code-foundry 1.28.12 → 1.28.14

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.28.14](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.13...v1.28.14) (2026-09-11)
+
+
+### Bug Fixes
+
+* **sync:** accept mixed broad and scoped CodeQL Rust shards ([#621](https://github.com/0xPlayerOne/code-foundry/issues/621)) ([f13c5a7](https://github.com/0xPlayerOne/code-foundry/commit/f13c5a734a1b24ee75566bab3b778052a28ada99))
+
+## [1.28.13](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.12...v1.28.13) (2026-09-11)
+
+
+### Bug Fixes
+
+* **fleet:** accept base-config evidence for merged rollouts ([#620](https://github.com/0xPlayerOne/code-foundry/issues/620)) ([394c528](https://github.com/0xPlayerOne/code-foundry/commit/394c528a137617ce2c4464436dbc6068349a0c54))
+
 ## [1.28.12](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.11...v1.28.12) (2026-09-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.12",
+  "version": "1.28.14",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1017,9 +1017,10 @@ function validateRustCodeqlConfig(config) {
       }
     }
   }
-  if (seen.has('all') && shards.length !== 1) {
-    throw new Error('Invalid codeql_rust_shards; "all" cannot be combined with scoped shards.')
-  }
+  // "all" combined with scoped shards is a deliberate consumer strategy: the
+  // broad pass keeps the workspace-level SARIF category reporting while the
+  // scoped shards add per-manifest detail. The renderer forwards the same
+  // list to every lane, so lane parity holds regardless of the combination.
   return { shards: JSON.stringify(shards), threads, maxParallel }
 }
 

package/src/lib/fleet-manifest.mjs

@@ -286,6 +286,21 @@ export function verifiedPullRequest(pr, required) {
   )
 }
 
+/**
+ * Evidence that a merged rollout actually landed. Gate rollup evidence is the
+ * normal path, but repositories without a required-check policy can merge
+ * through auto-merge before their checks complete, so a merged PR whose base
+ * configuration already matches the declared rollout is accepted with weaker
+ * `base-config` evidence instead of deadlocking the cohort forever.
+ * @param {any} pr @param {string[]} required @param {boolean} baseConfigMatches
+ * @returns {'gates'|'base-config'|null}
+ */
+export function rolloutEvidence(pr, required, baseConfigMatches) {
+  if (!pr || pr.state !== 'MERGED') return null
+  if (verifiedPullRequest(pr, required)) return 'gates'
+  return baseConfigMatches ? 'base-config' : null
+}
+
 /** @param {any} check */
 function checkState(check) {
   return check.status === 'COMPLETED' ? check.conclusion : (check.state ?? check.status)
@@ -339,8 +354,9 @@ function inspectRollout(run, path, entry, version, base) {
     if (!remoteHead || pr.headRefOid !== remoteHead)
       throw new Error('Existing pull request head no longer matches its remote branch')
   }
-  let complete = verifiedPullRequest(pr, entry.requiredChecks)
-  if (complete) {
+  let complete = false
+  let evidence = null
+  if (pr?.state === 'MERGED') {
     const response = JSON.parse(
       checked(run, path, [
         'gh',
@@ -351,9 +367,11 @@ function inspectRollout(run, path, entry, version, base) {
     if (response.encoding !== 'base64' || typeof response.content !== 'string')
       throw new Error('Unable to verify merged runtime configuration')
     const config = scalarConfig(Buffer.from(response.content, 'base64').toString('utf8'))
-    complete = config.runtime_ref === version && configDrift(config, entry).length === 0
+    const configMatches = config.runtime_ref === version && configDrift(config, entry).length === 0
+    evidence = rolloutEvidence(pr, entry.requiredChecks, configMatches)
+    complete = evidence !== null
   }
-  return { ...identity, pr, complete }
+  return { ...identity, pr, complete, evidence }
 }
 
 /** @param {Runner} run @param {string} path @param {string[]} files */
@@ -606,7 +624,12 @@ export function upgradeManifestFleet(root, source, options, sync, run = executeF
         const rollout = inspectRollout(run, item.path, entry, options.version, base)
         if (rollout.complete) {
           completed += 1
-          report.push({ ...record, status: 'verified-merged', pullRequest: rollout.pr.url })
+          report.push({
+            ...record,
+            status: 'verified-merged',
+            evidence: rollout.evidence,
+            pullRequest: rollout.pr.url,
+          })
           continue
         }
         if (rollout.pr) {

package/src/lib/merge-queue.mjs

@@ -96,10 +96,10 @@ export function renderMergeQueueCaller(config, ref) {
       )
     }
   }
-  ensure(
-    !(seen.has('all') && shards.length !== 1),
-    'Invalid codeql_rust_shards; "all" cannot be combined with scoped shards.'
-  )
+  // "all" combined with scoped shards is a deliberate consumer strategy: the
+  // broad pass keeps the workspace-level SARIF category reporting while the
+  // scoped shards add per-manifest detail. The renderer forwards the same
+  // list to every lane, so lane parity holds regardless of the combination.
   return `${QUEUE_MARKER}name: Merge Queue
 
 on: