code-foundry 1.29.1 → 1.30.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.30.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.29.1...v1.30.0) (2026-09-17)
+
+
+### Features
+
+* resolve lane diffs only for filtered lanes and accept injected paths ([#631](https://github.com/0xPlayerOne/code-foundry/issues/631)) ([04a0d8a](https://github.com/0xPlayerOne/code-foundry/commit/04a0d8a69b3fd3d3417eef46e22e0eb79860fb04))
+
 ## [1.29.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.29.0...v1.29.1) (2026-09-17)
 
 

package/docs/CONFIGURATION.md

@@ -228,6 +228,13 @@ change set all keep the lane running. Paths are evaluated against
 always run. Because filters only decide whether a lane _executes_, required
 checks stay green and the aggregate gate sees a normal success.
 
+Diff resolution only runs for lanes that have a filter configured, so
+repositories using a single filter pay one shallow fetch per change instead
+of one per lane. An orchestrator that has already resolved the change set can
+inject it for a lane through a newline-delimited `CHANGED_PATHS` environment
+variable; an empty or missing value falls back to local resolution, so an
+injection can never widen a skip.
+
 Security lanes and CodeQL are never filterable: their coverage is structural,
 not change-scoped.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.29.1",
+  "version": "1.30.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/lib/task-filters.mjs

@@ -79,14 +79,24 @@ export function globToRegExp(glob) {
 /**
  * Resolve the pull request or push change set. The generated Detect steps
  * pass EVENT_NAME plus BASE_REF/BASE_SHA/HEAD_SHA (pull_request) or
- * BEFORE_SHA/HEAD_SHA (push). Returns null when the change set cannot be
- * resolved; callers treat null as fail-open so a checkout edge never skips a
- * required lane.
+ * BEFORE_SHA/HEAD_SHA (push). An orchestrator that already resolved the
+ * change set once can inject it as a newline-delimited CHANGED_PATHS value;
+ * an empty or missing value falls through to local resolution so a stale
+ * injection can never widen a skip. Returns null when the change set cannot
+ * be resolved; callers treat null as fail-open so a checkout edge never
+ * skips a required lane.
  * @param {string} root
  * @param {Record<string, string | undefined>} env
  * @returns {string[] | null}
  */
 export function resolveChangedPaths(root, env = process.env) {
+  const injected = env.CHANGED_PATHS
+  if (injected && injected.trim().length > 0) {
+    return injected
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0)
+  }
   const event = env.EVENT_NAME
   let range = null
   try {

package/src/runtime-core.mjs

@@ -691,13 +691,11 @@ function ci(task) {
     writeOutput('applicable', relevant(selected) ? 'true' : 'false')
     // Path-filtered lanes are opt-in via `filter_<task>` config keys. The
     // gate fails open: no filter, an unresolvable diff, or an empty change
-    // set all keep the lane running.
-    writeOutput(
-      'affected',
-      taskAffected(selected ?? '', readTaskFilters(config), resolveChangedPaths(root))
-        ? 'true'
-        : 'false'
-    )
+    // set all keep the lane running. Resolving the diff costs a git fetch,
+    // so only lanes with a configured filter pay it.
+    const filters = readTaskFilters(config)
+    const diff = filters.has(selected ?? '') ? resolveChangedPaths(root) : null
+    writeOutput('affected', taskAffected(selected ?? '', filters, diff) ? 'true' : 'false')
     writeOutput(
       'javascript',
       hasLanguage('typescript') || hasLanguage('javascript') ? 'true' : 'false'