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success' && needs.profile.outputs.rust == 'true' }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
     steps:
@@ -226,7 +227,8 @@ jobs:
     name: Dependency Audit (Python) / ${{ matrix.requirement }}
     needs: profile
     if: >-
-      ${{ needs.profile.result == 'success' &&
+      ${{ vars.CI_BILLING_PAUSED != 'true' &&
+      needs.profile.result == 'success' &&
       needs.profile.outputs.python == 'true' &&
       needs.profile.outputs.python_requirements != '["none"]' }}
     strategy:
@@ -285,7 +287,8 @@ jobs:
     name: Dependency Audit (Python)
     needs: [profile, dependency-audit-python]
     if: >-
-      ${{ always() &&
+      ${{ vars.CI_BILLING_PAUSED != 'true' &&
+      always() &&
       needs.profile.result == 'success' &&
       needs.profile.outputs.python == 'true' &&
       needs.profile.outputs.python_requirements != '["none"]' }}
@@ -309,7 +312,7 @@ jobs:
   dependency-review:
     name: Dependency Review
     needs: profile
-    if: ${{ github.event_name == 'pull_request' && needs.profile.outputs.dependency_review == 'true' }}
+    if: ${{ vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request' && needs.profile.outputs.dependency_review == 'true' }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     steps:

package/.github/workflows/test.yml

@@ -54,6 +54,7 @@ concurrency:
 jobs:
   unit:
     name: Unit
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.unit-runner }}
     timeout-minutes: 30
     steps:
@@ -118,7 +119,7 @@ jobs:
 
   integration:
     name: Integration
-    if: inputs.unit-only != true
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -167,7 +168,7 @@ jobs:
 
   e2e:
     name: E2E
-    if: inputs.unit-only != true
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 45
     steps:
@@ -228,7 +229,7 @@ jobs:
 
   smoke:
     name: Smoke
-    if: inputs.unit-only != true
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     steps:

package/.github/workflows/validation.yml

@@ -75,7 +75,7 @@ permissions:
 jobs:
   ci:
     name: CI
-    if: inputs.mode == 'fast' || inputs.mode == 'audit'
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -87,7 +87,7 @@ jobs:
 
   test:
     name: Test
-    if: inputs.mode == 'fast' || inputs.mode == 'audit'
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -100,7 +100,7 @@ jobs:
 
   security:
     name: Security
-    if: inputs.mode == 'audit'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -109,7 +109,7 @@ jobs:
 
   codeql:
     name: CodeQL
-    if: inputs.mode == 'audit'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
     uses: ./.github/workflows/codeql.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -121,7 +121,7 @@ jobs:
 
   release-policy:
     name: Release Policy
-    if: inputs.mode == 'release'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'release'
     runs-on: ubuntu-slim
     timeout-minutes: 10
     steps:
@@ -156,7 +156,7 @@ jobs:
   gate:
     name: Gate
     needs: [ci, test, security, codeql, release-policy]
-    if: always()
+    if: vars.CI_BILLING_PAUSED != 'true' && always()
     runs-on: ubuntu-slim
     timeout-minutes: 10
     env:

package/.github/workflows/validation_self-ci.yml

@@ -25,6 +25,7 @@ concurrency:
 jobs:
   mode:
     name: Mode
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ubuntu-slim
     timeout-minutes: 10
     permissions:
@@ -57,6 +58,7 @@ jobs:
   validation:
     name: Validation
     needs: mode
+    if: vars.CI_BILLING_PAUSED != 'true'
     # Reusable workflows can only maintain or reduce the caller job's scopes.
     # The audit tier needs security-events: write for CodeQL uploads.
     permissions:

