code-foundry 1.22.1 → 1.28.2

package/.github/workflows/cloudflare-delivery.yml

@@ -36,6 +36,11 @@ on:
         required: false
         type: string
         default: '.'
+      turbo-filter:
+        description: 'Optional Turbo package name override; auto detects it from working-directory by default.'
+        required: false
+        type: string
+        default: auto
       build-script:
         required: false
         type: string
@@ -115,16 +120,143 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  candidate:
+  affected:
+    name: Check Turbo delivery impact
     if: >-
+      inputs['turbo-filter'] != '' &&
+      (github.event_name == 'pull_request' || github.event_name == 'push') &&
       vars.CI_BILLING_PAUSED != 'true' &&
       (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      should_deploy: ${{ steps.check.outputs.should_deploy || steps.resolve.outputs.should_deploy }}
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Resolve Turbo package
+        id: resolve
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_FILTER: ${{ inputs.turbo-filter }}
+          WORKSPACE: ${{ github.workspace }}
+          WORKING_DIRECTORY: ${{ inputs.working-directory }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFileSync, existsSync, readFileSync } from 'node:fs'
+          import { isAbsolute, relative, resolve, sep } from 'node:path'
+          const output = (name, value) => appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`)
+          const conservative = (reason) => {
+            console.log(`${reason}; deploying conservatively.`)
+            output('turbo_enabled', 'false')
+            output('should_deploy', 'true')
+          }
+          const filter = process.env.TURBO_FILTER
+          if (!filter || /[\r\n\0]/.test(filter)) throw new Error('Invalid turbo-filter')
+          const workspace = process.env.WORKSPACE
+          const appDirectory = resolve(workspace, process.env.WORKING_DIRECTORY)
+          const workspaceRelative = relative(workspace, appDirectory)
+          const outsideWorkspace =
+            isAbsolute(workspaceRelative) ||
+            workspaceRelative === '..' ||
+            workspaceRelative.startsWith(`..${sep}`)
+          if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
+            conservative('Turbo config not found')
+          } else if (outsideWorkspace) {
+            conservative('working-directory is outside the workspace')
+          } else if (filter !== 'auto') {
+            output('turbo_package', filter)
+            output('turbo_enabled', 'true')
+          } else {
+            const manifest = resolve(appDirectory, 'package.json')
+            let packageName = ''
+            try {
+              packageName = JSON.parse(readFileSync(manifest, 'utf8')).name ?? ''
+            } catch {
+              packageName = ''
+            }
+            if (typeof packageName !== 'string' || !packageName || /[\s\r\n\0]/.test(packageName)) {
+              conservative('Application package name could not be resolved')
+            } else {
+              console.log(`Resolved Turbo package: ${packageName}`)
+              output('turbo_package', packageName)
+              output('turbo_enabled', 'true')
+            }
+          }
+          NODE
+      - name: Set up Bun
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install dependencies for Turbo
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Check affected build task
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        id: check
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_PACKAGE: ${{ steps.resolve.outputs.turbo_package }}
+          TURBO_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          TURBO_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          [[ "$TURBO_PACKAGE" != *$'\n'* && "$TURBO_PACKAGE" != *$'\r'* && "$TURBO_PACKAGE" != *$'\0'* ]]
+          [[ "$TURBO_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]
+          if [[ ! "$TURBO_BASE_SHA" =~ ^[0-9a-fA-F]{40}$ || "$TURBO_BASE_SHA" =~ ^0+$ ]]; then
+            echo 'No comparable base commit; deploying conservatively.'
+            echo 'should_deploy=true' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          bunx --bun --no-install turbo query affected \
+            --packages \
+            --base="$TURBO_BASE_SHA" \
+            --head="$TURBO_HEAD_SHA" \
+            --no-update-notifier > "$RUNNER_TEMP/turbo-affected.json"
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs'
+          const result = JSON.parse(readFileSync(process.env.RUNNER_TEMP + '/turbo-affected.json', 'utf8'))
+          const items = result?.data?.affectedPackages?.items ?? result?.data?.affectedTasks?.items
+          if (!Array.isArray(items)) throw new Error('Turbo affected query returned no package/task items')
+          const packageName = process.env.TURBO_PACKAGE
+          const affected = items.some((item) => item?.name === packageName || item?.package?.name === packageName || item?.fullName?.startsWith(`${packageName}#`))
+          console.log(`${packageName}: ${affected ? 'affected' : 'unaffected'}`)
+          appendFileSync(process.env.GITHUB_OUTPUT, `should_deploy=${affected}\n`)
+          NODE
+
+  candidate:
+    needs: affected
+    if: >-
+      always() &&
+      vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      (
+        inputs['turbo-filter'] == '' ||
+        needs.affected.result == 'skipped' ||
+        needs.affected.outputs.should_deploy == 'true'
+      )
+    runs-on: ubuntu-latest
     timeout-minutes: 30
+    # The explicit deployment record below is the sole GitHub deployment record.
+    # Keep the environment for approvals, secrets, and branch protection without
+    # creating a second, competing PR timeline entry.
     environment:
       name: Preview
+      deployment: false
       url: ${{ steps.upload.outputs.url }}
     defaults:
       run:
@@ -251,6 +383,7 @@ jobs:
     timeout-minutes: 30
     environment:
       name: Production
+      deployment: false
       url: ${{ inputs.production-url }}
     defaults:
       run:

