code-foundry 1.28.8 → 1.28.9

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.28.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.8...v1.28.9) (2026-09-11)
+
+
+### Bug Fixes
+
+* **sync:** render the configured Rust shards into every CodeQL lane ([#612](https://github.com/0xPlayerOne/code-foundry/issues/612)) ([4e7eb2f](https://github.com/0xPlayerOne/code-foundry/commit/4e7eb2f03ba34b4fe459e8ce302bcbf3303b26cc))
+
 ## [1.28.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.7...v1.28.8) (2026-09-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.8",
+  "version": "1.28.9",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -733,14 +733,23 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       if (!value) continue
       rendered = rendered.replace(new RegExp(`^(\\s+${input}:)\\s+.*$`, 'm'), `$1 ${value}`)
     }
-    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/m, `$1 '${rustCodeql.shards}'`)
-    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/m, `$1 '${rustCodeql.threads}'`)
-    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/m, `$1 ${rustCodeql.maxParallel}`)
+    // Every Rust CodeQL lane in the caller must carry the configured shard
+    // list. A SARIF category is derived from the shard string, so a caller that
+    // renders the configuration into the pull-request lane while a second lane
+    // keeps the template literal makes the two lanes report disjoint
+    // categories. The default-branch baseline then never matches the pull
+    // request, and the code-scanning gate stalls every merge while every
+    // required check passes. Shards partition one scan, so the same list is
+    // correct in both lanes: `["all"]` stays a single pass, and a real shard
+    // list splits the same work in both places.
+    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/gm, `$1 '${rustCodeql.shards}'`)
+    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/gm, `$1 '${rustCodeql.threads}'`)
+    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/gm, `$1 ${rustCodeql.maxParallel}`)
   }
   if (workflow === 'codeql') {
-    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/m, `$1 '${rustCodeql.shards}'`)
-    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/m, `$1 '${rustCodeql.threads}'`)
-    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/m, `$1 ${rustCodeql.maxParallel}`)
+    rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/gm, `$1 '${rustCodeql.shards}'`)
+    rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/gm, `$1 '${rustCodeql.threads}'`)
+    rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/gm, `$1 ${rustCodeql.maxParallel}`)
   }
   if (workflow === 'opencode-security') {
     const model = configured(config.opencode_security_model, '').trim()