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.38.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.5...v0.38.0) (2026-08-24)
+
+
+### Features
+
+* **ci:** add reversible billing pause ([#402](https://github.com/0xPlayerOne/code-foundry/issues/402)) ([aa17b11](https://github.com/0xPlayerOne/code-foundry/commit/aa17b11037dccced17dd1173d9d788ac83ba50b5))
+
+
+### Bug Fixes
+
+* **ci:** guard every workflow during billing pause ([#405](https://github.com/0xPlayerOne/code-foundry/issues/405)) ([fc3930f](https://github.com/0xPlayerOne/code-foundry/commit/fc3930fcb50e9182bb0f5e97ea523a6805f3fa95))
+* **release:** allow explicit release while CI is paused ([#407](https://github.com/0xPlayerOne/code-foundry/issues/407)) ([3d31cf1](https://github.com/0xPlayerOne/code-foundry/commit/3d31cf154255225ecdd9bca94f8620ad8c2b3473))
+
 ## [0.37.5](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.4...v0.37.5) (2026-08-23)
 
 

package/docs/WORKFLOWS.md

@@ -26,6 +26,49 @@ automation listens to `main` pushes.
 Custom deployment, indexing, search, Slither, or other workflows are
 repository-owned extensions and should keep their own triggers and permissions.
 
+## Billing pause
+
+Code Foundry consumers can stop all generated jobs from allocating GitHub-hosted
+runners during a billing outage:
+
+```bash
+npx code-foundry ci pause
+npx code-foundry ci status
+npx code-foundry ci resume
+```
+
+The commands use the repository variable `CI_BILLING_PAUSED`. Every job in the
+generated callers and reusable workflows checks this variable before GitHub
+allocates a runner, so a direct reusable-workflow call cannot bypass the pause.
+`pause` also backs up and removes only `Validation / Gate` from active branch
+rulesets so pull requests do not wait forever for a deliberately disabled
+workflow, and cancels queued or in-progress workflow runs that were created
+before the flag changed.
+`resume` restores that exact check before re-enabling jobs. Pull-request,
+deletion, non-fast-forward, review, and other ruleset protections remain active.
+The operation fails closed when the gate or its backup is ambiguous.
+
+Release Please and package publication are deliberately included in the pause.
+Changes merged to `main` while paused remain unreleased until the release
+workflow receives a normal run after CI resumes, or a maintainer explicitly
+dispatches its release-only bypass. The bypass does not enable validation,
+security, CodeQL, draft-PR, or promotion jobs:
+
+```bash
+gh workflow run release_self-ci.yml --ref main -f release-while-paused=true
+```
+
+The first dispatch creates and, when an automation token is available, merges
+the Release Please version PR. After that PR is merged, dispatch the same
+command once more to create the tag, GitHub Release, and configured package
+publication. Without an automation token, review and merge the version PR
+manually between the two dispatches. `CI_BILLING_PAUSED` remains `true`
+throughout the bounded release flow.
+
+Custom workflows are repository-owned and are not rewritten by sync. Add
+`if: vars.CI_BILLING_PAUSED != 'true'` to each custom root job that should
+honor the shared billing pause.
+
 ## Standard workflow responsibilities
 
 | Workflow | Responsibility |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.37.5",
+  "version": "0.38.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/cli.mjs

@@ -8,10 +8,11 @@ import { doctor } from './commands/doctor.mjs'
 import { dispatchPostReleaseHook, reconcileRelease, releaseRecoveryPlan, validateReleasePullRequestDiffs } from './commands/release.mjs'
 import { discoverRepositories, upgradeFleet } from './commands/fleet.mjs'
 import { syncRepository } from './commands/sync.mjs'
+import { manageCiBilling } from './commands/ci.mjs'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
-/** @typedef {{ target: string, root: string, dryRun: boolean, force: boolean, github: boolean, createPr: boolean, exclude: string[], base: string, head: string, tag: string, workflow: string, mode: string, version: string, releaseSubcommand?: string, fleetSubcommand?: string }} Options */
+/** @typedef {{ target: string, root: string, dryRun: boolean, force: boolean, github: boolean, createPr: boolean, exclude: string[], base: string, head: string, tag: string, workflow: string, mode: string, version: string, releaseSubcommand?: string, fleetSubcommand?: string, ciSubcommand?: 'pause'|'resume'|'status' }} Options */
 /** @typedef {{ command: string, options: Options }} ParsedArgs */
 
