code-foundry 1.11.0 → 1.13.0

package/.github/CONTRIBUTING.md

@@ -41,13 +41,14 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 - Open every ordinary pull request as a draft. Use `gh pr create --draft` or
   set `draft: true` in the GitHub API; never create a ready ordinary pull
   request as a shortcut.
-- Keep ordinary pull requests in draft while making commits. The generated
-  Draft Guard resets a ready ordinary pull request to draft on creation,
-  reopening, or a new commit, and runner-heavy validation starts only after an
+- Keep ordinary pull requests in draft while preparing them. The generated
+  Draft Guard converts ready ordinary pull requests to draft when they are
+  opened or reopened, and runner-heavy validation starts only after an
   explicit `ready_for_review` transition.
 - Run local validation and finish review preparation before marking an ordinary
-  pull request ready. After any later commit, mark it ready again only after
-  the current head is ready for review.
+  pull request ready. Ready pull requests stay ready when new commits arrive,
+  and validation reruns for the current head; draft updates allocate no
+  validation runner until the pull request is ready.
 - Release Please version pull requests are managed by the Code Foundry release
   workflow; do not manually change their draft state unless the workflow asks.
 
@@ -183,7 +184,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Push to a working branch                           | Draft PR workflow                                                                     |
 | Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |
 
-Draft pull requests do not start validation. The lightweight Draft Guard also converts ordinary pull requests opened, reopened, or updated while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier. Convert it back to draft after an update, then mark it ready again after every update so the required checks attach to the current head. Converting it to draft runs only the lightweight cancellation control.
+Draft pull requests do not start validation. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner. Converting a pull request to draft runs only the lightweight cancellation control.
 
 Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
 

package/.github/workflows/cloudflare-delivery.yml

@@ -0,0 +1,354 @@
+name: Code Foundry Cloudflare Delivery
+
+on:
+  workflow_call:
+    inputs:
+      runtime-ref:
+        description: 'Immutable 40-character Code Foundry commit SHA containing this workflow and its helper.'
+        required: true
+        type: string
+      worker-name:
+        description: 'Exact effective Worker name, including any Wrangler environment suffix.'
+        required: true
+        type: string
+      artifact-path:
+        description: 'Build output subdirectory relative to working-directory; must cover uploaded code/assets.'
+        required: true
+        type: string
+      verify-command:
+        description: 'Required JSON argv array. Receives BASE_URL and FOUNDRY_DEPLOYMENT_PHASE.'
+        required: true
+        type: string
+      mode:
+        required: false
+        type: string
+        default: preview
+      working-directory:
+        required: false
+        type: string
+        default: '.'
+      install-working-directory:
+        required: false
+        type: string
+        default: '.'
+      build-script:
+        required: false
+        type: string
+        default: build
+      bun-version:
+        required: false
+        type: string
+        default: '1.4.0'
+      wrangler-version:
+        description: 'local uses the locked workspace installation; otherwise specify an exact version.'
+        required: false
+        type: string
+        default: local
+      wrangler-environment:
+        required: false
+        type: string
+        default: ''
+      wrangler-config:
+        required: false
+        type: string
+        default: ''
+      production-url:
+        required: false
+        type: string
+        default: ''
+      canary-verify-command:
+        description: 'Required JSON argv when canary-percentage is below 100; must prove the live request served this version.'
+        required: false
+        type: string
+        default: ''
+      smoke-path:
+        required: false
+        type: string
+        default: '/'
+      binding-policy-file:
+        description: 'Optional reviewed binding policy; undeclared stateful bindings fail closed.'
+        required: false
+        type: string
+        default: ''
+      canary-percentage:
+        description: '100 promotes directly; a lower value verifies a canary before final promotion.'
+        required: false
+        type: number
+        default: 100
+      auto-rollback:
+        description: 'Requires explicit rollbackSafe policy and no stateful bindings. Never restores resource data.'
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      CLOUDFLARE_API_TOKEN:
+        required: true
+      CLOUDFLARE_ACCOUNT_ID:
+        required: true
+    outputs:
+      preview-url:
+        value: ${{ jobs.candidate.outputs.url }}
+      version-id:
+        value: ${{ jobs.candidate.outputs.version-id }}
+      source-sha:
+        value: ${{ jobs.candidate.outputs.source-sha }}
+      artifact-digest:
+        value: ${{ jobs.candidate.outputs.artifact-digest }}
+      cloudflare-deployment-id:
+        value: ${{ jobs.promote.outputs.cloudflare-deployment-id }}
+      github-deployment-id:
+        value: ${{ jobs.promote.outputs.github-deployment-id || jobs.candidate.outputs.github-deployment-id }}
+
+permissions:
+  contents: read
+  deployments: write
+
+# All production deliveries for an application serialize; old commits are checked
+# again after environment approval. Never cancel a deployment mid-promotion.
+concurrency:
+  group: code-foundry-cloudflare-${{ github.repository }}-${{ inputs.worker-name }}-${{ inputs.mode }}
+  cancel-in-progress: false
+
+jobs:
+  candidate:
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: Preview
+      url: ${{ steps.upload.outputs.url }}
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      FOUNDRY_MODE: ${{ inputs.mode }}
+      FOUNDRY_WORKER: ${{ inputs.worker-name }}
+      FOUNDRY_PHASE: candidate
+      FOUNDRY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      ARTIFACT_PATH: ${{ inputs.artifact-path }}
+      VERIFY_COMMAND: ${{ inputs.verify-command }}
+      SMOKE_PATH: ${{ inputs.smoke-path }}
+      WRANGLER_VERSION: ${{ inputs.wrangler-version }}
+      WRANGLER_ENVIRONMENT: ${{ inputs.wrangler-environment }}
+      WRANGLER_CONFIG: ${{ inputs.wrangler-config }}
+      BINDING_POLICY_FILE: ${{ inputs.binding-policy-file }}
+      DEPLOYMENT_ENVIRONMENT: Preview
+    outputs:
+      url: ${{ steps.upload.outputs.url }}
+      version-id: ${{ steps.upload.outputs.version-id }}
+      artifact-digest: ${{ steps.upload.outputs.artifact-digest }}
+      source-sha: ${{ steps.upload.outputs.source-sha }}
+      verified: ${{ steps.verify.outputs.verified }}
+      github-deployment-id: ${{ steps.start.outputs.github-deployment-id }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Validate inputs
+        env:
+          RUNTIME_REF: ${{ inputs.runtime-ref }}
+          CANARY_PERCENTAGE: ${{ inputs.canary-percentage }}
+          CANARY_VERIFY_COMMAND: ${{ inputs.canary-verify-command }}
+          PRODUCTION_URL: ${{ inputs.production-url }}
+        run: |
+          set -euo pipefail
+          [[ "$RUNTIME_REF" =~ ^[0-9a-fA-F]{40}$ ]]
+          [[ "$FOUNDRY_MODE" == preview || "$FOUNDRY_MODE" == production ]]
+          node --input-type=module <<'NODE'
+          const percentage = Number(process.env.CANARY_PERCENTAGE)
+          if (!Number.isFinite(percentage) || percentage < 0.01 || percentage > 100 || (percentage < 100 && percentage > 99.99)) process.exit(1)
+          if (process.env.FOUNDRY_MODE === 'production' && percentage < 100) {
+            let argv
+            try { argv = JSON.parse(process.env.CANARY_VERIFY_COMMAND ?? '') } catch { process.exit(1) }
+            if (!Array.isArray(argv) || !argv.length || argv.some((arg) => typeof arg !== 'string' || !arg.length || arg.includes('\0'))) process.exit(1)
+          }
+          NODE
+          if [[ "$FOUNDRY_MODE" == production ]]; then
+            [[ "$GITHUB_REF" == "refs/heads/$FOUNDRY_DEFAULT_BRANCH" ]]
+            [[ "$PRODUCTION_URL" == https://* ]]
+          fi
