code-foundry 1.28.14 → 1.29.0

package/.github/actions/setup/action.yml

@@ -89,6 +89,15 @@ runs:
         if [ -f .github/code-foundry.yml ]; then
           configured_toolchain="$(awk -F': ' '/^toolchain:/ {print $2; exit}' .github/code-foundry.yml)"
           [ -n "$configured_toolchain" ] && toolchain="$configured_toolchain"
+          for flag in rust_sccache rust_nextest; do
+            if grep -Eq "^${flag}:\\s*[\"']?true[\"']?\\s*$" .github/code-foundry.yml; then
+              printf '%s=true\n' "$flag" >> "$GITHUB_OUTPUT"
+            else
+              printf '%s=false\n' "$flag" >> "$GITHUB_OUTPUT"
+            fi
+          done
+        else
+          printf 'rust_sccache=false\nrust_nextest=false\n' >> "$GITHUB_OUTPUT"
         fi
         if [ "$toolchain" = auto ] && [ -f .mise.toml ]; then
           toolchain=mise
@@ -746,6 +755,36 @@ runs:
         # primary saves but reuse a prior workflow's dependency artifacts.
         restore-keys: |
           ${{ runner.os }}-rust-build-v2-
+    # sccache is opt-in (`rust_sccache: true` in code-foundry.yml): it caches
+    # per-compilation objects keyed by content, so dependency artifacts
+    # survive Cargo.toml/Cargo.lock churn that busts the target/ cache above.
+    - name: Cache sccache artifacts
+      if: inputs.install == 'true' && inputs.install-rust == 'true' && steps.profile.outputs.rust == 'true' && steps.profile.outputs.rust_sccache == 'true'
+      uses: ./.github/actions/cache
+      with:
+        save: ${{ inputs.cache-save }}
+        path: ~/.cache/sccache
+        key: ${{ runner.os }}-rust-sccache-${{ github.workflow }}-${{ github.job }}-${{ hashFiles('rust-toolchain.toml', 'rust-toolchain', '.cargo/config*', '.mise.toml', 'mise.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-rust-sccache-
+    - name: Install sccache
+      if: inputs.install == 'true' && inputs.install-rust == 'true' && steps.profile.outputs.rust == 'true' && steps.profile.outputs.rust_sccache == 'true'
+      uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2
+      with:
+        tool: sccache
+    - name: Wrap rustc with sccache
+      if: inputs.install == 'true' && inputs.install-rust == 'true' && steps.profile.outputs.rust == 'true' && steps.profile.outputs.rust_sccache == 'true'
+      shell: bash
+      run: |
+        echo 'RUSTC_WRAPPER=sccache' >> "$GITHUB_ENV"
+        echo "SCCACHE_DIR=$HOME/.cache/sccache" >> "$GITHUB_ENV"
+    # cargo-nextest is opt-in (`rust_nextest: true`): the runtime uses
+    # `cargo nextest run` when the binary is present.
+    - name: Install cargo-nextest
+      if: inputs.install == 'true' && inputs.install-rust == 'true' && steps.profile.outputs.rust == 'true' && steps.profile.outputs.rust_nextest == 'true'
+      uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2
+      with:
+        tool: cargo-nextest
     - name: Setup
       if: ${{ steps.profile.outputs.mise_required == 'true' }}
       uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4

package/.github/workflows/ci.yml

@@ -78,9 +78,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run format >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           # Repository format scripts normally call a project-local formatter
@@ -93,13 +99,13 @@ jobs:
           task: format
       - name: Format
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci format
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/format.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -138,9 +144,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run lint >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: 'true'
@@ -148,13 +160,13 @@ jobs:
           task: lint
       - name: Lint
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci lint
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/lint.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -193,9 +205,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run type_check >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: 'true'
@@ -203,13 +221,13 @@ jobs:
           task: type_check
       - name: Type-Check
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/type_check.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -253,9 +271,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run build >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: 'true'
@@ -263,13 +287,13 @@ jobs:
           task: build
       - name: Build
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/build.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:

package/.github/workflows/codeql.yml

@@ -195,11 +195,17 @@ jobs:
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
+      # Analyze the pull request head, not the ephemeral merge ref. The
+      # codeql-action records commit_oid from `git rev-parse HEAD` on the
+      # checkout — the `sha` upload input is only a fallback when git is
+      # unavailable — so checking out the head is what actually keeps the
+      # recorded commit stable across mergeability evaluations.
       - name: Checkout
         if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       - name: Runtime
         if: ${{ matrix.entry.changed == true }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

