code-foundry 1.20.2 → 1.22.1

package/.github/CONTRIBUTING.md

@@ -44,7 +44,10 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 - Keep ordinary pull requests in draft while preparing them. The generated
   Draft Guard converts ready ordinary pull requests to draft when they are
   opened or reopened, and runner-heavy validation starts only after an
-  explicit `ready_for_review` transition.
+  explicit `ready_for_review` transition unless `draft_protection: false` is
+  configured for generated callers. That opt-out does not disable Draft Guard
+  or draft-PR automation. Cloudflare reusable callers use
+  `draft-protection: false`.
 - Run local validation and finish review preparation before marking an ordinary
   pull request ready. Ready pull requests stay ready when new commits arrive,
   and validation reruns for the current head; draft updates allocate no
@@ -184,7 +187,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Push to a working branch                           | Draft PR workflow                                                                     |
 | Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |
 
-Draft pull requests do not start validation. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner. Converting a pull request to draft runs only the lightweight cancellation control.
+Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 
 Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
 

package/.github/code-foundry.yml

@@ -3,6 +3,7 @@ version: 1
 profile: auto
 languages: typescript
 features: all
+draft_protection: true
 codeql: auto
 codeql_rust_shards: '["all"]'
 codeql_rust_threads: 1

package/.github/release-please-foundry.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bump-minor-pre-major": true,
+  "pull-request-title-pattern": "chore(main): release ${version}",
+  "group-pull-request-title-pattern": "chore(main): release ${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features"
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes"
+    },
+    {
+      "type": "perf",
+      "section": "Performance"
+    },
+    {
+      "type": "revert",
+      "section": "Reverts"
+    },
+    {
+      "type": "deps",
+      "section": "Dependencies"
+    },
+    {
+      "type": "docs",
+      "section": "Documentation"
+    },
+    {
+      "type": "test",
+      "section": "Tests"
+    },
+    {
+      "type": "ci",
+      "section": "CI"
+    },
+    {
+      "type": "refactor",
+      "section": "Maintenance"
+    },
+    {
+      "type": "chore",
+      "section": "Maintenance"
+    }
+  ],
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "include-component-in-tag": false,
+      "draft": true,
+      "force-tag-creation": true
+    }
+  }
+}

package/.github/workflows/cloudflare-delivery.yml

@@ -23,6 +23,11 @@ on:
         required: false
         type: string
         default: preview
+      draft-protection:
+        description: 'Skip draft pull requests by default; set false to run candidate gates for drafts.'
+        required: false
+        type: boolean
+        default: true
       working-directory:
         required: false
         type: string
@@ -113,6 +118,7 @@ jobs:
   candidate:
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
@@ -187,6 +193,7 @@ jobs:
         id: start
         env:
           GH_TOKEN: ${{ github.token }}
+          GITHUB_DEPLOYMENT_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: node "$FOUNDRY_EXECUTOR" record-start
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -238,6 +245,7 @@ jobs:
     needs: candidate
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       inputs.mode == 'production' && needs.candidate.outputs.verified == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -291,6 +299,7 @@ jobs:
         id: start
         env:
           GH_TOKEN: ${{ github.token }}
+          GITHUB_DEPLOYMENT_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: node "$FOUNDRY_EXECUTOR" record-start
       - name: Set up Bun for verification only
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

package/.github/workflows/cloudflare-deploy.yml

@@ -8,6 +8,11 @@ on:
         required: false
         type: string
         default: preview
+      draft-protection:
+        description: 'Skip draft pull requests by default; set false to run deployments for drafts.'
+        required: false
+        type: boolean
+        default: true
       working-directory:
         required: false
         type: string
@@ -68,6 +73,7 @@ jobs:
     name: Cloudflare Deploy / ${{ inputs.mode }}
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ${{ inputs.runner }}
@@ -98,9 +104,10 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           MODE: ${{ inputs.mode }}
           ENVIRONMENT: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+          GITHUB_DEPLOYMENT_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           set -euo pipefail
-          body=$(jq -n --arg ref "$GITHUB_SHA" --arg environment "$ENVIRONMENT" \
+          body=$(jq -n --arg ref "$GITHUB_DEPLOYMENT_REF" --arg environment "$ENVIRONMENT" \
             --argjson production "$([ "$MODE" = production ] && echo true || echo false)" \
             '{ref: $ref, environment: $environment, auto_merge: false, production_environment: $production, required_contexts: []}')
           id=$(gh api "repos/$GITHUB_REPOSITORY/deployments" --input - <<< "$body" --jq .id)

