code-foundry 1.20.1 → 1.20.2

package/.github/workflows/ci.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: string
         default: ubuntu-latest
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,8 +91,22 @@ jobs:
           cache-build: 'false'
           task: format
       - name: Format
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci format
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/format.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-format
+          path: .code-foundry/results/format.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   lint:
     name: Lint
@@ -126,8 +145,22 @@ jobs:
           cache-lint: 'true'
           task: lint
       - name: Lint
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci lint
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/lint.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-lint
+          path: .code-foundry/results/lint.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   type-check:
     name: Type-Check
@@ -166,8 +199,22 @@ jobs:
           cache-build: 'true'
           task: type_check
       - name: Type-Check
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/type_check.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-type_check
+          path: .code-foundry/results/type_check.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   build:
     name: Build
@@ -211,5 +258,19 @@ jobs:
           cache-build: 'true'
           task: build
       - name: Build
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/build.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-build
+          path: .code-foundry/results/build.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

package/.github/workflows/test.yml

@@ -33,6 +33,11 @@ on:
         required: false
         type: boolean
         default: false
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -104,8 +109,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci unit
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/unit.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-unit
+          path: .code-foundry/results/unit.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
       - name: Upload coverage
         if: >-
           always() &&
@@ -171,8 +190,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Performance
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci performance
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/performance.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-performance
+          path: .code-foundry/results/performance.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
       - name: Upload performance results
         if: >-
           always() &&
@@ -236,8 +269,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/integration.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-integration
+          path: .code-foundry/results/integration.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   e2e:
     name: E2E
@@ -298,8 +345,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci e2e
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/e2e.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-e2e
+          path: .code-foundry/results/e2e.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   smoke:
     name: Smoke
@@ -348,5 +409,19 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci smoke
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/smoke.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-smoke
+          path: .code-foundry/results/smoke.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

package/.github/workflows/validation-no-codeql.yml

@@ -62,6 +62,11 @@ on:
         required: false
         type: number
         default: 1
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,6 +91,7 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -101,6 +107,7 @@ jobs:
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
       unit-only: ${{ inputs.mode == 'fast' }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 

package/.github/workflows/validation.yml

@@ -62,6 +62,11 @@ on:
         required: false
         type: number
         default: 1
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,6 +91,7 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -101,6 +107,7 @@ jobs:
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
       unit-only: ${{ inputs.mode == 'fast' }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.20.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.1...v1.20.2) (2026-09-09)
+
+
+### Bug Fixes
+
+* **ci:** retain scoped task receipts across success and failure ([#557](https://github.com/0xPlayerOne/code-foundry/issues/557)) ([ee0fe45](https://github.com/0xPlayerOne/code-foundry/commit/ee0fe45e821621e3193831d70a533077b7bcf8a9))
+
 ## [1.20.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.0...v1.20.1) (2026-09-09)
 
 

package/docs/required-capabilities.md

@@ -60,9 +60,29 @@ appear in the GitHub job summary when `GITHUB_STEP_SUMMARY` is available.
 The recorded command is the delegated executor invocation, not a transcript of
 all nested package scripts. No environment variables or captured command output
 are copied into the report. Repository scripts remain responsible for sanitizing
-their own logs. Upload `.code-foundry/results/*.json` with `if: always()` and
-`include-hidden-files: true` to retain downloadable reports; only upload this
-specific directory, not arbitrary hidden files or the entire checkout.
+their own logs and command arguments. Receipts are diagnostics, not signatures,
+attestations, or authorization to publish or merge.
+
+The shared CI and Test workflows retain each executed task's receipt, including
+failure, and discovery receipts for explicitly skipped optional tasks. Each upload
+selects exactly `.code-foundry/results/<task>.json`, not the broader hidden
+directory. The artifact name is `task-result-RUN_ID-ATTEMPT-TASK` and retention is
+14 days. The optional `artifact-prefix` input is exposed by CI, Test, and both
+validation orchestrators; it disambiguates multiple invocations in the same run
+when forwarded to the leaf workflows. Use a different prefix for each such
+invocation. Existing coverage/performance artifact uploads are unchanged.
+
+Missing receipts from an older runtime, a discovery/setup failure, or termination
+before the runtime writes its report do not create an artifact. Missing evidence
+is not success: inspect the task's actual outcome and the validation gate. Uploads
+run after success or failure and do not suppress a failing task exit. When an
+existing receipt disappears during upload, the upload itself fails. A job skipped
+by the workflow's tier or billing policy cannot create a receipt.
+
+These files describe repository-controlled execution and can include paths and
+script-derived reasons. Do not put credentials in command arguments. Artifact
+access follows repository/Actions visibility; receipt retention does not provide
+a sandbox or independently validate repository-authored evidence.
 
 `node src/runtime.mjs ci plan` prints a JSON discovery plan without executing
 checks. Discovery validates every required task before reusable workflows select

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.20.1",
+  "version": "1.20.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {