code-foundry 1.1.1 → 1.2.1

package/.github/code-foundry.yml

@@ -11,7 +11,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v1.1.0
+runtime_ref: v1.2.0
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later

package/.github/workflows/codeql.yml

@@ -33,15 +33,18 @@ on:
         required: false
         type: number
         default: 1
+        # Retained for caller compatibility. Rust shards share the single
+        # analysis matrix, so no separate throttle applies.
 permissions:
   actions: read
   contents: read
   packages: read
   security-events: write
 
-# Analyzers run only for detected languages: the analysis matrix is built from
-# detection, so repositories never see skipped checks for languages they do
-# not use. An empty matrix while analysis is enabled fails the build closed.
+# Analyzers run only for detected languages: a single analysis matrix is
+# built from detection (Rust shards expand inline), so repositories never
+# see checks — not even skipped ones — for languages they do not use. An
+# empty matrix while analysis is enabled fails the build closed.
 env:
   REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
   REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
@@ -61,7 +64,6 @@ jobs:
       languages: ${{ steps.languages.outputs.languages }}
       enabled: ${{ steps.languages.outputs.enabled }}
       matrix: ${{ steps.matrix.outputs.matrix }}
-      rust_matrix: ${{ steps.matrix.outputs.rust_matrix }}
       code_security: ${{ steps.security.outputs.status }}
       actions_available: ${{ steps.languages.outputs.actions_available }}
       actions_changed: ${{ steps.languages.outputs.actions_changed }}
@@ -144,30 +146,40 @@ jobs:
           const enabled = process.env.MATRIX_ENABLED === "true";
           if (!enabled) {
             append("matrix", "[]");
-            append("rust_matrix", "[]");
           } else {
             const languages = JSON.parse(process.env.MATRIX_LANGUAGES || "[]");
             const shards = JSON.parse(process.env.MATRIX_SHARDS || "[\"all\"]");
             const display = { actions: "Actions", "javascript-typescript": "TypeScript", python: "Python" };
+            // SARIF categories are the code-scanning baseline keys: they must
+            // stay byte-identical to the pre-matrix values (/language:actions,
+            // /language:javascript-typescript, /language:python,
+            // /language:rust/<scope>). Any rename orphans the main-branch
+            // baseline and breaks alert comparison on every pull request.
             const matrix = languages
               .filter((entry) => entry.language !== "rust")
               .map((entry) => ({
                 display: display[entry.language] || entry.language,
                 language: entry.language,
-                category: "/language/" + entry.language,
+                category: "/language:" + entry.language,
                 build_mode: entry["build-mode"] || "none",
                 changed: entry.changed === true,
               }));
             const rust = languages.find((entry) => entry.language === "rust");
-            const rustMatrix = rust
-              ? shards.map((shard) => ({ display: "Rust (" + shard + ")", shard: String(shard), changed: rust.changed === true }))
-              : [];
-            if (!matrix.length && !rustMatrix.length) {
+            for (const shard of rust ? shards : []) {
+              matrix.push({
+                display: String(shard) === "all" ? "Rust" : "Rust (" + shard + ")",
+                language: "rust",
+                category: "/language:rust",
+                build_mode: "none",
+                changed: rust.changed === true,
+                shard: String(shard),
+              });
+            }
+            if (!matrix.length) {
               console.error("CodeQL analysis matrix is empty while analysis is enabled.");
               process.exit(1);
             }
             append("matrix", JSON.stringify(matrix));
-            append("rust_matrix", JSON.stringify(rustMatrix));
           }
           '
 