package/.github/workflows/opencode-security_self-ci.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   detect:
     name: OpenCode Security / Detect
-    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false)
+    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}

package/.github/workflows/qualified-foundry-publish.yml

@@ -11,11 +11,11 @@ on:
         description: Exact pre-attached Code Foundry npm tarball name.
         required: true
         type: string
-      environment:
-        description: Protected GitHub environment for npm publication.
+      billing-pause-bypass:
+        description: Allow only an explicitly dispatched release while shared CI remains paused.
         required: false
-        default: npm
-        type: string
+        type: boolean
+        default: false
     secrets:
       NPM_TOKEN:
         required: false
@@ -27,7 +27,7 @@ permissions:
 jobs:
   qualify:
     name: Qualify Node ${{ matrix.node }}
-    if: vars.CI_BILLING_PAUSED != 'true' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['billing-pause-bypass'] == true)) && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     strategy:
@@ -76,10 +76,9 @@ jobs:
   publish:
     name: Publish qualified archive
     needs: qualify
-    if: vars.CI_BILLING_PAUSED != 'true' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['billing-pause-bypass'] == true)) && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-24.04
     timeout-minutes: 15
-    environment: ${{ inputs.environment }}
     concurrency:
       group: qualified-foundry-npm-${{ github.repository }}-${{ inputs.tag }}
       cancel-in-progress: false

