code-foundry 1.28.9 → 1.28.10

package/.github/workflows/draft-pr_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Draft PR
 
 on:
   push:

package/.github/workflows/opencode-security_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Security
 
 on:
   pull_request:

package/.github/workflows/release-pr_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Promotion
 
 on:
   push:

package/.github/workflows/release_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Release
 
 on:
   push:

package/.github/workflows/validation_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Validation
 
 on:
   push:

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.28.10](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.9...v1.28.10) (2026-09-11)
+
+
+### Bug Fixes
+
+* **ci:** dedupe caller names and keep CodeQL Rust shards aligned ([#613](https://github.com/0xPlayerOne/code-foundry/issues/613)) ([8000e5e](https://github.com/0xPlayerOne/code-foundry/commit/8000e5e152ccc7e657933b55eb5b82a278762176))
+
 ## [1.28.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.8...v1.28.9) (2026-09-11)
 
 

package/docs/CONFIGURATION.md

@@ -215,6 +215,24 @@ Each shard must contain tracked Rust source. Absolute paths, parent traversal,
 duplicates, empty scopes, and more than eight shards are rejected. Use
 `["all"]` when complete, non-overlapping source scopes are not available.
 
+Every lane rendered from this configuration (pull-request validation, the
+default-branch scan, the scheduled audit, and merge queues) receives the same
+shard list, and the CodeQL Detect job fails closed when caller workflows drift
+apart. Keep them aligned: each shard uploads a SARIF category keyed by a hash
+of the shard scope, GitHub code scanning baselines every category it has seen
+on the default branch, and the code-scanning merge gate waits for results in
+every tracked category. Two practical consequences:
+
+- Treat `codeql_rust_shards` as add-only while the gate tracks categories.
+  Removing a shard orphans its category on the default branch, and pull
+  requests then stall on "Code scanning is still expecting N results" until
+  the category is covered again.
+- To retire a category for real, delete its code-scanning analyses (Code
+  security → Code scanning → analyses, or the code-scanning analysis
+  deletion API) after removing the shard, then re-run `sync`. Covering retired
+  categories in the shard list keeps the gate green but re-runs their analysis
+  on every pull request and is not a substitute for cleanup.
+
 ## Cloudflare Workers
 
 Repositories that deploy to Cloudflare Workers can use the opt-in verified

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.9",
+  "version": "1.28.10",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1003,7 +1003,12 @@ function escapeRegExp(value) {
  */
 export function isGeneratedEventCaller(content, stem, runtimeRepository) {
   const text = Buffer.isBuffer(content) ? content.toString('utf8') : String(content)
-  if (!/^name:\s*Code Foundry\s*$/m.test(text)) return false
+  // Generated callers carried the shared display name "Code Foundry" before
+  // issue 609 gave each caller a unique name; both renders must stay
+  // recognizable so a topology switch can still prune stale promotion callers.
+  const names = ['Code Foundry', ...(stem === 'release-pr' ? ['Code Foundry Promotion'] : [])]
+  if (!names.some((name) => new RegExp(`^name:\\s*${escapeRegExp(name)}\\s*$`, 'm').test(text)))
+    return false
   if (/^\s*(runs-on|steps):/m.test(text)) return false
   // Older generated staging-promotion callers predate the explicit runtime
   // repository input. They are still safe to identify structurally by their

package/src/runtime-core.mjs

@@ -1,7 +1,14 @@
 #!/usr/bin/env node
 // @ts-check
 
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs'
 import { resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
@@ -880,6 +887,75 @@ function isPublicRepository() {
   return visibility ? visibility === 'public' : process.env.REPO_FOUNDRY_PRIVATE !== 'true'
 }
 
+/** Split a workflow file's `jobs:` entries into [job id, block text] pairs.
+ * Caller files are re-parsed here instead of trusting the sync renderer so
+ * hand-edited or stale generated callers are still validated at run time.
+ * @param {string} text @returns {Array<[string, string]>}
+ */
+function workflowJobBlocks(text) {
+  const lines = text.split('\n')
+  /** @type {Array<[string, string]>} */
+  const blocks = []
+  let index = 0
+  while (index < lines.length) {
+    const match = lines[index].match(/^  ([A-Za-z0-9_-]+):\s*$/)
+    if (!match) {
+      index += 1
+      continue
+    }
+    const start = index
+    index += 1
+    while (index < lines.length && !/^  [A-Za-z0-9_-]+:\s*$/.test(lines[index])) index += 1
+    blocks.push([match[1], lines.slice(start, index).join('\n')])
+  }
+  return blocks
+}
+
+/**
+ * The Rust SARIF category embeds a hash of each shard scope, and GitHub code
+ * scanning baselines every category it has seen on the default branch: when
+ * two lanes calling the CodeQL workflow report different shard sets, each
+ * lane uploads categories the other never produces and the code-scanning
+ * merge gate waits forever (issue 609). Fail closed before any analysis runs.
+ */
+function assertRustShardsAligned() {
+  const directory = resolve(root, '.github/workflows')
+  if (!existsSync(directory)) return
+  /** @type {Map<string, string>} */
+  const lanes = new Map()
+  for (const file of readdirSync(directory)
+    .filter((name) => name.endsWith('.yml'))
+    .toSorted()) {
+    for (const [job, block] of workflowJobBlocks(readFileSync(resolve(directory, file), 'utf8'))) {
+      // Every lane that ultimately runs CodeQL analysis counts: direct
+      // codeql.yml callers and callers of the validation orchestrators whose
+      // rust-shards input flows through to the analysis matrix.
+      if (!/^\s+uses:\s*\S*\/(codeql|validation|validation-no-codeql)\.yml(@\S+)?\s*$/m.test(block))
+        continue
+      const raw = block.match(/^\s+rust-shards:\s*(.+?)\s*$/m)?.[1] ?? '["all"]'
+      // Unresolved caller expressions cannot be evaluated here; the literal
+      // shard list of the workflow that passes them is what gets compared.
+      if (raw.includes('${{')) continue
+      let shards = raw.replace(/^['"]|['"]$/g, '')
+      try {
+        shards = JSON.stringify(JSON.parse(shards).toSorted())
+      } catch {
+        // Compare unparsable values verbatim; alignment still fails loudly.
+      }
+      lanes.set(`${file} (${job})`, shards)
+    }
+  }
+  const distinct = new Set(lanes.values())
+  if (distinct.size <= 1) return
+  const detail = [...lanes].map(([lane, shards]) => `${lane}: ${shards}`).join(', ')
+  throw new Error(
+    `Rust CodeQL shard sets drift between lanes calling codeql.yml (${detail}). ` +
+      'GitHub code scanning tracks every uploaded category, so every lane must pass the same rust-shards list. ' +
+      'Re-render the callers with `npx code-foundry sync`, keep codeql_rust_shards aligned across callers, and retire ' +
+      'removed categories by deleting their code-scanning analyses (see docs/CONFIGURATION.md).'
+  )
+}
+
 function codeql() {
   const enabled =
     featureEnabled('codeql') &&
@@ -894,6 +970,9 @@ function codeql() {
     }
     return
   }
+  // Detect lane drift before any analysis uploads a category the other lanes
+  // never produce; a stall surfaces only later as a blocked merge gate.
+  assertRustShardsAligned()
   const available = []
   if (existsSync(resolve(root, '.github/workflows'))) available.push('actions')
   if (hasLanguage('typescript') || hasLanguage('javascript'))