package/.github/workflows/eval.yml

@@ -75,9 +75,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run eval >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           # Eval harnesses run through the repository's own package scripts and
@@ -87,13 +93,13 @@ jobs:
           task: eval
       - name: Eval
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci eval
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/eval.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:

package/.github/workflows/test.yml

@@ -92,9 +92,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile unit >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: true
@@ -110,13 +116,13 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci unit
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/unit.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -172,9 +178,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile performance >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: true
@@ -191,13 +203,13 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Performance
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci performance
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/performance.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -252,9 +264,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile integration >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: true
@@ -270,13 +288,13 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/integration.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -316,9 +334,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile e2e >> "$GITHUB_OUTPUT"
       - name: Cache browser binaries
-        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false' && steps.applicability.outputs.browser == 'true'
         uses: ./.github/actions/cache
         with:
           save: ${{ github.event_name == 'push' }}
@@ -330,7 +354,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-e2e-browsers-
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: true
@@ -346,13 +370,13 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci e2e
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/e2e.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -392,9 +416,15 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile smoke >> "$GITHUB_OUTPUT"
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         uses: ./.github/actions/setup
         with:
           install: true
@@ -410,13 +440,13 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
         id: execute
-        if: steps.applicability.outputs.applicable == 'true'
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci smoke
       - name: Retain task receipt
         if: >-
           always() &&
           (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
-          steps.applicability.outputs.applicable == 'false') &&
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
           hashFiles('.code-foundry/results/smoke.json') != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.29.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.15...v1.29.0) (2026-09-17)
+
+
+### Features
+
+* opt-in lane path filters, sccache, and nextest for Rust CI ([#626](https://github.com/0xPlayerOne/code-foundry/issues/626)) ([691ccad](https://github.com/0xPlayerOne/code-foundry/commit/691ccad529d88cde4ddd134b30cfb86988a1cb0a))
+
+## [1.28.15](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.14...v1.28.15) (2026-09-17)
+
+
+### Bug Fixes
+
+* **codeql:** analyze the pull request head commit ([#624](https://github.com/0xPlayerOne/code-foundry/issues/624)) ([ce05d1f](https://github.com/0xPlayerOne/code-foundry/commit/ce05d1f4f6c5df3a2d9134dd4657f478a265cb85))
+
 ## [1.28.14](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.13...v1.28.14) (2026-09-11)
 
 

package/docs/CONFIGURATION.md

@@ -105,6 +105,9 @@ See [Merge queue validation](merge-queues.md) before enabling it.
 | `coverage_minimum`        | `0`–`100`                                      | Minimum percentage; defaults to `80`.                                                                                                           |
 | `coverage_metrics`        | `lines`, `functions`, `branches`, `statements` | Metrics checked by the coverage gate.                                                                                                           |
 | `coverage_report`         | comma-separated repository paths               | Istanbul JSON summary or LCOV evidence files.                                                                                                   |
+| `filter_<task>`           | comma-separated repository path globs          | Skip a lane when no changed path matches; see [Lane path filters](#lane-path-filters).                                                          |
+| `rust_sccache`            | `true`, `false`                                | Install sccache and wrap rustc so compile artifacts survive manifest/lockfile churn.                                                            |
+| `rust_nextest`            | `true`, `false`                                | Install cargo-nextest and prefer `cargo nextest run` over `cargo test` in Rust test lanes.                                                      |
 
 Supported task capabilities are `format`, `lint`, `type_check`, `build`, `unit`,
 `integration`, `e2e`, `smoke`, `eval`, and `performance`. `coverage` is a policy
@@ -200,6 +203,34 @@ behavior:
 Use these controls only after measuring a repeatable benefit. See [Caching and
 remote caching](CACHING.md).
 
+## Lane path filters
+
+Validation lanes run their full suite by default. Repositories with clearly
+separated areas — for example a Rust workspace next to a web app — can opt any
+task lane into path filtering so a change that cannot affect the lane skips
+its setup and execution steps:
+
+```yaml
+filter_integration: 'src/**/*.py,tests/**,pyproject.toml,uv.lock'
+filter_eval: 'eval/**,crates/**,src/**'
+filter_e2e: 'apps/**,src/**'
+```
+
+`filter_<task>` accepts the same task names as `required_capabilities`. Globs
+are repo-relative: `**/` matches any directory depth, `*` stays inside one
+path segment, `?` matches one character, and a trailing `/` is shorthand for
+`dir/**`.
+
+The gate is fail-open by design: a task without a configured filter, a diff
+that cannot be resolved (shallow checkout edge, missing base ref), or an empty
+change set all keep the lane running. Paths are evaluated against
+`base...head` for pull requests and `before..after` for pushes; other events
+always run. Because filters only decide whether a lane _executes_, required
+checks stay green and the aggregate gate sees a normal success.
+
+Security lanes and CodeQL are never filterable: their coverage is structural,
+not change-scoped.
+
 ## Rust CodeQL tuning
 
