code-foundry 1.0.6 → 1.1.0

package/.github/workflows/codeql.yml

@@ -39,7 +39,9 @@ permissions:
   packages: read
   security-events: write
 
-# Every analyzer emits a successful check, including when its language is not applicable.
+# Analyzers run only for detected languages: the analysis matrix is built from
+# detection, so repositories never see skipped checks for languages they do
+# not use. An empty matrix while analysis is enabled fails the build closed.
 env:
   REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
   REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
@@ -58,6 +60,8 @@ jobs:
     outputs:
       languages: ${{ steps.languages.outputs.languages }}
       enabled: ${{ steps.languages.outputs.enabled }}
+      matrix: ${{ steps.matrix.outputs.matrix }}
+      rust_matrix: ${{ steps.matrix.outputs.rust_matrix }}
       code_security: ${{ steps.security.outputs.status }}
       actions_available: ${{ steps.languages.outputs.actions_available }}
       actions_changed: ${{ steps.languages.outputs.actions_changed }}
@@ -126,148 +130,65 @@ jobs:
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
         run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs codeql
-
-  analyze-actions:
-    name: Analyze (Actions)
-    needs: detect
-    if: >-
-      vars.CI_BILLING_PAUSED != 'true' &&
-      needs.detect.outputs.enabled == 'true' &&
-      needs.detect.outputs.actions_available == 'true'
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.actions_available == 'true' &&
-          needs.detect.outputs.actions_changed == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.actions_available == 'true' &&
-          needs.detect.outputs.actions_changed == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .github/.code-foundry
-          sparse-checkout: |
-            .github/actions
-            src/lib
-            src/runtime.mjs
-      - name: Install runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.actions_available == 'true' &&
-          needs.detect.outputs.actions_changed == 'true'
-        run: |
-          mkdir -p .github/actions
-          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
-          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
-      - name: Analyze
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.actions_available == 'true' &&
-          needs.detect.outputs.actions_changed == 'true'
-        uses: ./.github/actions/codeql
-        with:
-          language: actions
-          build-mode: ${{ needs.detect.outputs.actions_build_mode }}
-          category: /language:actions
-      - name: Not applicable
-        if: >-
-          needs.detect.outputs.enabled != 'true' ||
-          needs.detect.outputs.actions_available != 'true' ||
-          needs.detect.outputs.actions_changed != 'true'
-        run: echo "CodeQL Actions analysis is not applicable to this change."
-
-  analyze-typescript:
-    name: Analyze (TypeScript)
-    needs: detect
-    if: >-
-      vars.CI_BILLING_PAUSED != 'true' &&
-      needs.detect.outputs.enabled == 'true' &&
-      needs.detect.outputs.javascript_available == 'true'
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.javascript_available == 'true' &&
-          needs.detect.outputs.javascript_changed == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.javascript_available == 'true' &&
-          needs.detect.outputs.javascript_changed == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .github/.code-foundry
-          sparse-checkout: |
-            .github/actions
-            src/lib
-            src/runtime.mjs
-      - name: Install runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.javascript_available == 'true' &&
-          needs.detect.outputs.javascript_changed == 'true'
+      - id: matrix
+        name: Build analysis matrix
+        env:
+          MATRIX_ENABLED: ${{ steps.languages.outputs.enabled }}
+          MATRIX_LANGUAGES: ${{ steps.languages.outputs.languages }}
+          MATRIX_SHARDS: ${{ inputs.rust-shards }}
         run: |
-          mkdir -p .github/actions
-          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
-          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
-      - name: Analyze
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.javascript_available == 'true' &&
-          needs.detect.outputs.javascript_changed == 'true'
-        uses: ./.github/actions/codeql
-        with:
-          language: javascript-typescript
-          build-mode: ${{ needs.detect.outputs.javascript_build_mode }}
-          category: /language:javascript-typescript
-      - name: Not applicable
-        if: >-
-          needs.detect.outputs.enabled != 'true' ||
-          needs.detect.outputs.javascript_available != 'true' ||
-          needs.detect.outputs.javascript_changed != 'true'
-        run: echo "CodeQL TypeScript analysis is not applicable to this change."
+          node -e '
+          const fs = require("node:fs");
+          const out = process.env.GITHUB_OUTPUT;
+          function append(name, value) { fs.appendFileSync(out, name + "=" + value + "\n"); }
+          const enabled = process.env.MATRIX_ENABLED === "true";
+          if (!enabled) {
+            append("matrix", "[]");
+            append("rust_matrix", "[]");
+          } else {
+            const languages = JSON.parse(process.env.MATRIX_LANGUAGES || "[]");
+            const shards = JSON.parse(process.env.MATRIX_SHARDS || "[\"all\"]");
+            const display = { actions: "Actions", "javascript-typescript": "TypeScript", python: "Python" };
+            const matrix = languages
+              .filter((entry) => entry.language !== "rust")
+              .map((entry) => ({
+                display: display[entry.language] || entry.language,
+                language: entry.language,
+                category: "/language/" + entry.language,
+                build_mode: entry["build-mode"] || "none",
+                changed: entry.changed === true,
+              }));
+            const rust = languages.find((entry) => entry.language === "rust");
+            const rustMatrix = rust
+              ? shards.map((shard) => ({ display: "Rust (" + shard + ")", shard: String(shard), changed: rust.changed === true }))
+              : [];
+            if (!matrix.length && !rustMatrix.length) {
+              console.error("CodeQL analysis matrix is empty while analysis is enabled.");
+              process.exit(1);
+            }
+            append("matrix", JSON.stringify(matrix));
+            append("rust_matrix", JSON.stringify(rustMatrix));
+          }
+          '
 
