code-foundry 1.0.0 → 1.0.3

package/.github/actions/cache/action.yml

@@ -25,9 +25,13 @@ outputs:
 runs:
   using: composite
   steps:
+    # Caches are restored on every event but saved on push only: scheduled
+    # and dispatched runs share the default branch with untrusted
+    # runtime-ref checkouts, so letting them save would allow cache
+    # poisoning. Push events require write access and stay trusted.
     - name: Restore cache
       id: restore
-      if: inputs.save != 'true'
+      if: inputs.save != 'true' || github.event_name != 'push'
       uses: actions/cache/restore@v5
       with:
         path: ${{ inputs.path }}
@@ -35,7 +39,7 @@ runs:
         restore-keys: ${{ inputs.restore-keys }}
     - name: Restore and save cache
       id: cache
-      if: inputs.save == 'true'
+      if: inputs.save == 'true' && github.event_name == 'push'
       uses: actions/cache@v5
       with:
         path: ${{ inputs.path }}

package/.github/code-foundry.yml

@@ -11,7 +11,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v0.34.4
+runtime_ref: v1.0.0
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later

package/.github/workflows/release.yml

@@ -489,6 +489,27 @@ jobs:
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
+      - name: Setup Bun (lockfile managers)
+        # The install step below dispatches on lockfile: bun, pnpm, yarn, or
+        # npm. Stock runners only provide Node, so provision Bun (oven-sh)
+        # and Corepack (pnpm/yarn) explicitly; otherwise bun.lock projects
+        # fail with `bun: command not found` before publish.
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: latest
+      - name: Enable Corepack (pnpm/yarn managers)
+        run: corepack enable
+      - name: Install dependencies
+        # npm publish runs prepublishOnly (usually a build), which needs
+        # devDependencies present. Install with the project's own manager.
+        run: |
+          set -euo pipefail
+          if [ -f bun.lock ] || [ -f bun.lockb ]; then bun install --frozen-lockfile
+          elif [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile
+          elif [ -f yarn.lock ]; then yarn install --immutable
+          elif [ -f package-lock.json ]; then npm ci --no-audit --fund=false
+          elif [ -f package.json ]; then npm install --no-audit --fund=false --package-lock=false
+          fi
       - name: Publish npm with token
         if: env.NPM_TOKEN != ''
         env:

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [1.0.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.2...v1.0.3) (2026-09-06)
+
+
+### Bug Fixes
+
+* **security:** save caches on push events only ([3180b07](https://github.com/0xPlayerOne/code-foundry/commit/3180b07a669b7caa5728be6a07143d60a0c7f6af))
+
+## [1.0.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.1...v1.0.2) (2026-09-05)
+
+
+### Bug Fixes
+
+* **release:** provision bun and corepack before publish install ([32f9b15](https://github.com/0xPlayerOne/code-foundry/commit/32f9b153cdc96cf3c38b379eada41853116e9200))
+
+## [1.0.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.0...v1.0.1) (2026-09-05)
+
+
+### Bug Fixes
+
+* **release:** install dependencies before npm publish ([8e03535](https://github.com/0xPlayerOne/code-foundry/commit/8e0353549c42b982e84c28db94351d752a28d60e))
+
 ## [1.0.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.3...v1.0.0) (2026-09-05)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",