code-foundry 1.20.2 → 1.25.3

package/.github/CONTRIBUTING.md

@@ -44,7 +44,10 @@ This repository uses the `direct` workflow. Topic pull requests target `main`.
 - Keep ordinary pull requests in draft while preparing them. The generated
   Draft Guard converts ready ordinary pull requests to draft when they are
   opened or reopened, and runner-heavy validation starts only after an
-  explicit `ready_for_review` transition.
+  explicit `ready_for_review` transition unless `draft_protection: false` is
+  configured for generated callers. That opt-out does not disable Draft Guard
+  or draft-PR automation. Cloudflare reusable callers use
+  `draft-protection: false`.
 - Run local validation and finish review preparation before marking an ordinary
   pull request ready. Ready pull requests stay ready when new commits arrive,
   and validation reruns for the current head; draft updates allocate no
@@ -184,7 +187,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Push to a working branch                           | Draft PR workflow                                                                     |
 | Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |
 
-Draft pull requests do not start validation. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner. Converting a pull request to draft runs only the lightweight cancellation control.
+Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 
 Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
 

package/.github/code-foundry.yml

@@ -3,6 +3,7 @@ version: 1
 profile: auto
 languages: typescript
 features: all
+draft_protection: true
 codeql: auto
 codeql_rust_shards: '["all"]'
 codeql_rust_threads: 1

package/.github/release-please-foundry.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bump-minor-pre-major": true,
+  "pull-request-title-pattern": "chore(main): release ${version}",
+  "group-pull-request-title-pattern": "chore(main): release ${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features"
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes"
+    },
+    {
+      "type": "perf",
+      "section": "Performance"
+    },
+    {
+      "type": "revert",
+      "section": "Reverts"
+    },
+    {
+      "type": "deps",
+      "section": "Dependencies"
+    },
+    {
+      "type": "docs",
+      "section": "Documentation"
+    },
+    {
+      "type": "test",
+      "section": "Tests"
+    },
+    {
+      "type": "ci",
+      "section": "CI"
+    },
+    {
+      "type": "refactor",
+      "section": "Maintenance"
+    },
+    {
+      "type": "chore",
+      "section": "Maintenance"
+    }
+  ],
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "include-component-in-tag": false,
+      "draft": true,
+      "force-tag-creation": true
+    }
+  }
+}

package/.github/workflows/cloudflare-delivery.yml

@@ -23,6 +23,11 @@ on:
         required: false
         type: string
         default: preview
+      draft-protection:
+        description: 'Skip draft pull requests by default; set false to run candidate gates for drafts.'
+        required: false
+        type: boolean
+        default: true
       working-directory:
         required: false
         type: string
@@ -113,6 +118,7 @@ jobs:
   candidate:
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
@@ -187,6 +193,7 @@ jobs:
         id: start
         env:
           GH_TOKEN: ${{ github.token }}
+          GITHUB_DEPLOYMENT_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: node "$FOUNDRY_EXECUTOR" record-start
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -238,6 +245,7 @@ jobs:
     needs: candidate
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       inputs.mode == 'production' && needs.candidate.outputs.verified == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -291,6 +299,7 @@ jobs:
         id: start
         env:
           GH_TOKEN: ${{ github.token }}
+          GITHUB_DEPLOYMENT_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: node "$FOUNDRY_EXECUTOR" record-start
       - name: Set up Bun for verification only
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