@@ -206,56 +218,14 @@ jobs:
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Analyze
-        if: ${{ matrix.entry.changed == true }}
+        if: ${{ matrix.entry.changed == true && matrix.entry.language != 'rust' }}
         uses: ./.github/actions/codeql
         with:
           language: ${{ matrix.entry.language }}
           build-mode: ${{ matrix.entry.build_mode }}
           category: ${{ matrix.entry.category }}
-      - name: Not applicable
-        if: ${{ matrix.entry.changed != true }}
-        run: echo "CodeQL ${{ matrix.entry.display }} analysis is not applicable to this change."
-
-  # Rust keeps its own job so shard fan-out stays behind the
-  # rust-max-parallel throttle. The static name matches the pre-matrix check
-  # name; per-shard detail stays in the SARIF category and step logs.
-  analyze-rust:
-    name: Analyze (Rust)
-    needs: detect
-    if: vars.CI_BILLING_PAUSED != 'true' && needs.detect.outputs.enabled == 'true' && needs.detect.outputs.rust_available == 'true'
-    strategy:
-      fail-fast: false
-      max-parallel: ${{ inputs.rust-max-parallel }}
-      matrix:
-        entry: ${{ fromJson(needs.detect.outputs.rust_matrix || '[]') }}
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        if: ${{ matrix.entry.changed == true }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Runtime
-        if: ${{ matrix.entry.changed == true }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .github/.code-foundry
-          sparse-checkout: |
-            .github/actions
-            src/lib
-            src/runtime.mjs
-      - name: Install runtime
-        if: ${{ matrix.entry.changed == true }}
-        run: |
-          mkdir -p .github/actions
-          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
-          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Configure Rust scope
-        if: ${{ matrix.entry.changed == true }}
+        if: ${{ matrix.entry.changed == true && matrix.entry.language == 'rust' }}
         id: scope
         env:
           RUST_SCOPE: ${{ matrix.entry.shard }}
@@ -303,15 +273,15 @@ jobs:
           echo "config_file=$config_file" >> "$GITHUB_OUTPUT"
           echo "scope_id=$scope_id" >> "$GITHUB_OUTPUT"
       - name: Initialize
-        if: ${{ matrix.entry.changed == true }}
+        if: ${{ matrix.entry.changed == true && matrix.entry.language == 'rust' }}
         uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           languages: rust
           build-mode: ${{ needs.detect.outputs.rust_build_mode }}
           config-file: ${{ steps.scope.outputs.config_file }}
           threads: ${{ inputs.rust-threads }}
-      - name: Analyze
-        if: ${{ matrix.entry.changed == true }}
+      - name: Analyze Rust
+        if: ${{ matrix.entry.changed == true && matrix.entry.language == 'rust' }}
         uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           category: /language:rust/${{ steps.scope.outputs.scope_id }}
@@ -319,4 +289,4 @@ jobs:
           wait-for-processing: false
       - name: Not applicable
         if: ${{ matrix.entry.changed != true }}
-        run: echo "CodeQL Rust analysis is not applicable to this change."
+        run: echo "CodeQL ${{ matrix.entry.display }} analysis is not applicable to this change."

package/.github/workflows/opencode-security_self-ci.yml

@@ -9,16 +9,17 @@ permissions:
   contents: read
 
 jobs:
-  detect:
-    name: OpenCode Security / Detect
+  # One job: the release-please branch gate stays at the job level so
+  # ordinary pull requests render a single skipped check instead of two.
+  # The scan itself still runs only for generated release pull requests
+  # (or manual dispatch) with the scanner configured and keyed.
+  scan:
+    name: OpenCode Security / Scan
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
       (github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
     runs-on: ubuntu-slim
-    outputs:
-      enabled: ${{ steps.detect.outputs.enabled }}
-      token: ${{ steps.detect.outputs.token }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -35,20 +36,17 @@ jobs:
           if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
           echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
           echo "token=$token" >> "$GITHUB_OUTPUT"
-
-  scan:
-    name: OpenCode Security / Scan
-    needs: detect
-    if: vars.CI_BILLING_PAUSED != 'true' && needs.detect.outputs.enabled == 'true' && needs.detect.outputs.token == 'true'
-    uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@137698ef3545204af8fad00fc8bd64d663c8122e # main
-    with:
-      # This is the scanner checkout ref, not the consumer PR ref. The
-      # reusable workflow already checks out the consumer repository.
-      source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
-      runner: ubuntu-latest
-      model: opencode-go/muse-spark-1.3-contributor
-      mode: standard
-      fail_on_severity: high
-      max_cost_usd: 1
-    secrets:
-      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+      - name: Scan
+        if: steps.detect.outputs.enabled == 'true' && steps.detect.outputs.token == 'true'
+        uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@137698ef3545204af8fad00fc8bd64d663c8122e # main
+        with:
+          # This is the scanner checkout ref, not the consumer PR ref. The
+          # reusable workflow already checks out the consumer repository.
+          source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
+          runner: ubuntu-latest
+          model: opencode-go/muse-spark-1.3-contributor
+          mode: standard
+          fail_on_severity: high
+          max_cost_usd: 1
+        secrets:
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}

package/.github/workflows/validation.yml

@@ -119,43 +119,14 @@ jobs:
       rust-threads: ${{ inputs.rust-threads }}
       rust-max-parallel: ${{ inputs.rust-max-parallel }}
 
