code-foundry 1.28.13 → 1.28.15

package/.github/workflows/codeql.yml

@@ -195,11 +195,17 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
+      # Analyze the pull request head, not the ephemeral merge ref. The
+      # codeql-action records commit_oid from `git rev-parse HEAD` on the
+      # checkout — the `sha` upload input is only a fallback when git is
+      # unavailable — so checking out the head is what actually keeps the
+      # recorded commit stable across mergeability evaluations.
       - name: Checkout
         if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Runtime
         if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.28.15](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.14...v1.28.15) (2026-09-17)
+
+
+### Bug Fixes
+
+* **codeql:** analyze the pull request head commit ([#624](https://github.com/0xPlayerOne/code-foundry/issues/624)) ([ce05d1f](https://github.com/0xPlayerOne/code-foundry/commit/ce05d1f4f6c5df3a2d9134dd4657f478a265cb85))
+
+## [1.28.14](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.13...v1.28.14) (2026-09-11)
+
+
+### Bug Fixes
+
+* **sync:** accept mixed broad and scoped CodeQL Rust shards ([#621](https://github.com/0xPlayerOne/code-foundry/issues/621)) ([f13c5a7](https://github.com/0xPlayerOne/code-foundry/commit/f13c5a734a1b24ee75566bab3b778052a28ada99))
+
 ## [1.28.13](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.12...v1.28.13) (2026-09-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.13",
+  "version": "1.28.15",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1017,9 +1017,10 @@ function validateRustCodeqlConfig(config) {
       }
     }
   }
-  if (seen.has('all') && shards.length !== 1) {
-    throw new Error('Invalid codeql_rust_shards; "all" cannot be combined with scoped shards.')
-  }
+  // "all" combined with scoped shards is a deliberate consumer strategy: the
+  // broad pass keeps the workspace-level SARIF category reporting while the
+  // scoped shards add per-manifest detail. The renderer forwards the same
+  // list to every lane, so lane parity holds regardless of the combination.
   return { shards: JSON.stringify(shards), threads, maxParallel }
 }
 

package/src/lib/merge-queue.mjs

@@ -96,10 +96,10 @@ export function renderMergeQueueCaller(config, ref) {
       )
     }
   }
-  ensure(
-    !(seen.has('all') && shards.length !== 1),
-    'Invalid codeql_rust_shards; "all" cannot be combined with scoped shards.'
-  )
+  // "all" combined with scoped shards is a deliberate consumer strategy: the
+  // broad pass keeps the workspace-level SARIF category reporting while the
+  // scoped shards add per-manifest detail. The renderer forwards the same
+  // list to every lane, so lane parity holds regardless of the combination.
   return `${QUEUE_MARKER}name: Merge Queue
 
 on: