code-foundry 1.28.9 → 1.28.11

package/.github/workflows/ci.yml

@@ -53,6 +53,7 @@ jobs:
     name: Format
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -112,6 +113,7 @@ jobs:
     name: Lint
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -166,6 +168,7 @@ jobs:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -220,6 +223,7 @@ jobs:
     name: Build
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     env:
       # Framework builds may validate server-side configuration at build time.
       # Consumers can provide the real value; the fallback is intentionally

package/.github/workflows/draft-pr_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Draft PR
 
 on:
   push:

package/.github/workflows/eval.yml

@@ -50,6 +50,7 @@ jobs:
     name: Eval
     if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

package/.github/workflows/opencode-security_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Security
 
 on:
   pull_request:
@@ -16,6 +16,7 @@ jobs:
     name: OpenCode Security / Detect
     if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
     runs-on: ubuntu-slim
+    timeout-minutes: 10
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}
       token: ${{ steps.detect.outputs.token }}

package/.github/workflows/release-pr_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Promotion
 
 on:
   push:

package/.github/workflows/release_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Release
 
 on:
   push:

package/.github/workflows/validation_self-ci.yml

@@ -1,4 +1,4 @@
-name: Code Foundry
+name: Code Foundry Validation
 
 on:
   push:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.28.11](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.10...v1.28.11) (2026-09-11)
+
+
+### Bug Fixes
+
+* **fleet:** bound rendered jobs with timeouts and refresh stale runtime pins ([#616](https://github.com/0xPlayerOne/code-foundry/issues/616)) ([f8d20b4](https://github.com/0xPlayerOne/code-foundry/commit/f8d20b4ad48cddd20630ff9b7c1c21d0c5ac9520))
+
+## [1.28.10](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.9...v1.28.10) (2026-09-11)
+
+
+### Bug Fixes
+
+* **ci:** dedupe caller names and keep CodeQL Rust shards aligned ([#613](https://github.com/0xPlayerOne/code-foundry/issues/613)) ([8000e5e](https://github.com/0xPlayerOne/code-foundry/commit/8000e5e152ccc7e657933b55eb5b82a278762176))
+
 ## [1.28.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.8...v1.28.9) (2026-09-11)
 
 

package/docs/CONFIGURATION.md

@@ -215,6 +215,24 @@ Each shard must contain tracked Rust source. Absolute paths, parent traversal,
 duplicates, empty scopes, and more than eight shards are rejected. Use
 `["all"]` when complete, non-overlapping source scopes are not available.
 
+Every lane rendered from this configuration (pull-request validation, the
+default-branch scan, the scheduled audit, and merge queues) receives the same
+shard list, and the CodeQL Detect job fails closed when caller workflows drift
+apart. Keep them aligned: each shard uploads a SARIF category keyed by a hash
+of the shard scope, GitHub code scanning baselines every category it has seen
+on the default branch, and the code-scanning merge gate waits for results in
+every tracked category. Two practical consequences:
+
+- Treat `codeql_rust_shards` as add-only while the gate tracks categories.
+  Removing a shard orphans its category on the default branch, and pull
+  requests then stall on "Code scanning is still expecting N results" until
+  the category is covered again.
+- To retire a category for real, delete its code-scanning analyses (Code
+  security → Code scanning → analyses, or the code-scanning analysis
+  deletion API) after removing the shard, then re-run `sync`. Covering retired
+  categories in the shard list keeps the gate green but re-runs their analysis
+  on every pull request and is not a substitute for cleanup.
+
 ## Cloudflare Workers
 
 Repositories that deploy to Cloudflare Workers can use the opt-in verified

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.9",
+  "version": "1.28.11",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1,6 +1,14 @@
 // @ts-check
 
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import {
@@ -321,6 +329,37 @@ function synchronize(options) {
     }
   }
 
+  // Preserved (repository-owned) workflows may reference the runtime directly,
+  // for example a hand-maintained Cloudflare preview caller. Advance their
+  // plain semver pins to the synced runtime ref so a stale hand-added pin
+  // cannot keep an old runtime alive after a fleet upgrade. Intentional refs
+  // (branch names, immutable SHAs) and other repositories' actions are left
+  // untouched, mirroring the config pin policy above.
+  if (!selfRepository && /^v\d+\.\d+\.\d+$/.test(runtimeRef)) {
+    const standard = new Set(standardFiles)
+    const workflowsDir = join(target, '.github/workflows')
+    if (existsSync(workflowsDir)) {
+      const runtimePin = new RegExp(
+        `(uses:\\s*${escapeRegExp(runtimeRepository)}/\\.github/(?:workflows|actions)/[^\\s@]+)@v\\d+\\.\\d+\\.\\d+`,
+        'g'
+      )
+      for (const entry of readdirSync(workflowsDir).toSorted()) {
+        if (!entry.endsWith('.yml') || standard.has(`.github/workflows/${entry}`)) continue
+        const destination = join(workflowsDir, entry)
+        const original = readFileSync(destination, 'utf8')
+        const updated = original.replace(runtimePin, `$1@${runtimeRef}`)
+        if (updated !== original) {
+          changed.push(`.github/workflows/${entry}`)
+          if (dryRun)
+            console.log(
+              `Would refresh the runtime pin in .github/workflows/${entry} to ${runtimeRef}.`
+            )
+          else writeOrReport(destination, updated, dryRun)
+        }
+      }
+    }
+  }
+
   // A repository that no longer opts into the staging-release topology must
   // not keep a generated staging promotion caller that would otherwise
   // linger dormant (it triggers on pushes to a branch that does not exist).
@@ -1003,7 +1042,12 @@ function escapeRegExp(value) {
  */
 export function isGeneratedEventCaller(content, stem, runtimeRepository) {
   const text = Buffer.isBuffer(content) ? content.toString('utf8') : String(content)
-  if (!/^name:\s*Code Foundry\s*$/m.test(text)) return false
+  // Generated callers carried the shared display name "Code Foundry" before
+  // issue 609 gave each caller a unique name; both renders must stay
+  // recognizable so a topology switch can still prune stale promotion callers.
+  const names = ['Code Foundry', ...(stem === 'release-pr' ? ['Code Foundry Promotion'] : [])]
+  if (!names.some((name) => new RegExp(`^name:\\s*${escapeRegExp(name)}\\s*$`, 'm').test(text)))
+    return false
   if (/^\s*(runs-on|steps):/m.test(text)) return false
   // Older generated staging-promotion callers predate the explicit runtime
   // repository input. They are still safe to identify structurally by their

