code-foundry 1.10.0 → 1.10.1

package/.github/CONTRIBUTING.md

@@ -181,11 +181,11 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |
 | Scheduled or manual validation                     | Full audit tier                                                                       |
 | Push to a working branch                           | Draft PR workflow                                                                     |
-| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |
+| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |
 
 Draft pull requests do not start validation. The lightweight Draft Guard also converts ordinary pull requests opened, reopened, or updated while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier. Convert it back to draft after an update, then mark it ready again after every update so the required checks attach to the current head. Converting it to draft runs only the lightweight cancellation control.
 
-Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Both callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate.
+Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 

package/.github/workflows/validation_self-ci.yml

@@ -1,6 +1,8 @@
 name: Code Foundry
 
 on:
+  push:
+    branches: [main]
   pull_request:
     branches: [main, staging]
     types:
@@ -18,9 +20,9 @@ concurrency:
 jobs:
   mode:
     name: Mode
-    # The workflow is emitted only for ready_for_review, so draft pull requests
-    # register no skipped validation checks and allocate no validation runner.
-    if: vars.CI_BILLING_PAUSED != 'true'
+    # The mode classifier is only needed for pull requests. Main pushes use
+    # the dedicated default-branch CodeQL lane below.
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request'
     runs-on: ubuntu-slim
     timeout-minutes: 10
     permissions:
@@ -59,7 +61,7 @@ jobs:
   validation:
     name: Validation
     needs: mode
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request'
     # Reusable workflows can only maintain or reduce the caller job's scopes.
     # The audit tier needs security-events: write for CodeQL uploads.
     permissions:
@@ -87,3 +89,23 @@ jobs:
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
+
+  # CodeQL requires a push analysis to populate default-branch code-scanning
+  # alerts. Keep the full validation gate pull-request-only so main pushes do
+  # not duplicate CI, test, or security work.
+  default-branch-codeql:
+    name: CodeQL (default branch)
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: ./.github/workflows/codeql.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.10.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.10.0...v1.10.1) (2026-09-09)
+
+
+### Bug Fixes
+
+* **doctor:** honor shared config and correctly identify npm/Yarn lockfiles ([#533](https://github.com/0xPlayerOne/code-foundry/issues/533)) ([6464409](https://github.com/0xPlayerOne/code-foundry/commit/646440907ad3fc47f63e27b9621c8e0025459964))
+* **validation:** scan default branch with CodeQL on push ([#540](https://github.com/0xPlayerOne/code-foundry/issues/540)) ([98d8241](https://github.com/0xPlayerOne/code-foundry/commit/98d8241522c78e1b6d3f4f29a44053d33888edba))
+
 ## [1.10.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.13...v1.10.0) (2026-09-08)
 
 

package/README.md

@@ -70,7 +70,7 @@ when present and otherwise uses native language tooling; choose `native` or
 
 The standard workflow triggers are:
 
-- Pushes to `main` (and `staging` when `git_workflow: staging-release` is configured).
+- Pushes to `main` (and `staging` when `git_workflow: staging-release` is configured); main pushes also run the default-branch CodeQL scan.
 - Pull requests targeting `main` (and `staging` in the staging-release topology).
 - Draft PR automation for supported feature/fix branches.
 

package/docs/WORKFLOWS.md

@@ -4,16 +4,21 @@
 
 Validation uses two callers so pull-request code and default-branch-capable
 audit events never share a caller-selected runtime ref. The canonical
-`validation.yml` caller handles pull requests only:
+`validation.yml` caller handles pull requests and a lightweight default-branch
+CodeQL lane:
 
 ```yaml
+push:
+  branches: [main] # CodeQL only
 pull_request:
   branches: [main, staging] # staging-release topology
   # direct topology: branches: [main]
 ```
 
-The generated validation caller listens only for `ready_for_review`, so draft
-pull requests register no validation checks and allocate no validation runner.
+The generated validation caller listens for `ready_for_review` and `push` to
+`main`. Draft pull requests register no validation checks and allocate no
+validation runner; main pushes run only the default-branch CodeQL lane, while
+full validation remains pull-request-only.
 A separate lightweight Draft Guard runs from the trusted base branch on
 `opened`, `reopened`, and `synchronize`; it converts ordinary ready pull
 requests back to draft without checking out pull-request code. It rechecks the
@@ -44,7 +49,7 @@ Scheduled and manual runs select the audit tier in both topologies. Draft PR
 automation separately listens to supported topic-branch pushes and always
 opens those PRs as drafts. Promotion automation listens to `staging` pushes
 (staging-release only) and also always opens its PR as a draft. Release
-automation listens to `main` pushes.
+automation and default-branch CodeQL listen to `main` pushes.
 Custom deployment, indexing, search, Slither, or other workflows are
 repository-owned extensions and should use the same ready-transition policy.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -5,6 +5,7 @@ import { join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
 import { recommendRunners, resolveProfile } from '../lib/profile.mjs'
+import { packageManagerForLockfile } from '../lib/lockfiles.mjs'
 import { doctorGithub } from '../lib/github-doctor.mjs'
 import { isGeneratedEventCaller } from './sync.mjs'
 