package/.github/workflows/release.yml

@@ -23,6 +23,29 @@ on:
         required: false
         type: boolean
         default: false
+      config-file:
+        description: Repository-relative Release Please configuration file.
+        required: false
+        type: string
+        default: release-please-config.json
+      defer-publication:
+        description: Create a root draft release for an external qualified publisher; skip legacy publication and post-release jobs.
+        required: false
+        type: boolean
+        default: false
+    outputs:
+      release_created:
+        description: Whether Release Please created a release (possibly a draft).
+        value: ${{ jobs.release.outputs.release_created }}
+      tag_name:
+        description: Exact tag returned by Release Please.
+        value: ${{ jobs.release.outputs.tag_name }}
+      sha:
+        description: Exact source commit returned by Release Please.
+        value: ${{ jobs.release.outputs.sha }}
+      token_source:
+        description: Credential selected for release operations.
+        value: ${{ jobs.release.outputs.token_source }}
     secrets:
       CODE_FOUNDRY_TOKEN:
         required: false
@@ -57,6 +80,7 @@ jobs:
     outputs:
       release_created: ${{ steps.release.outputs.release_created || 'false' }}
       tag_name: ${{ steps.release.outputs.tag_name }}
+      sha: ${{ steps.release.outputs.sha }}
       npm_publish: ${{ steps.profile.outputs.npm_publish }}
       token_source: ${{ steps.credentials.outputs.token_source }}
     steps:
@@ -77,6 +101,9 @@ jobs:
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
       - name: Detect release profile
         id: profile
+        env:
+          RELEASE_CONFIG_FILE: ${{ inputs.config-file }}
+          DEFER_PUBLICATION: ${{ inputs.defer-publication }}
         run: |
           node <<'NODE'
           const fs = require('node:fs')
@@ -108,9 +135,25 @@ jobs:
           if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
           let legacyReleaseType = ''
           if (releaseType !== 'none') {
-            const sourcePath = 'release-please-config.json'
+            const sourcePath = process.env.RELEASE_CONFIG_FILE || 'release-please-config.json'
+            if (!/^(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+\.json$/.test(sourcePath) || sourcePath.split('/').includes('..')) {
+              throw new Error('config-file must be a repository-relative JSON path')
+            }
             if (!fs.existsSync(sourcePath)) throw new Error(`Missing ${sourcePath}`)
+            const path = require('node:path')
+            const relative = path.relative(fs.realpathSync('.'), fs.realpathSync(sourcePath))
+            if (relative === '..' || relative.startsWith(`..${path.sep}`) || !fs.statSync(sourcePath).isFile()) {
+              throw new Error('config-file must be a file inside the repository')
+            }
             const releaseConfig = JSON.parse(fs.readFileSync(sourcePath, 'utf8'))
+            if (process.env.DEFER_PUBLICATION === 'true') {
+              const rootPackage = releaseConfig.packages?.['.']
+              if (!rootPackage || Object.keys(releaseConfig.packages).length !== 1 ||
+                  (rootPackage.draft ?? releaseConfig.draft) !== true ||
+                  (rootPackage['force-tag-creation'] ?? releaseConfig['force-tag-creation']) !== true) {
+                throw new Error('defer-publication requires one root package with draft and force-tag-creation enabled')
+              }
+            }
             if (!releaseConfig.packages && !releaseConfig['release-type']) {
               legacyReleaseType = releaseType
             } else if (!fs.existsSync('.release-please-manifest.json')) {
@@ -152,7 +195,7 @@ jobs:
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         with:
           token: ${{ secrets.CODE_FOUNDRY_TOKEN }}
-          config-file: release-please-config.json
+          config-file: ${{ inputs.config-file }}
           release-type: ${{ steps.profile.outputs.legacy_release_type }}
       - name: Release Please (workflow token)
         id: release_workflow
@@ -160,7 +203,7 @@ jobs:
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         with:
           token: ${{ github.token }}
-          config-file: release-please-config.json
+          config-file: ${{ inputs.config-file }}
           release-type: ${{ steps.profile.outputs.legacy_release_type }}
       - name: Normalize Release Please outputs
         id: release
@@ -168,9 +211,11 @@ jobs:
         env:
           AUTOMATION_RELEASE_CREATED: ${{ steps.release_automation.outputs.release_created }}
           AUTOMATION_TAG_NAME: ${{ steps.release_automation.outputs.tag_name }}
+          AUTOMATION_SHA: ${{ steps.release_automation.outputs.sha }}
           AUTOMATION_PRS_CREATED: ${{ steps.release_automation.outputs.prs_created }}
           WORKFLOW_RELEASE_CREATED: ${{ steps.release_workflow.outputs.release_created }}
           WORKFLOW_TAG_NAME: ${{ steps.release_workflow.outputs.tag_name }}
+          WORKFLOW_SHA: ${{ steps.release_workflow.outputs.sha }}
           WORKFLOW_PRS_CREATED: ${{ steps.release_workflow.outputs.prs_created }}
         run: |
           set -euo pipefail
@@ -182,12 +227,14 @@ jobs:
             {
               echo "release_created=$AUTOMATION_RELEASE_CREATED"
               echo "tag_name=$AUTOMATION_TAG_NAME"
+              echo "sha=$AUTOMATION_SHA"
               echo "prs_created=$AUTOMATION_PRS_CREATED"
             } >> "$GITHUB_OUTPUT"
           else
             {
               echo "release_created=$WORKFLOW_RELEASE_CREATED"
               echo "tag_name=$WORKFLOW_TAG_NAME"
+              echo "sha=$WORKFLOW_SHA"
               echo "prs_created=$WORKFLOW_PRS_CREATED"
             } >> "$GITHUB_OUTPUT"
           fi
@@ -325,7 +372,7 @@ jobs:
     # creating a release. Reconciliation is only meaningful after a release
     # commit/tag is actually created; otherwise the promotion's source changes
     # are incorrectly rejected as non-metadata commits.
-    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
+    if: inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:
@@ -413,7 +460,7 @@ jobs:
   post-release:
     name: Post Hook
     needs: release
-    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true'
+    if: inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     concurrency:
@@ -423,9 +470,6 @@ jobs:
       actions: write
       contents: read
     env:
-      # The release job validates the configured automation token and exposes
-      # the selection; the post hook reuses the same selected credential so a
-      # rejected long-lived token is never used after fallback.
       CODE_FOUNDRY_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
       GH_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
     steps:
@@ -464,7 +508,11 @@ jobs:
           NODE
       - name: Dispatch post-release hook once
         if: steps.hook.outputs.enabled == 'true' && steps.hook.outputs.workflow != ''
-        run: node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release hook --tag '${{ needs.release.outputs.tag_name }}' --workflow '${{ steps.hook.outputs.workflow }}' --mode '${{ steps.hook.outputs.mode }}'
+        env:
+          RELEASE_TAG: ${{ needs.release.outputs.tag_name }}
+          POST_RELEASE_WORKFLOW: ${{ steps.hook.outputs.workflow }}
+          POST_RELEASE_MODE: ${{ steps.hook.outputs.mode }}
+        run: node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release hook --tag "$RELEASE_TAG" --workflow "$POST_RELEASE_WORKFLOW" --mode "$POST_RELEASE_MODE"
       - name: Explain disabled post-release hook
         if: steps.hook.outputs.enabled != 'true' || steps.hook.outputs.workflow == ''
         run: echo 'No post-release workflow configured; artifact delivery is intentionally skipped.'
@@ -472,7 +520,7 @@ jobs:
   npm:
     name: Publish npm
     needs: release
-    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
+    if: inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:

package/.github/workflows/release_self-ci.yml

@@ -12,32 +12,235 @@ on:
         default: false
 
 permissions:
-  actions: write
-  contents: write
-  issues: write
-  pull-requests: write
-  id-token: write
+  contents: read
+
+# One owner for draft staging and npm publication. Never cancel an active release.
+concurrency:
+  group: code-foundry-qualified-release-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   qualification:
     name: Qualify consumers
-    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/consumer-qualification.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
     permissions:
       actions: read
       contents: read
+
+  preflight:
+    name: Verify release prerequisites
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout trusted verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Require activation and verify immutability without changing it
+        env:
+          REQUIRE_IMMUTABLE_RELEASES: ${{ vars.REQUIRE_IMMUTABLE_RELEASES }}
+          CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$REQUIRE_IMMUTABLE_RELEASES" = true || { echo 'Enable and review immutable release prerequisites before this cutover.' >&2; exit 1; }
+          gh release verify --help >/dev/null
+          gh release verify-asset --help >/dev/null
+          # Match the reusable producer's credential selection. A rejected
+          # configured token must not make the later staging job use it.
+          if [ -n "$CODE_FOUNDRY_TOKEN" ] && GH_TOKEN="$CODE_FOUNDRY_TOKEN" gh api "repos/${GITHUB_REPOSITORY}" --jq '.full_name' >/dev/null 2>&1; then
+            GH_TOKEN="$CODE_FOUNDRY_TOKEN" node src/commands/release-integrity.mjs settings --repo "$GITHUB_REPOSITORY"
+          else
+            node src/commands/release-integrity.mjs settings --repo "$GITHUB_REPOSITORY"
+          fi
+
   release:
     name: Release
-    needs: qualification
-    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)
+    needs: [qualification, preflight]
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/release.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
       runner: ubuntu-slim
       runtime-repository: 0xPlayerOne/code-foundry
       runtime-ref: ${{ github.sha }}
+      config-file: .github/release-please-foundry.json
+      defer-publication: true
+    permissions:
+      actions: write
+      contents: write
+      issues: write
+      pull-requests: write
+      # Required by the reusable legacy workflow's declared npm job, which is disabled here.
+      id-token: write
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+
+  recovery:
+    name: Recover qualified draft identity
+    needs: [qualification, release]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.qualification.result == 'success' && needs.release.result == 'success'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      found: ${{ steps.recover.outputs.found }}
+      tag: ${{ steps.recover.outputs.tag }}
+      sha: ${{ steps.recover.outputs.sha }}
+    env:
+      RELEASE_CREATED: ${{ needs.release.outputs.release_created }}
+      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+    steps:
+      - name: Checkout trusted recovery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Locate an exact existing draft
+        id: recover
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from "node:fs"
+          import { resolveTagCommit, runGh } from "./src/commands/release-integrity.mjs"
+          const output = process.env.GITHUB_OUTPUT
+          const write = (found, tag = "", sha = "") => appendFileSync(output, `found=${found}\ntag=${tag}\nsha=${sha}\n`)
+          if (process.env.RELEASE_CREATED === "true") {
+            write("false")
+            process.exit(0)
+          }
+          const version = JSON.parse(readFileSync("package.json", "utf8")).version
+          const tag = `v${version}`
+          // GitHub's get-by-tag endpoint does not return draft releases. Use
+          // the authenticated release list and inspect every page instead.
+          const endpoint = `repos/${process.env.GITHUB_REPOSITORY}/releases?per_page=100`
+          const response = runGh(["api", "--paginate", "--slurp", endpoint])
+          if (response.status !== 0) throw new Error("Could not inspect the expected draft release; recovery remains blocked")
+          let pages
+          try {
+            pages = JSON.parse(response.stdout)
+          } catch {
+            throw new Error("GitHub returned an invalid release response; recovery remains blocked")
+          }
+          if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page))) {
+            throw new Error("GitHub returned an invalid release list; recovery remains blocked")
+          }
+          const release = pages.flat().find((entry) => entry?.tag_name === tag)
+          if (!release || release.draft !== true) {
+            write("false")
+            process.exit(0)
+          }
