code-foundry 1.22.1 → 1.28.2

package/docs/cloudflare-delivery.md

@@ -37,7 +37,18 @@ jobs:
 ```
 
 `artifact-path` is relative to `working-directory`; `install-working-directory`
-selects the lockfile root. The selected output tree is hashed before and after
+selects the lockfile root. For Turbo monorepos, filtering is automatic when
+`working-directory` points to the application package and the lockfile root
+contains `turbo.json` or `turbo.jsonc`. The workflow resolves the package name,
+then compares pull-request base/head commits or push before/after commits with
+`turbo query affected --packages`; shared-package changes therefore retain
+dependent app deployments. Unaffected app calls skip the build and Cloudflare
+deployment. Set `turbo-filter` only to override the detected package name; set
+it to an empty string to disable filtering. Full history is fetched for the
+comparison. Manual dispatches deploy conservatively because they do not provide
+a reliable comparison range.
+
+The selected output tree is hashed before and after
 upload; changes during upload fail. Include all built code/assets in that tree
 and disable duplicate custom build steps. This digest identifies the declared
 local build tree, not a Cloudflare-signed digest of every uploaded configuration
@@ -71,12 +82,16 @@ not sufficient.
 ## Approvals, ordering, and evidence
 
 Create and protect the fixed `Preview` and `Production` GitHub environments
-before adoption. The workflow references them at the **job** level; naming an
-environment does not itself configure reviewers or branch restrictions. Configure
-required reviewers and branch restrictions on `Production` separately. Production
-execution requires the current default-branch commit and
-rechecks freshness after approval and before final promotion. Fork PRs and
-`pull_request_target` execution are excluded.
+before adoption. The workflow references them at the **job** level and disables
+GitHub's implicit deployment record; the explicit application record is the sole
+entry in deployment history. Required reviewers, wait timers, and branch
+restrictions still apply. GitHub custom deployment protection rules are not
+compatible with `deployment: false`; use the explicit record without that rule or
+keep automatic deployment records enabled. Configure required reviewers and
+branch restrictions on `Production` separately. Production execution requires the
+current default-branch commit and rechecks freshness after approval and before
+final promotion. Fork PRs, release-please PRs, and `pull_request_target` execution
+are excluded from preview delivery.
 
 Per-repository/Worker/mode concurrency never cancels a running promotion. GitHub
 concurrency is not a FIFO queue; stale-source rejection is still necessary.
@@ -88,14 +103,15 @@ and new production workflows active.
 
 Outputs include preview URL, exact version ID, source SHA, declared build-tree
 SHA-256 digest, Cloudflare deployment ID, and GitHub application deployment ID.
-Explicit application deployment records receive in-progress and success/failure
-statuses, in addition to GitHub's environment-job records. For pull requests,
-the deployment record is associated with `github.event.pull_request.head.sha`,
-not GitHub Actions' merge commit, so GitHub can display the preview in the PR's
-Deployments section. Direct pushes use `github.sha`. Sanitized candidate and
-production JSON evidence is uploaded even on failure. Binding values, API bodies,
-and credentials are not copied into those reports. Forced runner termination may
-prevent final status steps; the GitHub job still reflects cancellation/failure.
+The workflows disable GitHub's automatic environment deployment object and use
+one explicit application deployment record, which receives in-progress and
+success/failure statuses. For pull requests, that record is associated with
+`github.event.pull_request.head.sha`, not GitHub Actions' merge commit, so GitHub
+can display the preview in the PR's Deployments section. Direct pushes use
+`github.sha`. Sanitized candidate and production JSON evidence is uploaded even
+on failure. Binding values, API bodies, and credentials are not copied into those
+reports. Forced runner termination may prevent final status steps; the GitHub job
+still reflects cancellation/failure.
 
 ## Stateful resources and isolation
 
@@ -171,18 +187,24 @@ the deployment API intentionally changes version routing only.
 
 ## Legacy workflow hardening
 
-`cloudflare-deploy.yml` uses real job environments, non-cancelling concurrency,
-structured Wrangler output, exact/local Wrangler selection, reusable outputs, and
-in-progress/failure deployment records. Its preview deployment records use the
-pull request head SHA when called from a PR, so completed previews appear in that
-PR's Deployments section; direct pushes use the workflow SHA. Its compatibility
+`cloudflare-deploy.yml` uses real job environments with automatic deployment
+history disabled, non-cancelling concurrency, structured Wrangler output,
+exact/local Wrangler selection, reusable outputs, and one explicit
+in-progress/failure deployment record. Preview records use the pull request head
+SHA when called from a PR, so completed previews appear in that PR's Deployments
+section; direct pushes use `github.sha`. Preview delivery skips release-please PRs,
+which are merged and closed by release automation rather than being application
+previews. Its compatibility
 default remains `latest`; callers should prefer `local` or an exact version for
 reproducibility. A production URL can be supplied with `deployment-url` when API
-output contains only route patterns. It is still a **direct, unverified deployment**;
-adopt `cloudflare-delivery.yml` for candidate verification and
-guarded promotion. Consumers pinned to an older Code Foundry release must update
-their reusable workflow reference; existing deployments are not retroactively
-re-associated with the PR head commit.
+output contains only route patterns. Turbo filtering also applies to production
+pushes, which use the previous and current commit to skip unaffected
+applications. It is still a **direct, unverified
+deployment**; adopt `cloudflare-delivery.yml` for candidate verification and
+guarded promotion.
+Consumers pinned to an older Code Foundry release must update their reusable
+workflow reference; existing deployments are not retroactively re-associated
+with the PR head commit.
 
 ## References and testing
 

package/docs/consumer-qualification.md

@@ -6,7 +6,7 @@ Release-candidate compatibility checks against the distributable package.
 **Scope:** Package installation, CLI initialization/synchronization, generated workflow contracts.
 
 `consumer-qualification.yml` packs the checked-out candidate once, shares that
-archive across Node 20, 22, and 24 using an artifact scoped to the same workflow
+archive across Node 24 and 26 using an artifact scoped to the same workflow
 run **and attempt**, and installs it offline with lifecycle scripts disabled,
 and executes its public CLI from the installed package. The harness does not
 import the source checkout's initializer as a substitute for package testing.

package/docs/fleet-release-eligibility.md

@@ -16,11 +16,7 @@ guard, and `--force` cannot bypass source identity or qualification.
   "repository": "owner/code-foundry",
   "workflow": ".github/workflows/release_self-ci.yml",
   "branch": "main",
-  "required_jobs": [
-    "Qualify consumers / Node 20",
-    "Qualify consumers / Node 22",
-    "Qualify consumers / Node 24"
-  ]
+  "required_jobs": ["Qualify consumers / Node 24", "Qualify consumers / Node 26"]
 }
 ```
 