package/.github/workflows/cloudflare-deploy.yml

@@ -8,6 +8,11 @@ on:
         required: false
         type: string
         default: preview
+      draft-protection:
+        description: 'Skip draft pull requests by default; set false to run deployments for drafts.'
+        required: false
+        type: boolean
+        default: true
       working-directory:
         required: false
         type: string
@@ -68,6 +73,7 @@ jobs:
     name: Cloudflare Deploy / ${{ inputs.mode }}
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ${{ inputs.runner }}
@@ -98,9 +104,10 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           MODE: ${{ inputs.mode }}
           ENVIRONMENT: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+          GITHUB_DEPLOYMENT_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           set -euo pipefail
-          body=$(jq -n --arg ref "$GITHUB_SHA" --arg environment "$ENVIRONMENT" \
+          body=$(jq -n --arg ref "$GITHUB_DEPLOYMENT_REF" --arg environment "$ENVIRONMENT" \
             --argjson production "$([ "$MODE" = production ] && echo true || echo false)" \
             '{ref: $ref, environment: $environment, auto_merge: false, production_environment: $production, required_contexts: []}')
           id=$(gh api "repos/$GITHUB_REPOSITORY/deployments" --input - <<< "$body" --jq .id)

package/.github/workflows/eval.yml

@@ -0,0 +1,116 @@
+name: Code Foundry Eval
+
+on:
+  workflow_call:
+    inputs:
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: false
+        type: string
+        default: 0xPlayerOne/code-foundry
+      runtime-ref:
+        description: Code Foundry runtime tag or ref.
+        required: false
+        type: string
+        default: v1.0.5
+      runner:
+        description: >-
+          Runner used by the eval harness. Browser evals need a
+          Chrome-capable runner such as ubuntu-latest; ubuntu-slim does not
+          ship a browser.
+        required: false
+        type: string
+        default: ubuntu-latest
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
+
+permissions:
+  contents: read
+
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_RUNNER: ${{ vars.REPO_FOUNDRY_RUNNER }}
+  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+  REPO_FOUNDRY_CACHE_BUILD: ${{ vars.REPO_FOUNDRY_CACHE_BUILD || 'auto' }}
+
+concurrency:
+  group: code-foundry-eval-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  eval:
+    name: Eval
+    if: vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            .github/actions
+            src/lib
+            src/runtime-core.mjs
+            src/runtime.mjs
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions
+          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Detect
+        id: applicability
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run eval >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          # Eval harnesses run through the repository's own package scripts and
+          # need their dependencies installed before the task executes.
+          install: 'true'
+          cache-build: 'true'
+          task: eval
+      - name: Eval
+        id: execute
+        if: steps.applicability.outputs.applicable == 'true'
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci eval
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/eval.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-eval
+          path: .code-foundry/results/eval.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
+      - name: Retain eval report
+        if: >-
+          always() &&
+          steps.execute.outcome == 'failure' &&
+          hashFiles('eval-results/result.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-eval-report
+          path: |
+            eval-results/result.json
+            eval-results/summary.json
+          if-no-files-found: error
+          retention-days: 14

package/.github/workflows/opencode-security_self-ci.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   detect:
     name: OpenCode Security / Detect
-    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false)
+    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}

package/.github/workflows/qualified-foundry-publish.yml

@@ -11,11 +11,11 @@ on:
         description: Exact pre-attached Code Foundry npm tarball name.
         required: true
         type: string
-      environment:
-        description: Protected GitHub environment for npm publication.
+      billing-pause-bypass:
+        description: Allow only an explicitly dispatched release while shared CI remains paused.
         required: false
-        default: npm
-        type: string
+        type: boolean
+        default: false
     secrets:
       NPM_TOKEN:
         required: false
@@ -27,7 +27,7 @@ permissions:
 jobs:
   qualify:
     name: Qualify Node ${{ matrix.node }}
-    if: vars.CI_BILLING_PAUSED != 'true' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['billing-pause-bypass'] == true)) && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     strategy:
@@ -76,10 +76,9 @@ jobs:
   publish:
     name: Publish qualified archive
     needs: qualify
-    if: vars.CI_BILLING_PAUSED != 'true' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['billing-pause-bypass'] == true)) && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-24.04
     timeout-minutes: 15
-    environment: ${{ inputs.environment }}
     concurrency:
       group: qualified-foundry-npm-${{ github.repository }}-${{ inputs.tag }}
       cancel-in-progress: false