-  analyze-python:
-    name: Analyze (Python)
+  analyze:
+    name: Analyze (${{ matrix.entry.display }})
     needs: detect
-    if: >-
-      vars.CI_BILLING_PAUSED != 'true' &&
-      needs.detect.outputs.enabled == 'true' &&
-      needs.detect.outputs.python_available == 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && needs.detect.outputs.enabled == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        entry: ${{ fromJson(needs.detect.outputs.matrix || '[]') }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
       - name: Checkout
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.python_available == 'true' &&
-          needs.detect.outputs.python_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.python_available == 'true' &&
-          needs.detect.outputs.python_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
@@ -279,59 +200,41 @@ jobs:
             src/lib
             src/runtime.mjs
       - name: Install runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.python_available == 'true' &&
-          needs.detect.outputs.python_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         run: |
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Analyze
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.python_available == 'true' &&
-          needs.detect.outputs.python_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         uses: ./.github/actions/codeql
         with:
-          language: python
-          build-mode: ${{ needs.detect.outputs.python_build_mode }}
-          category: /language:python
+          language: ${{ matrix.entry.language }}
+          build-mode: ${{ matrix.entry.build_mode }}
+          category: ${{ matrix.entry.category }}
       - name: Not applicable
-        if: >-
-          needs.detect.outputs.enabled != 'true' ||
-          needs.detect.outputs.python_available != 'true' ||
-          needs.detect.outputs.python_changed != 'true'
-        run: echo "CodeQL Python analysis is not applicable to this change."
+        if: ${{ matrix.entry.changed != true }}
+        run: echo "CodeQL ${{ matrix.entry.display }} analysis is not applicable to this change."
 