package/docs/qualified-publication.md

@@ -9,7 +9,7 @@ consumer release callers keep the ordinary `release.yml` behavior.
 The self-release pipeline is intentionally staged:
 
 1. `consumer-qualification.yml` packs the candidate once and qualifies it across
-   Node 20, 22, and 24.
+   Node 24 and 26.
 2. Release Please creates a draft release for the qualified source.
 3. The staging job attaches the exact archive and a digest-bound qualification
    receipt, publishes the immutable GitHub Release, and verifies its identity.

package/docs/required-capabilities.md

@@ -5,8 +5,9 @@ Optional task discovery remains available. Configure scalar values in
 `.github/code-foundry.yml`:
 
 ```yaml
-required_capabilities: type_check,unit,e2e,performance,coverage
+required_capabilities: type_check,unit,e2e,eval,performance,coverage
 performance: true
+eval: true
 coverage_enforcement: required
 coverage_minimum: 80
 coverage_metrics: lines,branches
@@ -14,10 +15,11 @@ coverage_report: coverage/coverage-summary.json
 ```
 
 Supported task capabilities are `format`, `lint`, `type_check`, `build`, `unit`,
-`integration`, `e2e`, `smoke`, and `performance`. `coverage` additionally requires
+`integration`, `e2e`, `smoke`, `eval`, and `performance`. `coverage` additionally requires
 unit tests. Unknown names, contradictory requirements, and invalid thresholds
-are errors. `performance: true` means required, not merely enabled when a
-script happens to exist. Use `performance: auto` to retain optional discovery.
+are errors. `performance: true` and `eval: true` mean required, not merely
+enabled when a script happens to exist. Use `performance: auto` or
+`eval: auto` to retain optional discovery.
 