package/.github/workflows/cloudflare-deploy.yml

@@ -21,6 +21,11 @@ on:
         required: false
         type: string
         default: '.'
+      turbo-filter:
+        description: 'Optional Turbo package name override; auto detects it from working-directory by default.'
+        required: false
+        type: string
+        default: auto
       build-script:
         required: false
         type: string
@@ -69,17 +74,144 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  affected:
+    name: Check Turbo deployment impact
+    if: >-
+      inputs['turbo-filter'] != '' &&
+      (github.event_name == 'pull_request' || github.event_name == 'push') &&
+      vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      should_deploy: ${{ steps.check.outputs.should_deploy || steps.resolve.outputs.should_deploy }}
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Resolve Turbo package
+        id: resolve
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_FILTER: ${{ inputs.turbo-filter }}
+          WORKSPACE: ${{ github.workspace }}
+          WORKING_DIRECTORY: ${{ inputs.working-directory }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFileSync, existsSync, readFileSync } from 'node:fs'
+          import { isAbsolute, relative, resolve, sep } from 'node:path'
+          const output = (name, value) => appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`)
+          const conservative = (reason) => {
+            console.log(`${reason}; deploying conservatively.`)
+            output('turbo_enabled', 'false')
+            output('should_deploy', 'true')
+          }
+          const filter = process.env.TURBO_FILTER
+          if (!filter || /[\r\n\0]/.test(filter)) throw new Error('Invalid turbo-filter')
+          const workspace = process.env.WORKSPACE
+          const appDirectory = resolve(workspace, process.env.WORKING_DIRECTORY)
+          const workspaceRelative = relative(workspace, appDirectory)
+          const outsideWorkspace =
+            isAbsolute(workspaceRelative) ||
+            workspaceRelative === '..' ||
+            workspaceRelative.startsWith(`..${sep}`)
+          if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
+            conservative('Turbo config not found')
+          } else if (outsideWorkspace) {
+            conservative('working-directory is outside the workspace')
+          } else if (filter !== 'auto') {
+            output('turbo_package', filter)
+            output('turbo_enabled', 'true')
+          } else {
+            const manifest = resolve(appDirectory, 'package.json')
+            let packageName = ''
+            try {
+              packageName = JSON.parse(readFileSync(manifest, 'utf8')).name ?? ''
+            } catch {
+              packageName = ''
+            }
+            if (typeof packageName !== 'string' || !packageName || /[\s\r\n\0]/.test(packageName)) {
+              conservative('Application package name could not be resolved')
+            } else {
+              console.log(`Resolved Turbo package: ${packageName}`)
+              output('turbo_package', packageName)
+              output('turbo_enabled', 'true')
+            }
+          }
+          NODE
+      - name: Set up Bun
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install dependencies for Turbo
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Check affected build task
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        id: check
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_PACKAGE: ${{ steps.resolve.outputs.turbo_package }}
+          TURBO_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          TURBO_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          [[ "$TURBO_PACKAGE" != *$'\n'* && "$TURBO_PACKAGE" != *$'\r'* && "$TURBO_PACKAGE" != *$'\0'* ]]
+          [[ "$TURBO_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]
+          if [[ ! "$TURBO_BASE_SHA" =~ ^[0-9a-fA-F]{40}$ || "$TURBO_BASE_SHA" =~ ^0+$ ]]; then
+            echo 'No comparable base commit; deploying conservatively.'
+            echo 'should_deploy=true' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          bunx --bun --no-install turbo query affected \
+            --packages \
+            --base="$TURBO_BASE_SHA" \
+            --head="$TURBO_HEAD_SHA" \
+            --no-update-notifier > "$RUNNER_TEMP/turbo-affected.json"
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs'
+          const result = JSON.parse(readFileSync(process.env.RUNNER_TEMP + '/turbo-affected.json', 'utf8'))
+          const items = result?.data?.affectedPackages?.items ?? result?.data?.affectedTasks?.items
+          if (!Array.isArray(items)) throw new Error('Turbo affected query returned no package/task items')
+          const packageName = process.env.TURBO_PACKAGE
+          const affected = items.some((item) => item?.name === packageName || item?.package?.name === packageName || item?.fullName?.startsWith(`${packageName}#`))
+          console.log(`${packageName}: ${affected ? 'affected' : 'unaffected'}`)
+          appendFileSync(process.env.GITHUB_OUTPUT, `should_deploy=${affected}\n`)
+          NODE
+
   deploy:
     name: Cloudflare Deploy / ${{ inputs.mode }}
+    needs: affected
     if: >-
+      always() &&
       vars.CI_BILLING_PAUSED != 'true' &&
       (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
       github.event_name != 'pull_request_target' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      (
+        inputs['turbo-filter'] == '' ||
+        needs.affected.result == 'skipped' ||
+        needs.affected.outputs.should_deploy == 'true'
+      )
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
+    # The explicit deployment record below is the sole GitHub deployment record.
+    # Keep the environment for approvals, secrets, and branch protection without
+    # creating a second, competing PR timeline entry.
     environment:
       name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+      deployment: false
       url: ${{ steps.deploy.outputs.url }}
     outputs:
       url: ${{ steps.deploy.outputs.url }}
@@ -182,10 +314,17 @@ jobs:
           DEPLOYMENT_ID: ${{ steps.start.outputs.id }}
           DEPLOY_URL: ${{ steps.deploy.outputs.url }}
           JOB_STATUS: ${{ job.status }}
+          MODE: ${{ inputs.mode }}
         run: |
           set -euo pipefail
           state=failure
           if [ "$JOB_STATUS" = success ]; then state=success; fi
           args=(-f "state=$state" -F auto_inactive=false)
+          # Preview environments are persistent per application. Once a new
+          # preview succeeds, retire the previous successful preview record;
+          # failed previews must not take a working preview offline.
+          if [ "$MODE" = preview ] && [ "$state" = success ]; then
+            args+=(-F auto_inactive=true)
+          fi
           if [ -n "$DEPLOY_URL" ]; then args+=(-f "environment_url=$DEPLOY_URL"); fi
           gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$DEPLOYMENT_ID/statuses" "${args[@]}" --silent

