code-foundry 1.28.7 → 1.28.9

package/.github/workflows/cloudflare-deploy.yml

@@ -319,12 +319,13 @@ jobs:
           set -euo pipefail
           state=failure
           if [ "$JOB_STATUS" = success ]; then state=success; fi
-          args=(-f "state=$state" -F auto_inactive=false)
           # Preview environments are persistent per application. Once a new
           # preview succeeds, retire the previous successful preview record;
           # failed previews must not take a working preview offline.
+          auto_inactive=false
           if [ "$MODE" = preview ] && [ "$state" = success ]; then
-            args+=(-F auto_inactive=true)
+            auto_inactive=true
           fi
+          args=(-f "state=$state" -F "auto_inactive=$auto_inactive")
           if [ -n "$DEPLOY_URL" ]; then args+=(-f "environment_url=$DEPLOY_URL"); fi
           gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$DEPLOYMENT_ID/statuses" "${args[@]}" --silent

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.28.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.8...v1.28.9) (2026-09-11)
+
+
+### Bug Fixes
+
+* **sync:** render the configured Rust shards into every CodeQL lane ([#612](https://github.com/0xPlayerOne/code-foundry/issues/612)) ([4e7eb2f](https://github.com/0xPlayerOne/code-foundry/commit/4e7eb2f03ba34b4fe459e8ce302bcbf3303b26cc))
+
+## [1.28.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.7...v1.28.8) (2026-09-11)
+
+
+### Bug Fixes
+
+* **deploy:** send auto_inactive once when completing a deployment status ([#610](https://github.com/0xPlayerOne/code-foundry/issues/610)) ([9951887](https://github.com/0xPlayerOne/code-foundry/commit/99518875f584e08cbd2b52759f13fc6065bcd1c5))
+
 ## [1.28.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.6...v1.28.7) (2026-09-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.7",
+  "version": "1.28.9",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -733,14 +733,23 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       if (!value) continue
       rendered = rendered.replace(new RegExp(`^(\\s+${input}:)\\s+.*$`, 'm'), `$1 ${value}`)
     }
-    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/m, `$1 '${rustCodeql.shards}'`)
-    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/m, `$1 '${rustCodeql.threads}'`)
-    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/m, `$1 ${rustCodeql.maxParallel}`)
+    // Every Rust CodeQL lane in the caller must carry the configured shard
+    // list. A SARIF category is derived from the shard string, so a caller that
+    // renders the configuration into the pull-request lane while a second lane
+    // keeps the template literal makes the two lanes report disjoint
+    // categories. The default-branch baseline then never matches the pull
+    // request, and the code-scanning gate stalls every merge while every
+    // required check passes. Shards partition one scan, so the same list is
+    // correct in both lanes: `["all"]` stays a single pass, and a real shard
+    // list splits the same work in both places.
+    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/gm, `$1 '${rustCodeql.shards}'`)
+    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/gm, `$1 '${rustCodeql.threads}'`)
+    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/gm, `$1 ${rustCodeql.maxParallel}`)
   }
   if (workflow === 'codeql') {
-    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/m, `$1 '${rustCodeql.shards}'`)
-    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/m, `$1 '${rustCodeql.threads}'`)
-    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/m, `$1 ${rustCodeql.maxParallel}`)
+    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/gm, `$1 '${rustCodeql.shards}'`)
+    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/gm, `$1 '${rustCodeql.threads}'`)
+    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/gm, `$1 ${rustCodeql.maxParallel}`)
   }
   if (workflow === 'opencode-security') {
     const model = configured(config.opencode_security_model, '').trim()