-  release-policy:
-    name: Release Policy
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'release'
-    runs-on: ubuntu-slim
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-          filter: blob:none
-      - name: Checkout runtime
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .github/.code-foundry
-          sparse-checkout: |
-            src/lib
-            src/runtime.mjs
-      - name: Install runtime
-        run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
-      - name: Validate generated release diff
-        env:
-          FOUNDRY_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          FOUNDRY_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-          FOUNDRY_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
-          FOUNDRY_REPOSITORY: ${{ github.repository }}
-        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation release_diff
-
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
+  # The release tier runs no suite jobs: its policy (generated release diff
+  # validation) executes as a conditional step below, so no separate
+  # release-policy job renders skipped checks on ordinary pull requests.
   gate:
     name: Gate
-    needs: [ci, test, security, codeql, release-policy]
+    needs: [ci, test, security, codeql]
     if: vars.CI_BILLING_PAUSED != 'true' && always()
     runs-on: ubuntu-slim
     timeout-minutes: 10
@@ -165,7 +136,6 @@ jobs:
       FOUNDRY_TEST: ${{ needs.test.result }}
       FOUNDRY_SECURITY: ${{ needs.security.result }}
       FOUNDRY_CODEQL: ${{ needs.codeql.result }}
-      FOUNDRY_RELEASE_POLICY: ${{ needs.release-policy.result }}
     steps:
       - name: Checkout runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -179,5 +149,20 @@ jobs:
             src/runtime.mjs
       - name: Install runtime
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+      - name: Checkout consumer repository
+        if: ${{ inputs.mode == 'release' }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          filter: blob:none
+      - name: Validate generated release diff
+        if: ${{ inputs.mode == 'release' }}
+        env:
+          FOUNDRY_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          FOUNDRY_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          FOUNDRY_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          FOUNDRY_REPOSITORY: ${{ github.repository }}
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation release_diff
       - name: Evaluate aggregate gate
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation gate

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.2.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.2.0...v1.2.1) (2026-09-06)
+
+
+### Bug Fixes
+
+* restore pre-matrix CodeQL SARIF category strings ([#468](https://github.com/0xPlayerOne/code-foundry/issues/468)) ([8c51892](https://github.com/0xPlayerOne/code-foundry/commit/8c518921bf3632ba5b8ee4ca757efe3bc302739a))
+
+## [1.2.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.1.1...v1.2.0) (2026-09-06)
+
+
+### Features
+
+* eliminate skipped checks with unified matrices and an in-gate release check ([#465](https://github.com/0xPlayerOne/code-foundry/issues/465)) ([55c3dca](https://github.com/0xPlayerOne/code-foundry/commit/55c3dca7a7d1460830464ec61f9b083d1350e3dd))
+
 ## [1.1.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.1.0...v1.1.1) (2026-09-06)
 
 

package/docs/WORKFLOWS.md

@@ -82,13 +82,15 @@ honor the shared billing pause.
 | Release | Release Please, GitHub release, and optional npm publication |
 
 Use concise job names such as `CI / Format`, `Test / Unit`, and
-`CodeQL / Analyze (Python)`. Per-language CodeQL analyzers and security
-audits run through a detection-built matrix, so a repository only ever shows
-checks for languages it actually uses; inapplicable languages produce no
-checks instead of skipped rows. Required checks should match the jobs
-actually enabled for the repository profile — in practice, require only the
-aggregate `Validation / Gate`, which fails closed unless every generated
-check succeeds.
+`CodeQL / Analyze (Python)`. Per-language CodeQL analyzers (Rust shards
+included) and security audits run through a detection-built matrix, so a
+repository only ever shows checks for languages it actually uses — never
+skipped rows for other languages. The release tier validates the generated
+diff as a step inside the gate rather than a separate job, for the same
+reason. Required checks should match the jobs actually enabled for the
+repository profile — in practice, require only the aggregate
+`Validation / Gate`, which fails closed unless every generated check
+succeeds.
 
 ## Merge methods
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/lib/validation-policy.mjs

@@ -19,8 +19,10 @@ export const RELEASE_PLEASE_PREFIX = 'release-please--branches--main'
 
 /** Stable aggregate check name emitted by the validation orchestrator's gate job. */
 export const AGGREGATE_CHECK_NAME = 'Validation / Gate'
-/** Job ids owned by the validation orchestrator. */
-export const VALIDATION_JOBS = ['ci', 'test', 'security', 'codeql', 'release-policy']
+/** Job ids owned by the validation orchestrator. The release tier runs no
+ * suite jobs: its policy executes as a conditional step inside the gate, so
+ * no release-policy job id exists. */
+export const VALIDATION_JOBS = ['ci', 'test', 'security', 'codeql']
 
 /** Events that may trigger canonical validation. */
 export const VALIDATION_EVENTS = ['pull_request', 'schedule', 'workflow_dispatch']
@@ -80,7 +82,10 @@ export function classifyValidationMode(input) {
 const REQUIRED_JOBS_BY_MODE = {
   fast: ['ci', 'test'],
   audit: ['ci', 'test', 'security', 'codeql'],
-  release: ['release-policy'],
+  // The release tier requires no suite jobs: the generated release diff
+  // check runs as a conditional step inside the gate itself, so an empty
+  // requirement list is complete and any suite result is irrelevant.
+  release: [],
 }
 
 /**

package/src/runtime.mjs

@@ -66,7 +66,6 @@ function validation(task) {
         test: process.env.FOUNDRY_TEST,
         security: process.env.FOUNDRY_SECURITY,
         codeql: process.env.FOUNDRY_CODEQL,
-        'release-policy': process.env.FOUNDRY_RELEASE_POLICY,
       },
     })
     if (gate.valid) {