+      - name: Checkout delivery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: 0xPlayerOne/code-foundry
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry-delivery
+          persist-credentials: false
+          sparse-checkout: src
+      - name: Prepare delivery state
+        run: |
+          echo "FOUNDRY_EXECUTOR=$GITHUB_WORKSPACE/.github/.code-foundry-delivery/src/commands/cloudflare-delivery.mjs" >> "$GITHUB_ENV"
+          echo "FOUNDRY_STATE_FILE=$RUNNER_TEMP/cloudflare-candidate.json" >> "$GITHUB_ENV"
+      - name: Record pending application deployment
+        id: start
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" record-start
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install locked dependencies
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile
+      - name: Build candidate
+        if: inputs.build-script != ''
+        env:
+          BUILD_SCRIPT: ${{ inputs.build-script }}
+        run: bun run "$BUILD_SCRIPT"
+      - name: Reject stale production source
+        if: inputs.mode == 'production'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" assert-current
+      - name: Upload candidate without changing traffic
+        id: upload
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" upload
+      - name: Inspect actual candidate bindings
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" inspect
+      - name: Verify candidate
+        id: verify
+        run: node "$FOUNDRY_EXECUTOR" verify
+      - name: Complete application deployment status
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEPLOYMENT_STATUS: ${{ job.status }}
+        run: node "$FOUNDRY_EXECUTOR" record-finish
+      - name: Preserve candidate evidence
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cloudflare-candidate-${{ inputs.worker-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/cloudflare-candidate.json
+          if-no-files-found: error
+          retention-days: 14
+
+  promote:
+    needs: candidate
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      inputs.mode == 'production' && needs.candidate.outputs.verified == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: Production
+      url: ${{ inputs.production-url }}
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      FOUNDRY_MODE: production
+      FOUNDRY_PHASE: production
+      FOUNDRY_WORKER: ${{ inputs.worker-name }}
+      FOUNDRY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      VERIFY_COMMAND: ${{ inputs.verify-command }}
+      SMOKE_PATH: ${{ inputs.smoke-path }}
+      PRODUCTION_URL: ${{ inputs.production-url }}
+      BINDING_POLICY_FILE: ${{ inputs.binding-policy-file }}
+      DEPLOYMENT_ENVIRONMENT: Production
+      AUTO_ROLLBACK: ${{ inputs.auto-rollback }}
+    outputs:
+      cloudflare-deployment-id: ${{ steps.promote.outputs.cloudflare-deployment-id || steps.canary.outputs.cloudflare-deployment-id }}
+      github-deployment-id: ${{ steps.start.outputs.github-deployment-id }}
+    steps:
+      - name: Checkout verified source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ needs.candidate.outputs.source-sha }}
+          persist-credentials: false
+      - name: Checkout delivery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: 0xPlayerOne/code-foundry
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry-delivery
+          persist-credentials: false
+          sparse-checkout: src
+      - name: Prepare production state
+        run: |
+          echo "FOUNDRY_EXECUTOR=$GITHUB_WORKSPACE/.github/.code-foundry-delivery/src/commands/cloudflare-delivery.mjs" >> "$GITHUB_ENV"
+          echo "FOUNDRY_STATE_FILE=$RUNNER_TEMP/cloudflare-production.json" >> "$GITHUB_ENV"
+      - name: Bind promotion to verified candidate
+        env:
+          CANDIDATE_VERIFIED: ${{ needs.candidate.outputs.verified }}
+          CANDIDATE_SOURCE_SHA: ${{ needs.candidate.outputs.source-sha }}
+          CANDIDATE_VERSION_ID: ${{ needs.candidate.outputs.version-id }}
+          CANDIDATE_URL: ${{ needs.candidate.outputs.url }}
+          CANDIDATE_ARTIFACT_DIGEST: ${{ needs.candidate.outputs.artifact-digest }}
+        run: node "$FOUNDRY_EXECUTOR" init-production
+      - name: Record pending application deployment
+        id: start
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" record-start
+      - name: Set up Bun for verification only
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install verification dependencies without rebuilding
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Reject stale source after approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" assert-current
+      - name: Activate canary
+        id: canary
+        if: inputs.canary-percentage < 100
+        env:
+          DEPLOY_PERCENTAGE: ${{ inputs.canary-percentage }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" activate
+      - name: Verify canary
+        if: inputs.canary-percentage < 100
+        env:
+          FOUNDRY_PHASE: canary
+          VERIFY_COMMAND: ${{ inputs.canary-verify-command }}
+        run: node "$FOUNDRY_EXECUTOR" verify
+      - name: Recheck source before final promotion
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node "$FOUNDRY_EXECUTOR" assert-current
+      - name: Promote the verified version to 100 percent
+        id: promote
+        env:
+          DEPLOY_PERCENTAGE: '100'
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" activate
+      - name: Verify production
+        run: node "$FOUNDRY_EXECUTOR" verify
+      - name: Optional stateless rollback
+        if: >-
+          failure() && inputs.auto-rollback &&
+          (steps.canary.outcome == 'success' || steps.promote.outcome == 'success')
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: node "$FOUNDRY_EXECUTOR" rollback
+      - name: Complete application deployment status
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEPLOYMENT_STATUS: ${{ job.status }}
+        run: node "$FOUNDRY_EXECUTOR" record-finish
+      - name: Preserve promotion and recovery evidence
+        if: always() && steps.start.outputs.github-deployment-id != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cloudflare-production-${{ inputs.worker-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/cloudflare-production.json
+          if-no-files-found: error
+          retention-days: 30