+          if (release.tag_name !== tag) throw new Error("Existing draft tag does not match the expected package version")
+          const sourceSha = resolveTagCommit(process.env.GITHUB_REPOSITORY, tag, runGh)
+          if (sourceSha.toLowerCase() !== process.env.SOURCE_SHA.toLowerCase()) throw new Error("Existing draft tag does not match the qualified source SHA")
+          write("true", tag, sourceSha)
+          NODE
+
+  stage:
+    name: Stage qualified release
+    needs: [qualification, release, recovery]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      attestations: read
+      contents: write
+    env:
+      RELEASE_TAG: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
+      RELEASE_SHA: ${{ needs.release.outputs.sha || needs.recovery.outputs.sha }}
+      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+      PACKAGE: ${{ needs.qualification.outputs.filename }}
+      CANDIDATE_SHA256: ${{ needs.qualification.outputs.sha256 }}
+      CANDIDATE_ARTIFACT: ${{ needs.qualification.outputs.candidate-artifact }}
+    steps:
+      - name: Checkout trusted staging runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Require the release to identify this qualified candidate
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict'
+          import { readFileSync } from 'node:fs'
+          const env = process.env
+          const version = JSON.parse(readFileSync('package.json', 'utf8')).version
+          assert.match(env.SOURCE_SHA, /^[a-f0-9]{40}$/)
+          assert.equal(env.SOURCE_SHA, env.GITHUB_SHA)
+          assert.equal(env.RELEASE_SHA, env.SOURCE_SHA)
+          assert.equal(env.RELEASE_TAG, `v${version}`)
+          assert.equal(env.PACKAGE, `code-foundry-${version}.tgz`)
+          assert.match(env.CANDIDATE_SHA256, /^[a-f0-9]{64}$/)
+          assert.equal(env.CANDIDATE_ARTIFACT, `qualification-candidate-${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`)
+          NODE
+      - name: Retrieve only this attempt's qualified bytes and reports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+            --name "$CANDIDATE_ARTIFACT" --dir "$RUNNER_TEMP/candidate"
+          test "$(sha256sum "$RUNNER_TEMP/candidate/$PACKAGE" | cut -d' ' -f1)" = "$CANDIDATE_SHA256"
+          for node in 20 22 24; do
+            gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+              --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
+              --dir "$RUNNER_TEMP/reports/$node"
+          done
+      - name: Stage identical assets then publish and verify the immutable release
+        env:
+          GH_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && secrets.CODE_FOUNDRY_TOKEN || github.token }}
+        run: |
+          set -euo pipefail
+          node src/commands/qualified-publication.mjs stage \
+            "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$SOURCE_SHA" "$PACKAGE" \
+            "$RUNNER_TEMP/candidate" \
+            "$RUNNER_TEMP/reports/20/report.json" \
+            "$RUNNER_TEMP/reports/22/report.json" \
+            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/staging.json"
+      - name: Retain staging identity
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: release-staging-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/staging.json
+          if-no-files-found: warn
+          retention-days: 14
+
+  publish:
+    name: Publish verified package
+    needs: [qualification, release, recovery, stage]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && needs.stage.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    uses: ./.github/workflows/qualified-foundry-publish.yml
+    permissions:
+      actions: read
+      attestations: read
+      contents: read
+      id-token: write
+    with:
+      tag: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
+      asset: ${{ needs.qualification.outputs.filename }}
+      billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
+    secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.gitignore

@@ -46,7 +46,7 @@ cache/
 !.github/actions/cache/action.yml
 typechain/
 coverage.json
-performance-results/
+.code-foundry/
 tests/.bin/
 **/.app/
 

package/AGENTS.md

@@ -106,7 +106,10 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 - Keep ordinary pull requests in draft while preparing them. The generated
   Draft Guard converts ready ordinary pull requests to draft when they are
   opened or reopened, and runner-heavy validation starts only after an
-  explicit `ready_for_review` transition.
+  explicit `ready_for_review` transition unless `draft_protection: false` is
+  configured for generated callers. That opt-out does not disable Draft Guard
+  or draft-PR automation. Cloudflare reusable callers use
+  `draft-protection: false`.
 - Run local validation and finish review preparation before marking an ordinary
   pull request ready. Ready pull requests stay ready when new commits arrive,
   and validation reruns for the current head; draft updates allocate no