 const usage = `code-foundry — initialize and maintain agent-ready repositories
@@ -20,6 +21,7 @@ Usage:
   npx code-foundry init [--target PATH]
   npx code-foundry sync [--target PATH]
   npx code-foundry doctor [--target PATH]
+  npx code-foundry ci pause|resume|status [--target PATH]
   npx code-foundry release reconcile [--github] [--base BRANCH] [--head BRANCH]
   npx code-foundry release hook --tag TAG --workflow WORKFLOW
   npx code-foundry fleet status [--root PATH]
@@ -68,6 +70,10 @@ function parseArgs(argv) {
     const subcommand = argv.shift() ?? ''
     if (subcommand !== 'status' && subcommand !== 'upgrade') fail(`unknown fleet command: ${subcommand ?? '(missing)'}; use fleet status or fleet upgrade`)
     options.fleetSubcommand = subcommand
+  } else if (command === 'ci') {
+    const subcommand = argv.shift() ?? ''
+    if (!['pause', 'resume', 'status'].includes(subcommand)) fail(`unknown ci command: ${subcommand || '(missing)'}; use ci pause, ci resume, or ci status`)
+    options.ciSubcommand = /** @type {'pause'|'resume'|'status'} */ (subcommand)
   }
 
   while (argv.length) {
@@ -138,6 +144,12 @@ function main() {
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))
     }
+  } else if (command === 'ci') {
+    try {
+      manageCiBilling(target, /** @type {'pause'|'resume'|'status'} */ (options.ciSubcommand))
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
   }
   else fail(`unknown command: ${command}`)
 }

package/src/commands/ci.mjs

@@ -0,0 +1,268 @@
+// @ts-check
+
+import { spawnSync } from 'node:child_process'
+
+export const CI_BILLING_PAUSED_VARIABLE = 'CI_BILLING_PAUSED'
+export const CI_BILLING_BACKUP_VARIABLE = 'CI_BILLING_GATE_BACKUP'
+export const CI_BILLING_REQUIRED_CHECK = 'Validation / Gate'
+
+/**
+ * Pause, resume, or inspect billable GitHub Actions for a consumer repository.
+ * The repository variable stops guarded jobs from allocating runners. While
+ * paused, the managed validation check is removed from active branch rulesets
+ * so pull requests do not deadlock on a check that cannot run.
+ *
+ * @param {string} root
+ * @param {'pause'|'resume'|'status'} action
+ * @returns {Record<string, unknown>}
+ */
+export function manageCiBilling(root, action) {
+  const repository = remoteRepository(root)
+  if (!repository) throw new Error('Unable to determine GitHub repository from the origin remote.')
+  requireGh()
+
+  const paused = readVariable(repository, CI_BILLING_PAUSED_VARIABLE) === 'true'
+  const backupText = readVariable(repository, CI_BILLING_BACKUP_VARIABLE)
+  const backup = backupText ? parseBackup(backupText) : null
+
+  if (action === 'status') {
+    const result = {
+      repository,
+      paused,
+      requiredCheck: CI_BILLING_REQUIRED_CHECK,
+      backupPresent: Boolean(backup),
+    }
+    console.log(JSON.stringify(result, null, 2))
+    return result
+  }
+
+  if (action === 'pause') {
+    const rulesets = activeBranchRulesets(repository)
+    const candidates = rulesets.filter((ruleset) => requiredChecks(ruleset).some(isManagedCheck))
+    const inherited = candidates.filter((ruleset) => ruleset.source_type !== 'Repository' || ruleset.source !== repository)
+    if (inherited.length) {
+      throw new Error(`${CI_BILLING_REQUIRED_CHECK} is enforced by an inherited ruleset that this repository cannot safely edit.`)
+    }
+    if (!candidates.length) {
+      if (paused && backup) {
+        const cancelledRuns = cancelActiveRuns(repository)
+        const result = { repository, paused: true, changed: false, cancelledRuns, rulesets: backup.rulesets.map((/** @type {any} */ ruleset) => ruleset.rulesetName) }
+        console.log(JSON.stringify(result, null, 2))
+        return result
+      }
+      throw new Error(`No active branch ruleset requires ${CI_BILLING_REQUIRED_CHECK}; refusing to pause without a restorable managed gate.`)
+    }
+    if (backup && !paused) {
+      throw new Error(`${CI_BILLING_BACKUP_VARIABLE} already exists while CI is active; inspect or remove the stale backup before pausing.`)
+    }
+    if (backup && candidates.some((ruleset) => !backup.rulesets.some((/** @type {any} */ saved) => saved.rulesetId === ruleset.id))) {
+      throw new Error(`${CI_BILLING_BACKUP_VARIABLE} does not cover every managed ruleset; refusing to overwrite the recovery state.`)
+    }
+
+    const changes = candidates.map(buildPausedRuleset)
+    const nextBackup = backup ?? { version: 1, rulesets: changes.map((change) => change.backup) }
+    setVariable(repository, CI_BILLING_BACKUP_VARIABLE, JSON.stringify(nextBackup))
+    setVariable(repository, CI_BILLING_PAUSED_VARIABLE, 'true')
+    const cancelledRuns = cancelActiveRuns(repository)
+    for (const change of changes) updateRuleset(repository, change.ruleset)
+    const result = { repository, paused: true, changed: true, cancelledRuns, rulesets: changes.map((change) => change.ruleset.name) }
+    console.log(JSON.stringify(result, null, 2))
+    return result
+  }
+
+  if (!backup) {
+    if (!paused) {
+      const result = { repository, paused: false, changed: false }
+      console.log(JSON.stringify(result, null, 2))
+      return result
+    }
+    throw new Error(`${CI_BILLING_PAUSED_VARIABLE} is true but ${CI_BILLING_BACKUP_VARIABLE} is missing; refusing an unsafe resume.`)
+  }
+
+  let changed = paused
+  for (const saved of backup.rulesets) {
+    const current = apiJson(repository, `repos/${repository}/rulesets/${saved.rulesetId}`)
+    if (!current || current.name !== saved.rulesetName) {
+      throw new Error(`The backed-up ruleset ${saved.rulesetName} (${saved.rulesetId}) is unavailable; refusing an unsafe resume.`)
+    }
+    const restored = buildResumedRuleset(current, saved)
+    if (restored.changed) updateRuleset(repository, restored.ruleset)
+    changed ||= restored.changed
+  }
+  setVariable(repository, CI_BILLING_PAUSED_VARIABLE, 'false')