package/.github/workflows/cloudflare-deploy.yml

@@ -4,27 +4,23 @@ on:
   workflow_call:
     inputs:
       mode:
-        description: 'Deploy mode: preview (wrangler versions upload) or production (wrangler deploy).'
+        description: 'Legacy direct deployment. Prefer cloudflare-delivery.yml for verified promotion.'
         required: false
         type: string
         default: preview
       working-directory:
-        description: 'Directory containing the wrangler configuration.'
         required: false
         type: string
         default: '.'
       install-working-directory:
-        description: 'Directory containing bun.lock. Used only when build-script is set.'
         required: false
         type: string
         default: '.'
       build-script:
-        description: 'Optional Bun package script to run before Wrangler deploys.'
         required: false
         type: string
         default: ''
       bun-version:
-        description: 'Bun version used for dependency installation and the optional build.'
         required: false
         type: string
         default: '1.4.0'
@@ -33,11 +29,16 @@ on:
         type: string
         default: ubuntu-latest
       wrangler-version:
+        description: 'local uses installed Wrangler; latest preserves legacy behavior; exact versions are recommended.'
         required: false
         type: string
-        default: 'latest'
+        default: latest
       environment:
-        description: 'GitHub deployment environment. Defaults to Preview/Production based on the mode.'
+        required: false
+        type: string
+        default: ''
+      deployment-url:
+        description: 'Optional HTTPS production URL when Wrangler targets are route patterns.'
         required: false
         type: string
         default: ''
@@ -46,41 +47,81 @@ on:
         required: true
       CLOUDFLARE_ACCOUNT_ID:
         required: true
+    outputs:
+      url:
+        value: ${{ jobs.deploy.outputs.url }}
+      version-id:
+        value: ${{ jobs.deploy.outputs.version-id }}
+      github-deployment-id:
+        value: ${{ jobs.deploy.outputs.github-deployment-id }}
 