@@ -69,9 +70,7 @@ export function doctor(root, options = {}) {
     if (lockfiles.length > 1) error('multiple JavaScript lockfiles found; keep one package manager')
     if (packageJson.packageManager && lockfiles.length) {
       const declared = String(packageJson.packageManager).split('@')[0]
-      const actual = lockfiles[0]?.startsWith('bun')
-        ? 'bun'
-        : lockfiles[0]?.split('-')[0].replace('.yaml', '')
+      const actual = packageManagerForLockfile(lockfiles[0])
       if (actual && declared !== actual)
         error(`packageManager (${declared}) does not match ${actual} lockfile`)
     }

package/src/commands/sync.mjs

@@ -537,12 +537,15 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   let rendered = content.replaceAll(localPrefix, remotePrefix)
   // An explicitly unavailable CodeQL capability selects an orchestrator that
   // omits the job entirely, so GitHub does not register a misleading skipped
-  // check on every pull request. `auto` retains runtime capability detection.
+  // check on every pull request or an unused main-push run. `auto` retains
+  // runtime capability detection.
   if (configured(config.codeql, 'auto') === 'false') {
     rendered = rendered.replaceAll(
       `${remotePrefix}validation.yml`,
       `${remotePrefix}validation-no-codeql.yml`
     )
+    rendered = removeWorkflowBlock(rendered, 'default-branch-codeql')
+    rendered = removeWorkflowBlock(rendered, 'push')
   }
   rendered = rendered.replace(
     new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'),
@@ -640,6 +643,25 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   return rendered
 }
 
+/**
+ * Remove a root-level YAML block by id while preserving the surrounding file.
+ * This is used for workflow jobs and triggers whose feature is disabled by
+ * configuration.
+ * @param {string} content
+ * @param {string} blockId
+ * @returns {string}
+ */
+function removeWorkflowBlock(content, blockId) {
+  const lines = content.split('\n')
+  const start = lines.findIndex((line) => line === `  ${blockId}:`)
+  if (start === -1) return content
+  let end = start + 1
+  while (end < lines.length && !/^  [A-Za-z0-9_-]+:\s*$/.test(lines[end])) end += 1
+  lines.splice(start, end - start)
+  if (content.endsWith('\n') && lines.at(-1) !== '') lines.push('')
+  return lines.join('\n')
+}
+
 /**
  * Dependabot updates land on the repository's integration branch. Direct
  * repositories have no staging branch, so every update targets main. Cargo,
@@ -779,8 +801,8 @@ const DIRECT_DOC_REPLACEMENTS = {
       '7. Push to the fork and open a pull request targeting `main`.',
     ],
     [
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |\n',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',

package/src/lib/github-doctor.mjs

@@ -3,6 +3,7 @@
 import { readFileSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { readConfig } from './config.mjs'
 
 /** @param {string} root @returns {{ errors: string[], warnings: string[], details: Record<string, unknown> }} */
 export function doctorGithub(root) {
@@ -306,22 +307,3 @@ function ghJson(args) {
 function commandExists(command) {
   return spawnSync(command, ['--version'], { stdio: 'ignore' }).status === 0
 }
-
-/** @param {string} root @returns {Record<string, string>} */
-function readConfig(root) {
-  const file = join(root, '.github/code-foundry.yml')
-  try {
-    return Object.fromEntries(
-      readFileSync(file, 'utf8')
-        .split(/\r?\n/)
-        .flatMap((line) => {
-          const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*?)\s*$/)
-          return match
-            ? [[match[1], match[2].replace(/\s+#.*$/, '').replace(/^['"]|['"]$/g, '')]]
-            : []
-        })
-    )
-  } catch {
-    return {}
-  }
-}

package/src/lib/lockfiles.mjs

@@ -0,0 +1,15 @@
+// @ts-check
+
+/** @type {Readonly<Record<string, string>>} */
+const managers = Object.freeze({
+  'bun.lock': 'bun',
+  'bun.lockb': 'bun',
+  'pnpm-lock.yaml': 'pnpm',
+  'yarn.lock': 'yarn',
+  'package-lock.json': 'npm',
+})
+
+/** @param {string | undefined} file @returns {string | undefined} */
+export function packageManagerForLockfile(file) {
+  return file && Object.hasOwn(managers, file) ? managers[file] : undefined
+}