 The public `src/runtime.mjs` entrypoint delegates ecosystem execution to the
 private `src/runtime-core.mjs`. Keep both files and `src/lib` when vendoring the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.22.1",
+  "version": "1.28.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {
@@ -42,7 +42,7 @@
     "build": "node --check src/cli.mjs",
     "format:check": "oxfmt --check .",
     "fmt": "oxfmt .",
-    "lint": "oxlint",
+    "lint": "oxlint --deny-warnings",
     "performance:check": "node scripts/performance-check.mjs",
     "test": "node --test",
     "test:unit": "node --test",
@@ -57,7 +57,7 @@
     "typescript": "^7.0.2"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "packageManager": "bun@1.4.0"
 }

package/src/commands/doctor.mjs

@@ -9,6 +9,11 @@ import { packageManagerForLockfile } from '../lib/lockfiles.mjs'
 import { doctorGithub } from '../lib/github-doctor.mjs'
 import { isGeneratedEventCaller } from './sync.mjs'
 
+/** @param {string} message */
+function warn(message) {
+  console.warn(`WARN: ${message}`)
+}
+
 /** @param {string} root @param {{ github?: boolean }} [options] */
 export function doctor(root, options = {}) {
   const target = resolve(root)
@@ -21,8 +26,6 @@ export function doctor(root, options = {}) {
     console.error(`ERROR: ${message}`)
     errors += 1
   }
-  /** @param {string} message */
-  const warn = (message) => console.warn(`WARN: ${message}`)
 
   const toolchain = config.toolchain ?? 'auto'
   if (!['auto', 'native', 'mise'].includes(toolchain)) error(`unsupported toolchain: ${toolchain}`)

package/src/commands/fleet-core.mjs

@@ -33,7 +33,7 @@ export function discoverRepositories(root) {
       gitWorkflow: config.git_workflow ?? 'direct',
     })
   }
-  return result.sort((a, b) => a.path.localeCompare(b.path))
+  return result.toSorted((a, b) => a.path.localeCompare(b.path))
 }
 
 /** @param {string} root @param {string} source @param {{ createPr?: boolean, dryRun?: boolean, force?: boolean, version: string, exclude?: string[] }} options */

package/src/commands/qualified-publication.mjs

@@ -16,7 +16,7 @@ import { join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { tmpdir } from 'node:os'
 
-export const REQUIRED_NODES = ['20', '22', '24']
+export const REQUIRED_NODES = ['24', '26']
 export const REQUIRED_FIXTURES = [
   'npm-direct',
   'pnpm-direct',
@@ -46,6 +46,24 @@ export function runCommand(command, args, cwd) {
   )
   return result.stdout
 }
+
+/** Default tolerant runner: GitHub CLI failures surface as retryable misses
+ * instead of aborting the publication flow.
+ * @param {string} command
+ * @param {string[]} args
+ * @param {string} [cwd]
+ * @returns {{status: number, stdout: string}}
+ */
+function defaultRunTolerant(command, args, cwd) {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    timeout: 180_000,
+    maxBuffer: 8 * 1024 * 1024,
+    env: { ...process.env, GH_HOST: 'github.com', GH_PROMPT_DISABLED: '1' },
+  })
+  return { status: result.error ? 1 : (result.status ?? 1), stdout: result.stdout ?? '' }
+}
 /** @param {Candidate} candidate */
 export function validateCandidate(candidate) {
   ensure(
@@ -225,10 +243,50 @@ export async function publishQualifiedArchive(candidate, reports, adapters = {})
   return { ...before, status: 'published' }
 }
 