 permissions:
   contents: read
   deployments: write
 
+concurrency:
+  group: code-foundry-cloudflare-legacy-${{ github.repository }}-${{ inputs.working-directory }}-${{ inputs.environment || inputs.mode }}
+  cancel-in-progress: false
+
 jobs:
   deploy:
     name: Cloudflare Deploy / ${{ inputs.mode }}
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
+    environment:
+      name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+      url: ${{ steps.deploy.outputs.url }}
+    outputs:
+      url: ${{ steps.deploy.outputs.url }}
+      version-id: ${{ steps.deploy.outputs.version-id }}
+      github-deployment-id: ${{ steps.start.outputs.id }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-
+      - name: Validate deployment inputs
+        env:
+          MODE: ${{ inputs.mode }}
+          WRANGLER_VERSION: ${{ inputs.wrangler-version }}
+        run: |
+          set -euo pipefail
+          [[ "$MODE" == preview || "$MODE" == production ]]
+          [[ "$WRANGLER_VERSION" == local || "$WRANGLER_VERSION" == latest || "$WRANGLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
+      - name: Record pending deployment
+        id: start
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MODE: ${{ inputs.mode }}
+          ENVIRONMENT: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+        run: |
+          set -euo pipefail
+          body=$(jq -n --arg ref "$GITHUB_SHA" --arg environment "$ENVIRONMENT" \
+            --argjson production "$([ "$MODE" = production ] && echo true || echo false)" \
+            '{ref: $ref, environment: $environment, auto_merge: false, production_environment: $production, required_contexts: []}')
+          id=$(gh api "repos/$GITHUB_REPOSITORY/deployments" --input - <<< "$body" --jq .id)
+          [[ "$id" =~ ^[0-9]+$ ]]
+          echo "id=$id" >> "$GITHUB_OUTPUT"
+          gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$id/statuses" -f state=in_progress -F auto_inactive=false --silent
       - name: Set up Bun
         if: inputs.build-script != ''
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: ${{ inputs.bun-version }}
-
       - name: Install dependencies
         if: inputs.build-script != ''
         working-directory: ${{ inputs.install-working-directory }}
         run: bun install --frozen-lockfile
-
       - name: Build Worker
         if: inputs.build-script != ''
         working-directory: ${{ inputs.working-directory }}
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
         run: bun run "$BUILD_SCRIPT"
-
       - name: Deploy to Cloudflare
         id: deploy
         working-directory: ${{ inputs.working-directory }}
@@ -90,52 +131,54 @@ jobs:
           BUILD_SCRIPT: ${{ inputs.build-script }}
           WRANGLER_VERSION: ${{ inputs.wrangler-version }}
           MODE: ${{ inputs.mode }}
+          DEPLOYMENT_URL: ${{ inputs.deployment-url }}
         run: |
           set -euo pipefail
-          # Bun callers install workspace dependencies with Bun. Keep that
-          # package-manager context for Wrangler's OpenNext auto-delegation;
-          # Wrangler otherwise selects npm/npx and cannot resolve the local
-          # opennextjs-cloudflare binary from a Bun workspace.
-          if [ -n "$BUILD_SCRIPT" ]; then
+          if [ "$WRANGLER_VERSION" = local ]; then
+            if [ -n "$BUILD_SCRIPT" ]; then
+              wrangler=(bunx --bun --no-install wrangler)
+            else
+              wrangler=(npx --no-install wrangler)
+            fi
+          elif [ -n "$BUILD_SCRIPT" ]; then
             wrangler=(bunx --bun "wrangler@$WRANGLER_VERSION")
           else
             wrangler=(npx -y "wrangler@$WRANGLER_VERSION")
           fi
+          export WRANGLER_OUTPUT_FILE_PATH="$RUNNER_TEMP/cloudflare-legacy.ndjson"
+          : > "$WRANGLER_OUTPUT_FILE_PATH"
           "${wrangler[@]}" --version
-          if [ "$MODE" = "production" ]; then
-            "${wrangler[@]}" deploy 2>&1 | tee deploy-output.txt
-          elif [ "$MODE" = "preview" ]; then
-            "${wrangler[@]}" versions upload --message "preview ${GITHUB_SHA::7}" 2>&1 | tee deploy-output.txt
+          if [ "$MODE" = production ]; then
+            "${wrangler[@]}" deploy
           else
-            echo "Unsupported mode: $MODE (use preview or production)" >&2
-            exit 1
+            "${wrangler[@]}" versions upload --message "preview ${GITHUB_SHA::7}"
           fi
-          # Prefer version preview URLs; fall back to the first workers.dev URL.
-          url=$(grep -Eo 'https://[a-zA-Z0-9][a-zA-Z0-9.-]*\.workers\.dev' deploy-output.txt | tail -1 || true)
-          echo "url=$url" >> "$GITHUB_OUTPUT"
-
-      - name: Record GitHub deployment
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs'
+          const records = readFileSync(process.env.WRANGLER_OUTPUT_FILE_PATH, 'utf8').split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line))
+          if (records.some(record => record.type === 'command-failed')) throw new Error('Wrangler command failed')
+          const type = process.env.MODE === 'production' ? 'deploy' : 'version-upload'
+          const matches = records.filter(record => record.type === type)
+          if (matches.length !== 1 || matches[0].version !== 1) throw new Error('Expected one supported structured deployment record')
+          const record = matches[0]
+          if (!/^[0-9a-f-]{36}$/i.test(record.version_id ?? '')) throw new Error('Missing Worker version ID')
+          const value = process.env.MODE === 'preview' ? record.preview_url : (process.env.DEPLOYMENT_URL || record.targets?.find(target => target.startsWith('https://')))
+          if (!value) throw new Error('Missing deployment URL; enable previews or configure deployment-url')
+          const url = new URL(value)
+          if (url.protocol !== 'https:' || url.username || url.password || url.hash) throw new Error('Invalid deployment URL')
+          appendFileSync(process.env.GITHUB_OUTPUT, `url=${url.href}\nversion-id=${record.version_id}\n`)
+          NODE
+      - name: Complete deployment status
+        if: always() && steps.start.outputs.id != ''
         env:
           GH_TOKEN: ${{ github.token }}
-          MODE: ${{ inputs.mode }}
-          ENVIRONMENT_OVERRIDE: ${{ inputs.environment }}
+          DEPLOYMENT_ID: ${{ steps.start.outputs.id }}
           DEPLOY_URL: ${{ steps.deploy.outputs.url }}
+          JOB_STATUS: ${{ job.status }}
         run: |
           set -euo pipefail
-          if [ "$MODE" != "production" ] && [ "$MODE" != "preview" ]; then
-            echo "Unsupported mode: $MODE" >&2
-            exit 1
-          fi
-          environment="${ENVIRONMENT_OVERRIDE:-$([ "$MODE" = "production" ] && echo Production || echo Preview)}"
-          body=$(jq -n \
-            --arg ref "$GITHUB_SHA" \
-            --arg environment "$environment" \
-            --argjson production "$([ "$MODE" = "production" ] && echo true || echo false)" \
-            '{ref: $ref, environment: $environment, auto_merge: false, production_environment: $production, required_contexts: []}')
-          deployment=$(gh api "repos/$GITHUB_REPOSITORY/deployments" --input - <<< "$body" --jq .id)
-          status_args=(-f state=success -f description="Cloudflare $MODE deploy (${GITHUB_SHA::7})")
-          if [ -n "$DEPLOY_URL" ]; then
-            status_args+=(-f environment_url="$DEPLOY_URL" -f log_url="$DEPLOY_URL")
-          fi
-          gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$deployment/statuses" "${status_args[@]}" --jq .state
-          echo "Recorded $environment deployment for ${GITHUB_SHA::7}"
+          state=failure
+          if [ "$JOB_STATUS" = success ]; then state=success; fi
+          args=(-f "state=$state" -F auto_inactive=false)
+          if [ -n "$DEPLOY_URL" ]; then args+=(-f "environment_url=$DEPLOY_URL"); fi
+          gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$DEPLOYMENT_ID/statuses" "${args[@]}" --silent