package/.github/workflows/release.yml

@@ -23,6 +23,29 @@ on:
         required: false
         type: boolean
         default: false
+      config-file:
+        description: Repository-relative Release Please configuration file.
+        required: false
+        type: string
+        default: release-please-config.json
+      defer-publication:
+        description: Create a root draft release for an external qualified publisher; skip legacy publication and post-release jobs.
+        required: false
+        type: boolean
+        default: false
+    outputs:
+      release_created:
+        description: Whether Release Please created a release (possibly a draft).
+        value: ${{ jobs.release.outputs.release_created }}
+      tag_name:
+        description: Exact tag returned by Release Please.
+        value: ${{ jobs.release.outputs.tag_name }}
+      sha:
+        description: Exact source commit returned by Release Please.
+        value: ${{ jobs.release.outputs.sha }}
+      token_source:
+        description: Credential selected for release operations.
+        value: ${{ jobs.release.outputs.token_source }}
     secrets:
       CODE_FOUNDRY_TOKEN:
         required: false
@@ -57,6 +80,7 @@ jobs:
     outputs:
       release_created: ${{ steps.release.outputs.release_created || 'false' }}
       tag_name: ${{ steps.release.outputs.tag_name }}
+      sha: ${{ steps.release.outputs.sha }}
       npm_publish: ${{ steps.profile.outputs.npm_publish }}
       token_source: ${{ steps.credentials.outputs.token_source }}
     steps:
@@ -77,6 +101,9 @@ jobs:
         run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
       - name: Detect release profile
         id: profile
+        env:
+          RELEASE_CONFIG_FILE: ${{ inputs.config-file }}
+          DEFER_PUBLICATION: ${{ inputs.defer-publication }}
         run: |
           node <<'NODE'
           const fs = require('node:fs')
@@ -108,9 +135,25 @@ jobs:
           if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
           let legacyReleaseType = ''
           if (releaseType !== 'none') {
-            const sourcePath = 'release-please-config.json'
+            const sourcePath = process.env.RELEASE_CONFIG_FILE || 'release-please-config.json'
+            if (!/^(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+\.json$/.test(sourcePath) || sourcePath.split('/').includes('..')) {
+              throw new Error('config-file must be a repository-relative JSON path')
+            }
             if (!fs.existsSync(sourcePath)) throw new Error(`Missing ${sourcePath}`)
+            const path = require('node:path')
+            const relative = path.relative(fs.realpathSync('.'), fs.realpathSync(sourcePath))
+            if (relative === '..' || relative.startsWith(`..${path.sep}`) || !fs.statSync(sourcePath).isFile()) {
+              throw new Error('config-file must be a file inside the repository')
+            }
             const releaseConfig = JSON.parse(fs.readFileSync(sourcePath, 'utf8'))
+            if (process.env.DEFER_PUBLICATION === 'true') {
+              const rootPackage = releaseConfig.packages?.['.']
+              if (!rootPackage || Object.keys(releaseConfig.packages).length !== 1 ||
+                  (rootPackage.draft ?? releaseConfig.draft) !== true ||
+                  (rootPackage['force-tag-creation'] ?? releaseConfig['force-tag-creation']) !== true) {
+                throw new Error('defer-publication requires one root package with draft and force-tag-creation enabled')
+              }
+            }
             if (!releaseConfig.packages && !releaseConfig['release-type']) {
               legacyReleaseType = releaseType
             } else if (!fs.existsSync('.release-please-manifest.json')) {
@@ -152,7 +195,7 @@ jobs:
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         with:
           token: ${{ secrets.CODE_FOUNDRY_TOKEN }}
-          config-file: release-please-config.json
+          config-file: ${{ inputs.config-file }}
           release-type: ${{ steps.profile.outputs.legacy_release_type }}