   analyze-rust:
-    name: Analyze (Rust)
+    name: Analyze (${{ matrix.entry.display }})
     needs: detect
-    if: >-
-      vars.CI_BILLING_PAUSED != 'true' &&
-      needs.detect.outputs.enabled == 'true' &&
-      needs.detect.outputs.rust_available == 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && needs.detect.outputs.enabled == 'true' && needs.detect.outputs.rust_available == 'true'
     strategy:
       fail-fast: false
       max-parallel: ${{ inputs.rust-max-parallel }}
       matrix:
-        shard: ${{ fromJson(inputs.rust-shards) }}
+        entry: ${{ fromJson(needs.detect.outputs.rust_matrix || '[]') }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
       - name: Checkout
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.rust_available == 'true' &&
-          needs.detect.outputs.rust_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.rust_available == 'true' &&
-          needs.detect.outputs.rust_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
@@ -343,22 +246,16 @@ jobs:
             src/lib
             src/runtime.mjs
       - name: Install runtime
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.rust_available == 'true' &&
-          needs.detect.outputs.rust_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         run: |
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Configure Rust scope
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.rust_available == 'true' &&
-          needs.detect.outputs.rust_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         id: scope
         env:
-          RUST_SCOPE: ${{ matrix.shard }}
+          RUST_SCOPE: ${{ matrix.entry.shard }}
         run: |
           set -euo pipefail
           scope="$RUST_SCOPE"
@@ -403,10 +300,7 @@ jobs:
           echo "config_file=$config_file" >> "$GITHUB_OUTPUT"
           echo "scope_id=$scope_id" >> "$GITHUB_OUTPUT"
       - name: Initialize
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.rust_available == 'true' &&
-          needs.detect.outputs.rust_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           languages: rust
@@ -414,18 +308,12 @@ jobs:
           config-file: ${{ steps.scope.outputs.config_file }}
           threads: ${{ inputs.rust-threads }}
       - name: Analyze
-        if: >-
-          needs.detect.outputs.enabled == 'true' &&
-          needs.detect.outputs.rust_available == 'true' &&
-          needs.detect.outputs.rust_changed == 'true'
+        if: ${{ matrix.entry.changed == true }}
         uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           category: /language:rust/${{ steps.scope.outputs.scope_id }}
           upload-database: false
           wait-for-processing: false
       - name: Not applicable
-        if: >-
-          needs.detect.outputs.enabled != 'true' ||
-          needs.detect.outputs.rust_available != 'true' ||
-          needs.detect.outputs.rust_changed != 'true'
-        run: echo "CodeQL Rust analysis is not applicable to this change."
+        if: ${{ matrix.entry.changed != true }}
+        run: echo "CodeQL ${{ matrix.entry.display }} analysis is not applicable to this change."

package/.github/workflows/security.yml

@@ -45,6 +45,7 @@ jobs:
       python: ${{ steps.profile.outputs.python }}
       python_requirements: ${{ steps.profile.outputs.python_requirements }}
       dependency_review: ${{ steps.profile.outputs.dependency_review }}
+      audit_matrix: ${{ steps.matrix.outputs.audit_matrix }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -99,15 +100,49 @@ jobs:
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
         run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security profile >> "$GITHUB_OUTPUT"
+      - id: matrix
+        name: Build audit matrix
+        env:
+          MATRIX_JAVASCRIPT: ${{ steps.profile.outputs.javascript }}
+          MATRIX_RUST: ${{ steps.profile.outputs.rust }}
+          MATRIX_PYTHON: ${{ steps.profile.outputs.python }}
+          MATRIX_REQUIREMENTS: ${{ steps.profile.outputs.python_requirements }}
+        run: |
+          node -e '
+          const fs = require("node:fs");
+          const env = process.env;
+          const entries = [];
+          if (env.MATRIX_JAVASCRIPT === "true") entries.push({ display: "JavaScript", language: "javascript" });
+          if (env.MATRIX_RUST === "true") entries.push({ display: "Rust", language: "rust" });
+          if (env.MATRIX_PYTHON === "true") {
+            let requirements = [];
+            try { requirements = JSON.parse(env.MATRIX_REQUIREMENTS || "[]"); } catch (error) { requirements = []; }
+            for (const requirement of requirements.filter((item) => item && item !== "none")) {
+              entries.push({ display: "Python / " + requirement, language: "python", requirement: requirement });
+            }
+          }
+          fs.appendFileSync(env.GITHUB_OUTPUT, "audit_matrix=" + JSON.stringify(entries) + "\n");
+          '
 