package/.github/workflows/draft-enforcement_self-ci.yml

@@ -8,7 +8,6 @@ on:
     types:
       - opened
       - reopened
-      - synchronize
 
 permissions:
   pull-requests: write
@@ -55,8 +54,8 @@ jobs:
               ;;
           esac
 
-          # A newer state transition or commit superseded this event. Do not
-          # undo a user's later explicit readiness decision with a stale event.
+          # A newer state transition superseded this event. Do not undo a
+          # user's later explicit readiness decision with a stale event.
           if [ "$head_sha" != "$EVENT_HEAD_SHA" ] || [ "$updated_at" != "$EVENT_UPDATED_AT" ]; then
             echo 'A newer pull-request state or head commit superseded this draft-guard event; leaving the current state unchanged.'
             exit 0
@@ -76,4 +75,4 @@ jobs:
             "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \
             -F draft=true \
             --silent >/dev/null
-          echo "Converted ordinary pull request #$PR_NUMBER to draft; runner-heavy validation waits for ready_for_review."
+          echo "Converted ordinary pull request #$PR_NUMBER to draft; validation waits for ready_for_review."

package/.github/workflows/opencode-security_self-ci.yml

@@ -5,6 +5,7 @@ on:
     branches: [main, staging]
     types:
       - ready_for_review
+      - synchronize
   workflow_dispatch:
 
 permissions:
@@ -13,7 +14,7 @@ permissions:
 jobs:
   detect:
     name: OpenCode Security / Detect
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false)
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}