package/.github/workflows/consumer-qualification.yml

@@ -76,7 +76,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ['20', '22', '24']
+        node: ['24', '26']
     env:
       PACKAGE: ${{ needs.pack.outputs.filename }}
       SOURCE_SHA: ${{ needs.pack.outputs.source-sha }}
@@ -162,7 +162,7 @@ jobs:
           gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
             --name "qualification-candidate-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
             --dir "$RUNNER_TEMP/candidate"
-          for node in 20 22 24; do
+          for node in 24 26; do
             gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
               --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
               --dir "$RUNNER_TEMP/reports/$node"
@@ -182,7 +182,7 @@ jobs:
             sourceSha: env.SOURCE_SHA, asset: env.PACKAGE,
             directory: join(env.RUNNER_TEMP, 'candidate'),
           }
-          const result = qualifyArchive(candidate, ['20', '22', '24'].map(node => join(env.RUNNER_TEMP, 'reports', node, 'report.json')))
+          const result = qualifyArchive(candidate, ['24', '26'].map(node => join(env.RUNNER_TEMP, 'reports', node, 'report.json')))
           assert.equal(result.digest, `sha256:${env.CANDIDATE_SHA256}`)
           const artifact = `qualification-candidate-${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`
           writeFileSync(join(env.RUNNER_TEMP, 'qualification.json'), JSON.stringify({ ...result, run_id: env.GITHUB_RUN_ID, run_attempt: env.GITHUB_RUN_ATTEMPT }, null, 2) + '\n')

package/.github/workflows/eval.yml

@@ -0,0 +1,116 @@
+name: Code Foundry Eval
+
+on:
+  workflow_call:
+    inputs:
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: false
+        type: string
+        default: 0xPlayerOne/code-foundry
+      runtime-ref:
+        description: Code Foundry runtime tag or ref.
+        required: false
+        type: string
+        default: v1.0.5
+      runner:
+        description: >-
+          Runner used by the eval harness. Browser evals need a
+          Chrome-capable runner such as ubuntu-latest; ubuntu-slim does not
+          ship a browser.
+        required: false
+        type: string
+        default: ubuntu-latest
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
+
+permissions:
+  contents: read
+
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_RUNNER: ${{ vars.REPO_FOUNDRY_RUNNER }}
+  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+  REPO_FOUNDRY_CACHE_BUILD: ${{ vars.REPO_FOUNDRY_CACHE_BUILD || 'auto' }}
+
+concurrency:
+  group: code-foundry-eval-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  eval:
+    name: Eval
+    if: vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            .github/actions
+            src/lib
+            src/runtime-core.mjs
+            src/runtime.mjs
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions
+          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Detect
+        id: applicability
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run eval >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          # Eval harnesses run through the repository's own package scripts and
+          # need their dependencies installed before the task executes.
+          install: 'true'
+          cache-build: 'true'
+          task: eval
+      - name: Eval
+        id: execute
+        if: steps.applicability.outputs.applicable == 'true'
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci eval
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/eval.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-eval
+          path: .code-foundry/results/eval.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
+      - name: Retain eval report
+        if: >-
+          always() &&
+          steps.execute.outcome == 'failure' &&
+          hashFiles('eval-results/result.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-eval-report
+          path: |
+            eval-results/result.json
+            eval-results/summary.json
+          if-no-files-found: error
+          retention-days: 14