-  dependency-audit-javascript:
-    name: Dependency Audit (JavaScript)
+  # Audits run only for detected languages: the audit matrix is built from the
+  # profile, so repositories never see skipped checks for ecosystems they do
+  # not use. An empty matrix skips this job with no per-language rows.
+  dependency-audit:
+    name: Dependency Audit (${{ matrix.entry.display }})
     needs: profile
-    if: ${{ vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success' && needs.profile.outputs.javascript == 'true' }}
+    if: vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success'
+    strategy:
+      fail-fast: false
+      max-parallel: 8
+      matrix:
+        entry: ${{ fromJson(needs.profile.outputs.audit_matrix || '[]') }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
+    env:
+      REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.entry.requirement }}
     steps:
-      - name: Checkout
+      - name: Checkout JavaScript
+        if: matrix.entry.language == 'javascript'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
@@ -126,43 +161,22 @@ jobs:
             **/yarn.lock
             **/package-lock.json
           sparse-checkout-cone-mode: false
-      - name: Runtime
+      - name: Checkout Rust
+        if: matrix.entry.language == 'rust'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .github/.code-foundry
+          filter: blob:none
           sparse-checkout: |
-            .github/actions
-            src/lib
-            src/runtime.mjs
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions
-          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
-          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
-      - name: Detect
-        id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
-      - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
-        uses: ./.github/actions/setup
-        with:
-          mise-scope: javascript
-          cache-save: ${{ github.event_name == 'push' }}
-      - name: Audit dependencies
-        if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit javascript
-
-  dependency-audit-rust:
-    name: Dependency Audit (Rust)
-    needs: profile
-    if: ${{ vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success' && needs.profile.outputs.rust == 'true' }}
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
+            .github
+            .mise.toml
+            mise.lock
+            **/Cargo.toml
+            **/Cargo.lock
+            **/.cargo/**
+          sparse-checkout-cone-mode: false
+      - name: Checkout Python
+        if: matrix.entry.language == 'python'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
@@ -171,9 +185,14 @@ jobs:
             .github
             .mise.toml
             mise.lock
-            **/Cargo.toml
-            **/Cargo.lock
-            **/.cargo/**
+            **/pyproject.toml
+            **/requirements*.txt
+            **/setup.py
+            **/setup.cfg
+            **/Pipfile
+            **/Pipfile.lock
+            **/poetry.lock
+            **/uv.lock
           sparse-checkout-cone-mode: false
       - name: Runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -191,12 +210,32 @@ jobs:
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
-      - name: Detect
-        id: applicability
+      - name: Detect JavaScript
+        id: applicability-javascript
+        if: matrix.entry.language == 'javascript'
+        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
+      - name: Detect Rust
+        id: applicability-rust
+        if: matrix.entry.language == 'rust'
         run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security should_run rust >> "$GITHUB_OUTPUT"
+      - name: Setup JavaScript
+        if: >-
+          matrix.entry.language == 'javascript' &&
+          steps.applicability-javascript.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: javascript
+          cache-save: ${{ github.event_name == 'push' }}
+      - name: Audit JavaScript dependencies
+        if: >-
+          matrix.entry.language == 'javascript' &&
+          steps.applicability-javascript.outputs.applicable == 'true'
+        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit javascript
       - name: Check Rust
         id: system-rust
-        if: steps.applicability.outputs.applicable == 'true'
+        if: >-
+          matrix.entry.language == 'rust' &&
+          steps.applicability-rust.outputs.applicable == 'true'
         shell: bash
         run: |
           if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
@@ -206,109 +245,37 @@ jobs:
           else
             echo 'available=false' >> "$GITHUB_OUTPUT"
           fi
-      - name: Setup
+      - name: Setup Rust
         if: >-
-          steps.applicability.outputs.applicable == 'true' &&
+          matrix.entry.language == 'rust' &&
+          steps.applicability-rust.outputs.applicable == 'true' &&
           steps.system-rust.outputs.available != 'true'
         uses: ./.github/actions/setup
         with:
           mise-scope: rust
           cache-save: ${{ github.event_name == 'push' }}
       - name: Install cargo-audit
-        if: steps.applicability.outputs.applicable == 'true'
+        if: >-
+          matrix.entry.language == 'rust' &&
+          steps.applicability-rust.outputs.applicable == 'true'
         uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2
         with:
           tool: cargo-audit
-      - name: Audit dependencies
-        if: steps.applicability.outputs.applicable == 'true'
+      - name: Audit Rust dependencies
+        if: >-
+          matrix.entry.language == 'rust' &&
+          steps.applicability-rust.outputs.applicable == 'true'
         run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit rust
-
-  dependency-audit-python:
-    name: Dependency Audit (Python) / ${{ matrix.requirement }}
-    needs: profile
-    if: >-
-      ${{ vars.CI_BILLING_PAUSED != 'true' &&
-      needs.profile.result == 'success' &&
-      needs.profile.outputs.python == 'true' &&
-      needs.profile.outputs.python_requirements != '["none"]' }}
-    strategy:
-      fail-fast: false
-      max-parallel: 8
-      matrix:
-        requirement: ${{ fromJSON(needs.profile.outputs.python_requirements) }}
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    env:
-      REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.requirement }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          filter: blob:none
-          sparse-checkout: |
-            .github
-            .mise.toml
-            mise.lock
-            **/pyproject.toml
-            **/requirements*.txt
-            **/setup.py
-            **/setup.cfg
-            **/Pipfile
-            **/Pipfile.lock
-            **/poetry.lock
-            **/uv.lock
-          sparse-checkout-cone-mode: false
-      - name: Runtime
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .github/.code-foundry
-          sparse-checkout: |
-            .github/actions
-            src/lib
-            src/runtime.mjs
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions
-          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
-          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
-      - name: Setup
+      - name: Setup Python
+        if: matrix.entry.language == 'python'
         uses: ./.github/actions/setup
         with:
           mise-scope: python
           cache-save: ${{ github.event_name == 'push' }}
-      - name: Audit dependencies
+      - name: Audit Python dependencies
+        if: matrix.entry.language == 'python'
         run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit python
 