+/** @typedef {(command:string, args:string[], cwd?:string) => {status: number, stdout: string}} RunTolerant */
+
+/** Poll the releases-by-tag endpoint through its eventual-consistency window.
+ * Immediately after `gh release edit --draft=false` the endpoint can still
+ * return 404; a strict verification in that window aborts an otherwise
+ * healthy publication. Bounded retries keep the flow strict: it only proceeds
+ * once the endpoint serves the published release with the exact tag.
+ * @param {Candidate} candidate
+ * @param {{runTolerant?: RunTolerant, delay?: (ms:number)=>Promise<void>, attempts?: number}} [adapters]
+ * @returns {Promise<Record<string, any>>}
+ */
+async function waitForPublishedRelease(candidate, adapters = {}) {
+  const runTolerant = adapters.runTolerant ?? defaultRunTolerant
+  const delay = adapters.delay ?? ((ms) => new Promise((done) => setTimeout(done, ms)))
+  const attempts = adapters.attempts ?? 15
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const result = runTolerant('gh', [
+      'api',
+      '--hostname',
+      'github.com',
+      `repos/${candidate.repository}/releases/tags/${encodeURIComponent(candidate.tag)}`,
+    ])
+    if (result.status === 0) {
+      /** @type {Record<string, any> | null} */
+      let release = null
+      try {
+        release = JSON.parse(result.stdout)
+      } catch {
+        release = null
+      }
+      if (release?.draft === false && release?.tag_name === candidate.tag) return release
+    }
+    if (attempt === attempts) break
+    await delay(2_000)
+  }
+  throw new Error(
+    'The published release was not retrievable via the tag endpoint within the consistency window'
+  )
+}
+
 /** Stage only a previously-created draft: never move tags, overwrite assets, or
  * treat an API/permissions failure as an absent release. Authentication needs
  * immutable-settings read and release write; no setting is mutated.
- * @param {Candidate} candidate @param {string[]} reports @param {{run?:Run, verify?:Verify}} [adapters]
+ * @param {Candidate} candidate @param {string[]} reports @param {{run?:Run, runTolerant?:RunTolerant, delay?:(ms:number)=>Promise<void>, attempts?:number, verify?:Verify}} [adapters]
  */
 export async function stageQualifiedRelease(candidate, reports, adapters = {}) {
   const run = adapters.run ?? runCommand
@@ -332,7 +390,27 @@ export async function stageQualifiedRelease(candidate, reports, adapters = {}) {
       '--repo',
       candidate.repository,
     ])
-    const identity = await (adapters.verify ?? verifier)(candidate)
+    // GitHub's release index is eventually consistent right after a draft is
+    // published; a strict verification a second later can observe a 404 and
+    // abort the publication even though the release is live. Poll until the
+    // index serves the release, then verify; the verification cycle itself
+    // retries through the same window and still fails closed in the end.
+    await waitForPublishedRelease(candidate, {
+      runTolerant: adapters.runTolerant,
+      delay: adapters.delay,
+      attempts: 10,
+    })
+    /** @type {Record<string, any>} */
+    let identity
+    for (let attempt = 1; ; attempt += 1) {
+      try {
+        identity = await (adapters.verify ?? verifier)(candidate)
+        break
+      } catch (error) {
+        if (attempt >= 10) throw error
+        await (adapters.delay ?? ((ms) => new Promise((done) => setTimeout(done, ms))))(5_000)
+      }
+    }
     ensure(
       identity.status === 'passed' &&
         identity.immutable === true &&

package/src/commands/release-integrity.mjs

@@ -7,7 +7,7 @@ import { basename, isAbsolute, relative, resolve, sep } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { pathToFileURL } from 'node:url'
 
-/** @typedef {(argv: string[]) => {status: number|null, stdout: string}} Runner */
+/** @typedef {(argv: string[]) => {status: number|null, stdout: string, stderr?: string}} Runner */
 
 /** @type {Runner} */
 export function runGh(argv) {
@@ -18,7 +18,7 @@ export function runGh(argv) {
     env: { ...process.env, GH_PROMPT_DISABLED: '1', GH_HOST: 'github.com' },
   })
   if (result.error) throw new Error(`GitHub CLI unavailable: ${result.error.name}`)
-  return { status: result.status, stdout: result.stdout ?? '' }
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' }
 }
 
 /** @param {string} repository */
@@ -56,7 +56,7 @@ function json(run, argv) {
   const result = run(argv)
   if (result.status !== 0)
     throw new Error(
-      `GitHub verification command failed (${result.status ?? 'signal'}); state is unverified`
+      `GitHub verification command failed (${result.status ?? 'signal'}); state is unverified: ${String(result.stderr ?? '').slice(0, 300) || 'no stderr captured'}`
     )
   try {
     return JSON.parse(result.stdout)
@@ -197,6 +197,17 @@ export function verifyRelease(options, run = runGh) {
   }
 }
 