 Rust CodeQL defaults to one full scan with one worker. Larger multi-crate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.14",
+  "version": "1.29.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/lib/task-filters.mjs

@@ -0,0 +1,143 @@
+// @ts-check
+
+import { execFileSync } from 'node:child_process'
+
+/**
+ * Tasks that support `filter_<task>` path filters in code-foundry.yml. A
+ * filter lists repo-relative globs; when every changed path misses the filter
+ * the lane reports `affected=false` and its workflow steps skip. CI lanes and
+ * security tasks are not filterable because their coverage is structural.
+ */
+export const FILTERABLE_TASKS = [
+  'format',
+  'lint',
+  'type_check',
+  'build',
+  'unit',
+  'integration',
+  'e2e',
+  'smoke',
+  'eval',
+  'performance',
+]
+
+/**
+ * Parse `filter_<task>` config keys into per-task glob lists.
+ * @param {Record<string, string>} config
+ * @returns {Map<string, string[]>}
+ */
+export function readTaskFilters(config) {
+  const filters = new Map()
+  for (const task of FILTERABLE_TASKS) {
+    const value = config[`filter_${task}`]
+    if (value === undefined || value === '') continue
+    const globs = value
+      .split(',')
+      .map((glob) => glob.trim())
+      .filter(Boolean)
+    if (globs.length > 0) filters.set(task, globs)
+  }
+  return filters
+}
+
+/**
+ * Compile a repo-relative glob to a RegExp. Supported syntax: double-star
+ * segments match any directory depth, `*` stays inside a path segment, `?`
+ * matches one character, and a trailing `/` is a directory shorthand.
+ * @param {string} glob
+ * @returns {RegExp}
+ */
+export function globToRegExp(glob) {
+  let pattern = glob.replace(/^\.\//, '')
+  if (pattern.endsWith('/')) pattern += '**'
+  let regex = '^'
+  let index = 0
+  while (index < pattern.length) {
+    if (pattern.startsWith('**/', index)) {
+      regex += '(?:[^/]+/)*'
+      index += 3
+    } else if (pattern.startsWith('/**', index) && index + 3 === pattern.length) {
+      regex += '/.*'
+      index += 3
+    } else if (pattern.startsWith('**', index)) {
+      regex += '.*'
+      index += 2
+    } else if (pattern[index] === '*') {
+      regex += '[^/]*'
+      index += 1
+    } else if (pattern[index] === '?') {
+      regex += '[^/]'
+      index += 1
+    } else {
+      regex += pattern[index].replace(/[.+^${}()|[\]\\]/g, '\\$&')
+      index += 1
+    }
+  }
+  return new RegExp(`${regex}$`)
+}
+
+/**
+ * Resolve the pull request or push change set. The generated Detect steps
+ * pass EVENT_NAME plus BASE_REF/BASE_SHA/HEAD_SHA (pull_request) or
+ * BEFORE_SHA/HEAD_SHA (push). Returns null when the change set cannot be
+ * resolved; callers treat null as fail-open so a checkout edge never skips a
+ * required lane.
+ * @param {string} root
+ * @param {Record<string, string | undefined>} env
+ * @returns {string[] | null}
+ */
+export function resolveChangedPaths(root, env = process.env) {
+  const event = env.EVENT_NAME
+  let range = null
+  try {
+    if (event === 'pull_request' || event === 'pull_request_target') {
+      const baseRef = env.BASE_REF
+      const baseSha = env.BASE_SHA
+      const head = env.HEAD_SHA || 'HEAD'
+      if (!baseSha) return null
+      if (baseRef) {
+        execFileSync('git', ['fetch', '--no-tags', '--depth=100', 'origin', baseRef], {
+          cwd: root,
+          stdio: 'pipe',
+        })
+        range = `FETCH_HEAD...${head}`
+      } else {
+        range = `${baseSha}...${head}`
+      }
+    } else if (event === 'push') {
+      const before = env.BEFORE_SHA
+      const head = env.HEAD_SHA || 'HEAD'
+      if (!before || /^0+$/.test(before)) return null
+      range = `${before}..${head}`
+    } else {
+      return null
+    }
+    const output = execFileSync('git', ['diff', '--name-only', range], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    return output
+      .split('\n')
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0)
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Report whether a task's configured path filter matches the change set.
+ * Fail-open by contract: no filter, no resolvable diff, or an empty diff all
+ * keep the lane running.
+ * @param {string} task
+ * @param {Map<string, string[]>} filters
+ * @param {string[] | null} paths
+ * @returns {boolean}
+ */
+export function taskAffected(task, filters, paths) {
+  const globs = filters.get(task)
+  if (!globs || globs.length === 0 || paths === null || paths.length === 0) return true
+  const matchers = globs.map(globToRegExp)
+  return paths.some((path) => matchers.some((matcher) => matcher.test(path)))
+}

