code-foundry 1.28.10 → 1.28.12

package/.github/workflows/ci.yml

@@ -53,6 +53,7 @@ jobs:
     name: Format
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -112,6 +113,7 @@ jobs:
     name: Lint
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -166,6 +168,7 @@ jobs:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -220,6 +223,7 @@ jobs:
     name: Build
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     env:
       # Framework builds may validate server-side configuration at build time.
       # Consumers can provide the real value; the fallback is intentionally

package/.github/workflows/eval.yml

@@ -50,6 +50,7 @@ jobs:
     name: Eval
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

package/.github/workflows/opencode-security_self-ci.yml

@@ -16,6 +16,7 @@ jobs:
     name: OpenCode Security / Detect
     if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
     runs-on: ubuntu-slim
+    timeout-minutes: 10
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}
       token: ${{ steps.detect.outputs.token }}

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.28.12](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.11...v1.28.12) (2026-09-11)
+
+
+### Maintenance
+
+* **fleet:** add explicit inventory manifest ([#618](https://github.com/0xPlayerOne/code-foundry/issues/618)) ([0771878](https://github.com/0xPlayerOne/code-foundry/commit/077187817728f3d4eb40333b6e6d07fa533a9780))
+
+## [1.28.11](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.10...v1.28.11) (2026-09-11)
+
+
+### Bug Fixes
+
+* **fleet:** bound rendered jobs with timeouts and refresh stale runtime pins ([#616](https://github.com/0xPlayerOne/code-foundry/issues/616)) ([f8d20b4](https://github.com/0xPlayerOne/code-foundry/commit/f8d20b4ad48cddd20630ff9b7c1c21d0c5ac9520))
+
 ## [1.28.10](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.9...v1.28.10) (2026-09-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.10",
+  "version": "1.28.12",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1,6 +1,14 @@
 // @ts-check
 
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import {
@@ -321,6 +329,37 @@ function synchronize(options) {
     }
   }
 
+  // Preserved (repository-owned) workflows may reference the runtime directly,
+  // for example a hand-maintained Cloudflare preview caller. Advance their
+  // plain semver pins to the synced runtime ref so a stale hand-added pin
+  // cannot keep an old runtime alive after a fleet upgrade. Intentional refs
+  // (branch names, immutable SHAs) and other repositories' actions are left
+  // untouched, mirroring the config pin policy above.
+  if (!selfRepository && /^v\d+\.\d+\.\d+$/.test(runtimeRef)) {
+    const standard = new Set(standardFiles)
+    const workflowsDir = join(target, '.github/workflows')
+    if (existsSync(workflowsDir)) {
+      const runtimePin = new RegExp(
+        `(uses:\\s*${escapeRegExp(runtimeRepository)}/\\.github/(?:workflows|actions)/[^\\s@]+)@v\\d+\\.\\d+\\.\\d+`,
+        'g'
+      )
+      for (const entry of readdirSync(workflowsDir).toSorted()) {
+        if (!entry.endsWith('.yml') || standard.has(`.github/workflows/${entry}`)) continue
+        const destination = join(workflowsDir, entry)
+        const original = readFileSync(destination, 'utf8')
+        const updated = original.replace(runtimePin, `$1@${runtimeRef}`)
+        if (updated !== original) {
+          changed.push(`.github/workflows/${entry}`)
+          if (dryRun)
+            console.log(
+              `Would refresh the runtime pin in .github/workflows/${entry} to ${runtimeRef}.`
+            )
+          else writeOrReport(destination, updated, dryRun)
+        }
+      }
+    }
+  }
+
   // A repository that no longer opts into the staging-release topology must
   // not keep a generated staging promotion caller that would otherwise
   // linger dormant (it triggers on pushes to a branch that does not exist).