code-foundry 0.39.4 → 0.40.1

package/.github/workflows/validation_self-ci.yml

@@ -33,6 +33,12 @@ jobs:
     outputs:
       mode: ${{ steps.classify.outputs.mode }}
     steps:
+      # The runtime classifies policy from the consumer repository's config.
+      # Keep this checkout before the isolated runtime checkout below.
+      - name: Checkout consumer repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Checkout runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.40.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.0...v0.40.1) (2026-08-31)
+
+
+### Bug Fixes
+
+* **validation:** load consumer audit policy ([8d13173](https://github.com/0xPlayerOne/code-foundry/commit/8d13173a36849528335f87a550072e08137f4473))
+
+## [0.40.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.39.4...v0.40.0) (2026-08-31)
+
+
+### Features
+
+* **validation:** allow audit mode on staging PRs ([0d95123](https://github.com/0xPlayerOne/code-foundry/commit/0d951230b9095d3b875db44ae8287335152eee60))
+
 ## [0.39.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.39.3...v0.39.4) (2026-08-29)
 
 

package/docs/CONFIGURATION.md

@@ -35,6 +35,7 @@ repository manifests and source
 | `languages` | detected list | TypeScript, Rust, Python, Solidity |
 | `package_manager` | `bun`, `pnpm`, `yarn`, `npm`, `none` | JavaScript setup |
 | `toolchain` | `auto`, `native`, `mise` | Environment setup policy; defaults to `auto` |
+| `staging_validation_mode` | `fast`, `audit` | Validation tier for pull requests targeting `staging`; defaults to `fast` |
 | `features` | `all` or a list | Standard workflow callers |
 | `codeql` | `auto`, `true`, `false` | CodeQL policy; public repositories default to enabled, non-public repositories default to disabled |
 | `codeql_rust_shards` | JSON array of paths | Rust scan scopes; `["all"]` keeps the safe single full scan |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.39.4",
+  "version": "0.40.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -100,6 +100,12 @@ export function syncRepository(options) {
   if (!['direct', 'staging-release'].includes(workflow)) {
     throw new Error(`Unsupported git_workflow: ${workflow}; use direct or staging-release.`)
   }
+  const stagingValidationMode = configured(config.staging_validation_mode, 'fast')
+  if (!['fast', 'audit'].includes(stagingValidationMode)) {
+    throw new Error(
+      `Unsupported staging_validation_mode: ${stagingValidationMode}; use fast or audit.`
+    )
+  }
   const mergeStrategy = configured(config.merge_strategy, 'rebase')
   if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
     throw new Error(`Unsupported merge_strategy: ${mergeStrategy}; the staging-release topology requires rebase for staging to main promotions.`)
@@ -429,7 +435,13 @@ function renderDependabot(content, config, languages) {
  * @returns {string}
  */
 export function renderContributionDocs(content, file, config) {
-  if (isStagingRelease(config.git_workflow)) return content
+  if (isStagingRelease(config.git_workflow)) {
+    if (configured(config.staging_validation_mode, 'fast') !== 'audit') return content
+    return content.replace(
+      'Fast validation: CI plus unit tests, ending in `Validation / Gate`',
+      'Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`'
+    )
+  }
   const replacements = DIRECT_DOC_REPLACEMENTS[file]
   if (!replacements) return content
   let rendered = content
@@ -645,7 +657,7 @@ function createDefaultConfig(root, source) {
     codeql_rust_shards: '["all"]', codeql_rust_threads: '1', codeql_rust_max_parallel: '1',
     runtime_repository: '0xPlayerOne/code-foundry', runtime_ref: `v${readPackageVersion(source)}`,
     ...runners,
-    toolchain: 'auto',
+    toolchain: 'auto', staging_validation_mode: 'fast',
     prune_standard: 'false', cache_packages: 'auto', cache_build: 'auto', coverage_minimum: '80', turbo_remote: 'auto',
     release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node', npm_publish: 'false',
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',

package/src/lib/validation-policy.mjs

@@ -40,18 +40,18 @@ export function isReleasePleaseHead(headRef) {
 
 /**
  * Classify an event into exactly one validation mode, failing closed:
- * - fast: pull_request targeting staging
+ * - fast or audit: pull_request targeting staging, according to the repository policy
  * - release: pull_request targeting main whose head is the exact approved
  *   Release Please prefix
  * - audit: every other pull_request targeting main, plus schedule and
  *   workflow_dispatch
  * Unsupported events (for example push) and unsupported base branches are
  * rejected so canonical validation can never silently run or silently skip.
- * @param {{ eventName: string, baseRef?: string, headRef?: string }} input
+ * @param {{ eventName: string, baseRef?: string, headRef?: string, stagingMode?: string }} input
  * @returns {'fast'|'audit'|'release'}
  */
 export function classifyValidationMode(input) {
-  const { eventName, baseRef, headRef } = input
+  const { eventName, baseRef, headRef, stagingMode = 'fast' } = input
   if (typeof eventName !== 'string' || !VALIDATION_EVENTS.includes(eventName)) {
     throw new Error(
       `Unsupported validation event: ${eventName ?? '(missing)'}; canonical validation must not run on this event.`
@@ -64,7 +64,14 @@ export function classifyValidationMode(input) {
   if (typeof headRef !== 'string' || headRef.length === 0) {
     throw new Error('pull_request classification requires head_ref.')
   }
-  if (baseRef === 'staging') return 'fast'
+  if (baseRef === 'staging') {
+    if (stagingMode !== 'fast' && stagingMode !== 'audit') {
+      throw new Error(
+        `Unsupported staging validation mode: ${stagingMode || '(missing)'}; expected fast or audit.`
+      )
+    }
+    return stagingMode
+  }
   if (baseRef === 'main') return isReleasePleaseHead(headRef) ? 'release' : 'audit'
   throw new Error(`Unsupported pull_request base branch: ${baseRef}; expected staging or main.`)
 }

package/src/runtime.mjs

@@ -53,6 +53,7 @@ function validation(task) {
       eventName: process.env.FOUNDRY_EVENT_NAME ?? '',
       baseRef: process.env.FOUNDRY_BASE_REF ?? '',
       headRef: process.env.FOUNDRY_HEAD_REF ?? '',
+      stagingMode: config.staging_validation_mode,
     }))
     return
   }