package/.github/workflows/qualified-foundry-publish.yml

@@ -33,7 +33,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ['20', '22', '24']
+        node: ['24', '26']
     steps:
       - name: Checkout trusted qualification runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -113,7 +113,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          for node in 20 22 24; do
+          for node in 24 26; do
             gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
               --name "qualified-$GITHUB_RUN_ATTEMPT-node-$node" \
               --dir "$RUNNER_TEMP/reports/$node"
@@ -130,9 +130,8 @@ jobs:
           node src/commands/qualified-publication.mjs publish \
             "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
             "$RUNNER_TEMP/candidate" \
-            "$RUNNER_TEMP/reports/20/report.json" \
-            "$RUNNER_TEMP/reports/22/report.json" \
-            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/publication.json"
+            "$RUNNER_TEMP/reports/24/report.json" \
+            "$RUNNER_TEMP/reports/26/report.json" > "$RUNNER_TEMP/publication.json"
       - name: Retain publication identity
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

package/.github/workflows/release_self-ci.yml

@@ -22,7 +22,13 @@ concurrency:
 jobs:
   qualification:
     name: Qualify consumers
-    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
+    # Qualification feeds staging and publication, so it runs only when this
+    # push created a release or recovery found a stuck one. Feature merges
+    # only pay for the cheap release-please and recovery probes below; the
+    # content they merge was already audited on its pull request, and the
+    # release merge re-qualifies the exact tree it publishes.
+    needs: [release, recovery]
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
     uses: ./.github/workflows/consumer-qualification.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
@@ -65,7 +71,11 @@ jobs:
 
   release:
     name: Release
-    needs: [qualification, preflight]
+    # Release Please consumes no qualification outputs; it runs first so the
+    # qualification below only executes when a release (or a stuck draft) needs
+    # it. Version pull requests keep flowing even when the candidate is broken;
+    # publication stays gated on qualification success in the stage job.
+    needs: [preflight]
     if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/release.yml
     with:
@@ -87,8 +97,8 @@ jobs:
 
   recovery:
     name: Recover qualified draft identity
-    needs: [qualification, release]
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.qualification.result == 'success' && needs.release.result == 'success'
+    needs: [release]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.release.result == 'success'
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
@@ -99,7 +109,9 @@ jobs:
       sha: ${{ steps.recover.outputs.sha }}
     env:
       RELEASE_CREATED: ${{ needs.release.outputs.release_created }}
-      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+      # The qualification source SHA is git rev-parse HEAD of the push, so
+      # recovery computes it directly instead of depending on qualification.
+      SOURCE_SHA: ${{ github.sha }}
     steps:
       - name: Checkout trusted recovery runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -156,7 +168,10 @@ jobs:
   stage:
     name: Stage qualified release
     needs: [qualification, release, recovery]
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    # Qualification only runs when this push created a release or recovery
+    # found a stuck one; staging additionally requires its success so an
+    # unqualified tree can never reach publication.
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && needs.qualification.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
@@ -203,7 +218,7 @@ jobs:
           gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
             --name "$CANDIDATE_ARTIFACT" --dir "$RUNNER_TEMP/candidate"
           test "$(sha256sum "$RUNNER_TEMP/candidate/$PACKAGE" | cut -d' ' -f1)" = "$CANDIDATE_SHA256"
-          for node in 20 22 24; do
+          for node in 24 26; do
             gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
               --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
               --dir "$RUNNER_TEMP/reports/$node"
@@ -216,9 +231,8 @@ jobs:
           node src/commands/qualified-publication.mjs stage \
             "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$SOURCE_SHA" "$PACKAGE" \
             "$RUNNER_TEMP/candidate" \
-            "$RUNNER_TEMP/reports/20/report.json" \
-            "$RUNNER_TEMP/reports/22/report.json" \
-            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/staging.json"
+            "$RUNNER_TEMP/reports/24/report.json" \
+            "$RUNNER_TEMP/reports/26/report.json" > "$RUNNER_TEMP/staging.json"
       - name: Retain staging identity
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7