package/src/runtime-core.mjs

@@ -15,6 +15,7 @@ import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
 import { configured, readConfig } from './lib/config.mjs'
 import { classifyTestFiles } from './lib/test-discovery.mjs'
 import { docsOnlyPullRequest } from './lib/docs-only.mjs'
+import { readTaskFilters, resolveChangedPaths, taskAffected } from './lib/task-filters.mjs'
 import { classifyValidationMode, evaluateValidationGate } from './lib/validation-policy.mjs'
 import { readReleaseConfig, validateGeneratedReleaseDiff } from './lib/release-policy.mjs'
 import { runNodePackagePerformance } from './lib/node-package-performance.mjs'
@@ -688,6 +689,15 @@ function ci(task) {
   if (task === 'should_run' || task === 'task_profile') {
     const selected = process.argv[4]
     writeOutput('applicable', relevant(selected) ? 'true' : 'false')
+    // Path-filtered lanes are opt-in via `filter_<task>` config keys. The
+    // gate fails open: no filter, an unresolvable diff, or an empty change
+    // set all keep the lane running.
+    writeOutput(
+      'affected',
+      taskAffected(selected ?? '', readTaskFilters(config), resolveChangedPaths(root))
+        ? 'true'
+        : 'false'
+    )
     writeOutput(
       'javascript',
       hasLanguage('typescript') || hasLanguage('javascript') ? 'true' : 'false'
@@ -784,9 +794,14 @@ function ci(task) {
   }
 
   if (hasLanguage('rust') && hasRootRustProject()) {
+    // `rust_nextest` opts into process-per-test parallelism. cargo-nextest
+    // accepts the same --lib/--bin/--test target flags as `cargo test`.
+    const nextest =
+      configured(config.rust_nextest, 'false') === 'true' && commandExists('cargo-nextest')
+    const testArgs = nextest ? ['nextest', 'run'] : ['test']
     if (task === 'unit') {
       // Batch exact prior targets through one Cargo graph.
-      const args = ['test']
+      const args = [...testArgs]
       if (existsSync(resolve(root, 'src/lib.rs'))) args.push('--lib')
       if (existsSync(resolve(root, 'src/main.rs'))) args.push('--bin', packageName())
       run('cargo', args)
@@ -796,7 +811,7 @@ function ci(task) {
         const match = file.match(/^tests\/(.+)\.rs$/)
         return match && !match[1].includes('/') ? ['--test', match[1]] : []
       })
-      if (targets.length > 0) run('cargo', ['test', ...targets])
+      if (targets.length > 0) run('cargo', [...testArgs, ...targets])
     }
   }
 }

package/src/runtime.mjs

@@ -42,6 +42,7 @@ export function taskProfile(root, task, entry = core) {
     throw new Error(`Task discovery returned no applicability: ${task}`)
   return {
     ...describeTask(root, task, profile),
+    affected: profile.affected ?? 'true',
     javascript: profile.javascript ?? 'false',
     python: profile.python ?? 'false',
     rust: profile.rust ?? 'false',
@@ -110,6 +111,24 @@ export function runRuntime(args, root = process.cwd(), entry = core) {
       (name) => name !== 'coverage' && name !== selected
     ))
       taskProfile(root, requiredName, entry)
+    // A path-filtered lane that misses the diff still leaves a receipt so the
+    // run records why its steps skipped.
+    if (profile.applicable && profile.affected === 'false') {
+      const now = new Date().toISOString()
+      saveResult(root, selected, {
+        schemaVersion: 1,
+        kind: 'code-foundry-task-result',
+        task: selected,
+        sourceSha: sourceSha(root),
+        startedAt: now,
+        completedAt: now,
+        status: 'skipped',
+        reason: 'no changed path matched the task filter',
+        required: false,
+        commands: [],
+        artifacts: [],
+      })
+    }
     if (!profile.applicable) {
       const now = new Date().toISOString()
       saveResult(root, selected, {
@@ -128,6 +147,7 @@ export function runRuntime(args, root = process.cwd(), entry = core) {
     }
     for (const [key, value] of Object.entries({
       applicable: String(profile.applicable),
+      affected: profile.affected ?? 'true',
       javascript: profile.javascript ?? 'false',
       python: profile.python ?? 'false',
       rust: profile.rust ?? 'false',