+  deleteVariable(repository, CI_BILLING_BACKUP_VARIABLE)
+  const result = { repository, paused: false, changed, rulesets: backup.rulesets.map((/** @type {any} */ ruleset) => ruleset.rulesetName) }
+  console.log(JSON.stringify(result, null, 2))
+  return result
+}
+
+/** @param {any} ruleset */
+export function buildPausedRuleset(ruleset) {
+  const requiredRuleIndexes = (ruleset.rules ?? []).flatMap((/** @type {any} */ rule, /** @type {number} */ index) =>
+    rule?.type === 'required_status_checks' && (rule.parameters?.required_status_checks ?? []).some(isManagedCheck) ? [index] : [],
+  )
+  if (requiredRuleIndexes.length > 1) throw new Error(`${CI_BILLING_REQUIRED_CHECK} appears in multiple rules; refusing an ambiguous pause.`)
+  const requiredRuleIndex = requiredRuleIndexes[0]
+  const requiredRule = ruleset.rules?.[requiredRuleIndex]
+  const matches = (requiredRule?.parameters?.required_status_checks ?? []).filter(isManagedCheck)
+  if (!matches.length) throw new Error(`${CI_BILLING_REQUIRED_CHECK} is not present in the selected ruleset.`)
+  const remaining = (requiredRule.parameters?.required_status_checks ?? []).filter((/** @type {any} */ check) => !isManagedCheck(check))
+  const rules = (ruleset.rules ?? []).flatMap((/** @type {any} */ rule, /** @type {number} */ index) => {
+    if (index !== requiredRuleIndex) return [rule]
+    if (!remaining.length) return []
+    return [{ ...rule, parameters: { ...rule.parameters, required_status_checks: remaining } }]
+  })
+  return {
+    ruleset: { ...ruleset, rules },
+    backup: {
+      rulesetId: ruleset.id,
+      rulesetName: ruleset.name,
+      checks: matches,
+      parameters: {
+        strict_required_status_checks_policy: Boolean(requiredRule?.parameters?.strict_required_status_checks_policy),
+        do_not_enforce_on_create: Boolean(requiredRule?.parameters?.do_not_enforce_on_create),
+      },
+    },
+  }
+}
+
+/** @param {any} ruleset @param {any} backup */
+export function buildResumedRuleset(ruleset, backup) {
+  if (requiredChecks(ruleset).some(isManagedCheck)) return { ruleset, changed: false }
+  const rules = [...(ruleset.rules ?? [])]
+  const index = rules.findIndex((rule) => rule?.type === 'required_status_checks')
+  if (index === -1) {
+    rules.push({
+      type: 'required_status_checks',
+      parameters: { ...backup.parameters, required_status_checks: backup.checks },
+    })
+  } else {
+    const rule = rules[index]
+    rules[index] = {
+      ...rule,
+      parameters: {
+        ...rule.parameters,
+        required_status_checks: [...requiredChecks({ rules: [rule] }), ...backup.checks],
+      },
+    }
+  }
+  return { ruleset: { ...ruleset, rules }, changed: true }
+}
+
+/** @param {any} backup */
+function validateBackup(backup) {
+  return backup?.version === 1 &&
+    Array.isArray(backup.rulesets) &&
+    backup.rulesets.length > 0 &&
+    backup.rulesets.every((/** @type {any} */ ruleset) =>
+      Number.isInteger(ruleset?.rulesetId) &&
+      typeof ruleset.rulesetName === 'string' &&
+      Array.isArray(ruleset.checks) &&
+      ruleset.checks.length > 0 &&
+      ruleset.checks.every(isManagedCheck) &&
+      ruleset.parameters && typeof ruleset.parameters === 'object',
+    )
+}
+
+/** @param {string} value */
+function parseBackup(value) {
+  let backup
+  try { backup = JSON.parse(value) }
+  catch { throw new Error(`${CI_BILLING_BACKUP_VARIABLE} is not valid JSON; refusing to change CI state.`) }
+  if (!validateBackup(backup)) throw new Error(`${CI_BILLING_BACKUP_VARIABLE} is invalid; refusing to change CI state.`)
+  return backup
+}
+
+/** @param {any} check */
+function isManagedCheck(check) { return check?.context === CI_BILLING_REQUIRED_CHECK }
+
+/** @param {any} ruleset @returns {any[]} */
+function requiredChecks(ruleset) {
+  return (ruleset?.rules ?? []).flatMap((/** @type {any} */ rule) => rule?.type === 'required_status_checks' ? rule.parameters?.required_status_checks ?? [] : [])
+}
+
+/** @param {string} repository @returns {any[]} */
+function activeBranchRulesets(repository) {
+  const summaries = apiJson(repository, `repos/${repository}/rulesets`)
+  if (!Array.isArray(summaries)) throw new Error('Unable to read repository rulesets.')
+  return summaries
+    .map((ruleset) => apiJson(repository, `repos/${repository}/rulesets/${ruleset.id}`))
+    .filter((/** @type {any} */ ruleset) => ruleset && ruleset.enforcement === 'active' && ruleset.target === 'branch')
+}
+
+/** @param {string} repository @param {any} ruleset */
+function updateRuleset(repository, ruleset) {
+  const payload = {
+    name: ruleset.name,
+    target: ruleset.target,
+    enforcement: ruleset.enforcement,
+    bypass_actors: ruleset.bypass_actors ?? [],
+    conditions: ruleset.conditions,
+    rules: ruleset.rules,
+  }
+  const result = spawnSync('gh', ['api', '--method', 'PUT', `repos/${repository}/rulesets/${ruleset.id}`, '--input', '-'], {
+    encoding: 'utf8',
+    input: JSON.stringify(payload),
+  })
+  if (result.status !== 0) throw new Error(`Unable to update ruleset ${ruleset.name}: ${result.stderr.trim() || 'GitHub API request failed'}`)
+}
+
+/** @param {string} repository @returns {number[]} */
+function cancelActiveRuns(repository) {
+  const ids = new Set()
+  for (const status of ['queued', 'in_progress', 'requested', 'waiting', 'pending']) {
+    const response = apiJson(repository, `repos/${repository}/actions/runs?status=${status}&per_page=100`)
+    for (const run of response?.workflow_runs ?? []) {
+      if (Number.isInteger(run?.id)) ids.add(run.id)
+    }
+  }
+  for (const id of ids) {
+    const result = spawnSync('gh', ['api', '--method', 'POST', `repos/${repository}/actions/runs/${id}/cancel`], { encoding: 'utf8' })
+    if (result.status !== 0 && !/409|cannot be cancelled/i.test(result.stderr)) {
+      throw new Error(`Unable to cancel workflow run ${id}: ${result.stderr.trim() || 'GitHub API request failed'}`)
+    }
+  }
+  return [...ids]
+}
+
+/** @param {string} repository @param {string} name @returns {string|null} */
+function readVariable(repository, name) {
+  const result = spawnSync('gh', ['api', `repos/${repository}/actions/variables/${name}`], { encoding: 'utf8' })
+  if (result.status !== 0) {
+    if (/404|not found/i.test(result.stderr)) return null
+    throw new Error(`Unable to read repository variable ${name}: ${result.stderr.trim() || 'GitHub API request failed'}`)
+  }
+  try { return JSON.parse(result.stdout)?.value ?? null }
+  catch { throw new Error(`GitHub returned invalid JSON for repository variable ${name}.`) }
+}
+
+/** @param {string} repository @param {string} name @param {string} value */
+function setVariable(repository, name, value) {
+  const result = spawnSync('gh', ['variable', 'set', name, '--repo', repository, '--body', value], { encoding: 'utf8' })
+  if (result.status !== 0) throw new Error(`Unable to set repository variable ${name}: ${result.stderr.trim() || 'GitHub CLI request failed'}`)
+}
+
+/** @param {string} repository @param {string} name */
+function deleteVariable(repository, name) {
+  const result = spawnSync('gh', ['variable', 'delete', name, '--repo', repository], { encoding: 'utf8' })
+  if (result.status !== 0) throw new Error(`Unable to delete repository variable ${name}: ${result.stderr.trim() || 'GitHub CLI request failed'}`)
+}
+
+/** @param {string} repository @param {string} endpoint @returns {any} */
+function apiJson(repository, endpoint) {
+  const result = spawnSync('gh', ['api', endpoint], { encoding: 'utf8' })
+  if (result.status !== 0) throw new Error(`Unable to read ${endpoint} for ${repository}: ${result.stderr.trim() || 'GitHub API request failed'}`)
+  try { return JSON.parse(result.stdout) }
+  catch { throw new Error(`GitHub returned invalid JSON for ${endpoint}.`) }
+}
+
+/** @param {string} root @returns {string} */
+function remoteRepository(root) {
+  const result = spawnSync('git', ['remote', 'get-url', 'origin'], { cwd: root, encoding: 'utf8' })
+  const value = result.status === 0 ? result.stdout.trim() : ''
+  return value.replace(/^git@github\.com:/, '').replace(/^https?:\/\/github\.com\//, '').replace(/\.git$/, '')
+}
+
+function requireGh() {
+  if (spawnSync('gh', ['--version'], { stdio: 'ignore' }).status !== 0) throw new Error('CI billing controls require the `gh` CLI.')
+}

package/src/commands/sync.mjs

@@ -365,7 +365,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
     // reusable-workflow input. Keep it on the configured default runner so
     // consumers that cannot use ubuntu-slim do not fail before validation.
     if (config.runner) {
-      rendered = rendered.replace(/^  mode:\n    name: Mode\n    runs-on:\s+.*$/m, `  mode:\n    name: Mode\n    runs-on: ${config.runner}`)
+      rendered = rendered.replace(/^(\s+runs-on:)\s+.*$/m, `$1 ${config.runner}`)
     }
     /** @type {Record<string, string|undefined>} */
     const runnerInputs = {