+/** Sync pause used by the post-publication verifier while the release index
+ * catches up with a just-published release.
+ * @param {number} ms
+ */
+function sleepSync(ms) {
+  if (ms <= 0) return
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+}
+
+const RELEASE_VERIFICATION_ATTEMPTS = 6
+
 /** @param {string[]} argv @param {Runner} [run] */
 export function integrityCommand(argv, run = runGh) {
   const [command, ...args] = argv
@@ -228,17 +239,29 @@ export function integrityCommand(argv, run = runGh) {
     throw new Error('An argument is not supported by this integrity command')
   if (command === 'settings') return verifyImmutableSetting(values['--repo'] ?? '', run)
   if (command === 'manifest') return assetManifest(values['--root'] ?? process.cwd(), assets)
-  if (command === 'release')
-    return verifyRelease(
-      {
-        repository: values['--repo'] ?? '',
-        tag: values['--tag'] ?? '',
-        root: values['--root'],
-        expectedSha: values['--expected-sha'],
-        assets,
-      },
-      run
-    )
+  if (command === 'release') {
+    const options = {
+      repository: values['--repo'] ?? '',
+      tag: values['--tag'] ?? '',
+      root: values['--root'],
+      expectedSha: values['--expected-sha'],
+      assets,
+    }
+    // The lane fires the instant GitHub marks the release published, while the
+    // releases-by-tag index can still lag behind. Retry through that window;
+    // every strict check still runs on every attempt and the command fails
+    // closed once the bounded window is exhausted.
+    let lastError
+    for (let attempt = 1; attempt <= RELEASE_VERIFICATION_ATTEMPTS; attempt += 1) {
+      try {
+        return verifyRelease(options, run)
+      } catch (error) {
+        lastError = error
+        if (attempt < RELEASE_VERIFICATION_ATTEMPTS) sleepSync(5_000)
+      }
+    }
+    throw lastError
+  }
   throw new Error('Use release-integrity settings, release, or manifest')
 }
 

package/src/commands/sync.mjs

@@ -354,7 +354,7 @@ function synchronize(options) {
     const mergedManifest = {}
     for (const directory of [
       ...new Set([...Object.keys(releaseManifest), ...Object.keys(existingManifest)]),
-    ].sort()) {
+    ].toSorted()) {
       mergedManifest[directory] = existingManifest[directory] ?? releaseManifest[directory]
     }
     const content = `${JSON.stringify(mergedManifest, null, 2)}\n`
@@ -652,7 +652,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
     // self-only jobs whose outputs and environments do not exist for them.
     for (const job of ['qualification', 'preflight', 'recovery', 'stage', 'publish'])
       rendered = removeWorkflowBlock(rendered, job)
-    rendered = rendered.replace(/^    needs: \[qualification, preflight\]\n/m, '')
+    rendered = rendered.replace(/^    needs: \[preflight\]\n/m, '')
     rendered = rendered.replace(/^      config-file: \.github\/release-please-foundry\.json\n/m, '')
     rendered = rendered.replace(/^      defer-publication: true\n/m, '')
     rendered = rendered.replace(
@@ -714,6 +714,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       'codeql-runner': config.codeql_runner ?? config.runner,
       'unit-runner': config.unit_runner,
       'performance-runner': config.performance_runner ?? config.test_runner ?? config.runner,
+      'eval-runner': config.eval_runner ?? config.runner,
     }
     for (const [input, value] of Object.entries(runnerInputs)) {
       if (!value) continue

package/src/lib/docs-only.mjs

@@ -0,0 +1,39 @@
+// @ts-check
+
+import { execFileSync } from 'node:child_process'
+
+/** Docs-only allowlist: markdown, docs/, and license roots. Code, lockfiles,
+ * workflows, configuration, and packaging always keep the audit tier. */
+const DOCS_ONLY_PATTERNS = [/\.md$/i, /^docs\//, /^LICENSE/i]
+
+/** @param {string} path */
+export function isDocsOnlyPath(path) {
+  return DOCS_ONLY_PATTERNS.some((pattern) => pattern.test(path))
+}
+
+/**
+ * Report whether a pull request changes docs only. Fail-closed: any git
+ * failure, unresolvable base, or non-docs path keeps the audit tier.
+ * @param {string} root
+ * @param {string} baseRef
+ */
+export function docsOnlyPullRequest(root, baseRef) {
+  try {
+    execFileSync('git', ['fetch', '--no-tags', '--depth=100', 'origin', baseRef], {
+      cwd: root,
+      stdio: 'pipe',
+    })
+    const output = execFileSync('git', ['diff', '--name-only', 'FETCH_HEAD...HEAD'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    const paths = output
+      .split('\n')
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0)
+    return paths.length > 0 && paths.every(isDocsOnlyPath)
+  } catch {
+    return false
+  }
+}