package/src/runtime-core.mjs

@@ -1,7 +1,14 @@
 #!/usr/bin/env node
 // @ts-check
 
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs'
 import { resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
@@ -880,6 +887,75 @@ function isPublicRepository() {
   return visibility ? visibility === 'public' : process.env.REPO_FOUNDRY_PRIVATE !== 'true'
 }
 
+/** Split a workflow file's `jobs:` entries into [job id, block text] pairs.
+ * Caller files are re-parsed here instead of trusting the sync renderer so
+ * hand-edited or stale generated callers are still validated at run time.
+ * @param {string} text @returns {Array<[string, string]>}
+ */
+function workflowJobBlocks(text) {
+  const lines = text.split('\n')
+  /** @type {Array<[string, string]>} */
+  const blocks = []
+  let index = 0
+  while (index < lines.length) {
+    const match = lines[index].match(/^  ([A-Za-z0-9_-]+):\s*$/)
+    if (!match) {
+      index += 1
+      continue
+    }
+    const start = index
+    index += 1
+    while (index < lines.length && !/^  [A-Za-z0-9_-]+:\s*$/.test(lines[index])) index += 1
+    blocks.push([match[1], lines.slice(start, index).join('\n')])
+  }
+  return blocks
+}
+
+/**
+ * The Rust SARIF category embeds a hash of each shard scope, and GitHub code
+ * scanning baselines every category it has seen on the default branch: when
+ * two lanes calling the CodeQL workflow report different shard sets, each
+ * lane uploads categories the other never produces and the code-scanning
+ * merge gate waits forever (issue 609). Fail closed before any analysis runs.
+ */
+function assertRustShardsAligned() {
+  const directory = resolve(root, '.github/workflows')
+  if (!existsSync(directory)) return
+  /** @type {Map<string, string>} */
+  const lanes = new Map()
+  for (const file of readdirSync(directory)
+    .filter((name) => name.endsWith('.yml'))
+    .toSorted()) {
+    for (const [job, block] of workflowJobBlocks(readFileSync(resolve(directory, file), 'utf8'))) {
+      // Every lane that ultimately runs CodeQL analysis counts: direct
+      // codeql.yml callers and callers of the validation orchestrators whose
+      // rust-shards input flows through to the analysis matrix.
+      if (!/^\s+uses:\s*\S*\/(codeql|validation|validation-no-codeql)\.yml(@\S+)?\s*$/m.test(block))
+        continue
+      const raw = block.match(/^\s+rust-shards:\s*(.+?)\s*$/m)?.[1] ?? '["all"]'
+      // Unresolved caller expressions cannot be evaluated here; the literal
+      // shard list of the workflow that passes them is what gets compared.
+      if (raw.includes('${{')) continue
+      let shards = raw.replace(/^['"]|['"]$/g, '')
+      try {
+        shards = JSON.stringify(JSON.parse(shards).toSorted())
+      } catch {
+        // Compare unparsable values verbatim; alignment still fails loudly.
+      }
+      lanes.set(`${file} (${job})`, shards)
+    }
+  }
+  const distinct = new Set(lanes.values())
+  if (distinct.size <= 1) return
+  const detail = [...lanes].map(([lane, shards]) => `${lane}: ${shards}`).join(', ')
+  throw new Error(
+    `Rust CodeQL shard sets drift between lanes calling codeql.yml (${detail}). ` +
+      'GitHub code scanning tracks every uploaded category, so every lane must pass the same rust-shards list. ' +
+      'Re-render the callers with `npx code-foundry sync`, keep codeql_rust_shards aligned across callers, and retire ' +
+      'removed categories by deleting their code-scanning analyses (see docs/CONFIGURATION.md).'
+  )
+}
+
 function codeql() {
   const enabled =
     featureEnabled('codeql') &&
@@ -894,6 +970,9 @@ function codeql() {
     }
     return
   }
+  // Detect lane drift before any analysis uploads a category the other lanes
+  // never produce; a stall surfaces only later as a blocked merge gate.
+  assertRustShardsAligned()
   const available = []
   if (existsSync(resolve(root, '.github/workflows'))) available.push('actions')
   if (hasLanguage('typescript') || hasLanguage('javascript'))