-  dependency-audit-python-gate:
-    name: Dependency Audit (Python)
-    needs: [profile, dependency-audit-python]
-    if: >-
-      ${{ vars.CI_BILLING_PAUSED != 'true' &&
-      always() &&
-      needs.profile.result == 'success' &&
-      needs.profile.outputs.python == 'true' &&
-      needs.profile.outputs.python_requirements != '["none"]' }}
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 5
-    steps:
-      - name: Gate
-        env:
-          PROFILE_RESULT: ${{ needs.profile.result }}
-          AUDIT_RESULT: ${{ needs.dependency-audit-python.result }}
-        run: |
-          if [ "$PROFILE_RESULT" != success ]; then
-            echo "Python audit profile failed: $PROFILE_RESULT" >&2
-            exit 1
-          fi
-          case "$AUDIT_RESULT" in
-            success|skipped) exit 0 ;;
-            *) echo "Python dependency audit failed: $AUDIT_RESULT" >&2; exit 1 ;;
-          esac
-
   dependency-review:
     name: Dependency Review
     needs: profile

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.1.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.6...v1.1.0) (2026-09-06)
+
+
+### Features
+
+* scope per-language checks to detected languages via matrix ([#459](https://github.com/0xPlayerOne/code-foundry/issues/459)) ([71f8985](https://github.com/0xPlayerOne/code-foundry/commit/71f8985b9732d39b7b68df40a4c8cbe5a90175fe))
+
 ## [1.0.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.5...v1.0.6) (2026-09-06)
 
 

package/docs/WORKFLOWS.md

@@ -82,8 +82,13 @@ honor the shared billing pause.
 | Release | Release Please, GitHub release, and optional npm publication |
 
 Use concise job names such as `CI / Format`, `Test / Unit`, and
-`CodeQL / Analyze (Python)`. Required checks should match the jobs actually
-enabled for the repository profile.
+`CodeQL / Analyze (Python)`. Per-language CodeQL analyzers and security
+audits run through a detection-built matrix, so a repository only ever shows
+checks for languages it actually uses; inapplicable languages produce no
+checks instead of skipped rows. Required checks should match the jobs
+actually enabled for the repository profile — in practice, require only the
+aggregate `Validation / Gate`, which fails closed unless every generated
+check succeeds.
 
 ## Merge methods
 
@@ -178,9 +183,13 @@ validation gate. Land changes through the standard `direct` or
 - Solidity: preserve the repository's native Hardhat, Foundry, or specialized
   test/security workflows.
 
-Jobs detect applicability before installing tools. Empty language or test
-surfaces remain successful and visible, so branch protection does not become
-ambiguous for mixed-language repositories.
+Jobs detect applicability before installing tools. Per-language CodeQL and
+security-audit jobs are generated from detection, so empty language surfaces
+produce no checks at all instead of skipped rows; the aggregate
+`Validation / Gate` keeps branch protection unambiguous for mixed-language
+repositories by failing closed unless every generated check succeeds. An
+empty analysis matrix while analysis is enabled fails the build instead of
+silently skipping every analyzer.
 
 ## Security behavior
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.0.6",
+  "version": "1.1.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",