       - name: Release Please (workflow token)
         id: release_workflow
@@ -160,7 +203,7 @@ jobs:
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         with:
           token: ${{ github.token }}
-          config-file: release-please-config.json
+          config-file: ${{ inputs.config-file }}
           release-type: ${{ steps.profile.outputs.legacy_release_type }}
       - name: Normalize Release Please outputs
         id: release
@@ -168,9 +211,11 @@ jobs:
         env:
           AUTOMATION_RELEASE_CREATED: ${{ steps.release_automation.outputs.release_created }}
           AUTOMATION_TAG_NAME: ${{ steps.release_automation.outputs.tag_name }}
+          AUTOMATION_SHA: ${{ steps.release_automation.outputs.sha }}
           AUTOMATION_PRS_CREATED: ${{ steps.release_automation.outputs.prs_created }}
           WORKFLOW_RELEASE_CREATED: ${{ steps.release_workflow.outputs.release_created }}
           WORKFLOW_TAG_NAME: ${{ steps.release_workflow.outputs.tag_name }}
+          WORKFLOW_SHA: ${{ steps.release_workflow.outputs.sha }}
           WORKFLOW_PRS_CREATED: ${{ steps.release_workflow.outputs.prs_created }}
         run: |
           set -euo pipefail
@@ -182,12 +227,14 @@ jobs:
             {
               echo "release_created=$AUTOMATION_RELEASE_CREATED"
               echo "tag_name=$AUTOMATION_TAG_NAME"
+              echo "sha=$AUTOMATION_SHA"
               echo "prs_created=$AUTOMATION_PRS_CREATED"
             } >> "$GITHUB_OUTPUT"
           else
             {
               echo "release_created=$WORKFLOW_RELEASE_CREATED"
               echo "tag_name=$WORKFLOW_TAG_NAME"
+              echo "sha=$WORKFLOW_SHA"
               echo "prs_created=$WORKFLOW_PRS_CREATED"
             } >> "$GITHUB_OUTPUT"
           fi
@@ -325,7 +372,7 @@ jobs:
     # creating a release. Reconciliation is only meaningful after a release
     # commit/tag is actually created; otherwise the promotion's source changes
     # are incorrectly rejected as non-metadata commits.
-    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
+    if: inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:
@@ -413,7 +460,7 @@ jobs:
   post-release:
     name: Post Hook
     needs: release
-    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true'
+    if: inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     concurrency:
@@ -423,9 +470,6 @@ jobs:
       actions: write
       contents: read
     env:
-      # The release job validates the configured automation token and exposes
-      # the selection; the post hook reuses the same selected credential so a
-      # rejected long-lived token is never used after fallback.
       CODE_FOUNDRY_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
       GH_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
     steps:
@@ -464,7 +508,11 @@ jobs:
           NODE
       - name: Dispatch post-release hook once
         if: steps.hook.outputs.enabled == 'true' && steps.hook.outputs.workflow != ''
-        run: node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release hook --tag '${{ needs.release.outputs.tag_name }}' --workflow '${{ steps.hook.outputs.workflow }}' --mode '${{ steps.hook.outputs.mode }}'
+        env:
+          RELEASE_TAG: ${{ needs.release.outputs.tag_name }}
+          POST_RELEASE_WORKFLOW: ${{ steps.hook.outputs.workflow }}
+          POST_RELEASE_MODE: ${{ steps.hook.outputs.mode }}
+        run: node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release hook --tag "$RELEASE_TAG" --workflow "$POST_RELEASE_WORKFLOW" --mode "$POST_RELEASE_MODE"
       - name: Explain disabled post-release hook
         if: steps.hook.outputs.enabled != 'true' || steps.hook.outputs.workflow == ''
         run: echo 'No post-release workflow configured; artifact delivery is intentionally skipped.'
@@ -472,7 +520,7 @@ jobs:
   npm:
     name: Publish npm
     needs: release
-    if: (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
+    if: inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions: