code-foundry 1.31.0 → 1.33.1

package/.github/workflows/ci.yml

@@ -33,6 +33,7 @@ permissions:
   contents: read
 
 env:
+  TURBO_API: ${{ vars.TURBO_API }}
   TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   TURBO_TEAM: ${{ vars.TURBO_TEAM }}
   REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}

package/.github/workflows/cloudflare-deploy.yml

@@ -57,6 +57,9 @@ on:
         required: true
       CLOUDFLARE_ACCOUNT_ID:
         required: true
+      TURBO_TOKEN:
+        description: 'Optional turborepo remote cache token; when set, the Build Worker step authenticates to TURBO_API so deploy builds save to and hit the remote cache.'
+        required: false
     outputs:
       url:
         value: ${{ jobs.deploy.outputs.url }}
@@ -264,6 +267,9 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
+          TURBO_API: ${{ vars.TURBO_API }}
+          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+          TURBO_TEAM: ${{ vars.TURBO_TEAM }}
         run: bun run "$BUILD_SCRIPT"
       - name: Deploy to Cloudflare
         id: deploy

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [1.33.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.0...v1.33.1) (2026-09-25)
+
+
+### Bug Fixes
+
+* **security:** stop a clean pip-audit result from failing the audit gate ([#643](https://github.com/0xPlayerOne/code-foundry/issues/643)) ([7260291](https://github.com/0xPlayerOne/code-foundry/commit/7260291fc24e851678ddbf9cc9dfcf99bea48f59))
+
+
+### Maintenance
+
+* **perf:** recalibrate the packed artifact budget ([#645](https://github.com/0xPlayerOne/code-foundry/issues/645)) ([64b6504](https://github.com/0xPlayerOne/code-foundry/commit/64b65049ba313f01f6989bf52a83efe31d2b91dd))
+
+## [1.33.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.32.0...v1.33.0) (2026-09-22)
+
+
+### Features
+
+* **cloudflare-deploy:** accept optional TURBO_TOKEN secret for remote-cached deploy builds ([#640](https://github.com/0xPlayerOne/code-foundry/issues/640)) ([091bfd1](https://github.com/0xPlayerOne/code-foundry/commit/091bfd12b6bbca0e9289a74827713dc50bcb4193))
+
+## [1.32.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.31.0...v1.32.0) (2026-09-21)
+
+
+### Features
+
+* forward TURBO_API to validation and cloudflare deploy builds ([#638](https://github.com/0xPlayerOne/code-foundry/issues/638)) ([55347f6](https://github.com/0xPlayerOne/code-foundry/commit/55347f6fd3bea41f11aa936650222cd73cfd8026))
+
 ## [1.31.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.30.2...v1.31.0) (2026-09-21)
 
 

package/docs/WORKFLOWS.md

@@ -282,6 +282,10 @@ The repository's format and lint jobs are ordinary CI checks. Set `codeql:
 false` or `dependency_review: false` when a public repository also needs those
 checks disabled.
 
+The Python audit fails only on a reported advisory: `pip-audit` can report a
+clean result with a non-zero status, so the runtime decides from the report,
+replays it to the job log, and emits a `::warning::` when it downgrades.
+
 ## Branch protection
 
 Use repository rulesets (or legacy branch protection settings) to mirror the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.31.0",
+  "version": "1.33.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/runtime-core.mjs

@@ -432,6 +432,25 @@ function run(command, args = [], options = {}) {
   if (result.status !== 0) process.exit(result.status ?? 1)
 }
 
+// pip-audit can report its clean result with a non-zero status when the
+// inspected environment hits a resolution problem, so decide from the report.
+const CLEAN_AUDIT = 'No known vulnerabilities found'
+const ADVISORY = /\b(?:PYSEC|GHSA|CVE|OSV)-[A-Za-z0-9._-]+/
+
+/** @param {string} command @param {string[]} [args] */
+function runAudited(command, args = []) {
+  const result = spawnSync(command, args, { cwd: root, encoding: 'utf8', env: process.env })
+  if (result.error) throw result.error
+  const stdout = result.stdout ?? ''
+  const stderr = result.stderr ?? ''
+  if (stdout) process.stdout.write(stdout)
+  if (stderr) process.stderr.write(stderr)
+  if (result.status === 0) return
+  const report = `${stdout}\n${stderr}`
+  if (!report.includes(CLEAN_AUDIT) || ADVISORY.test(report)) process.exit(result.status ?? 1)
+  console.warn(`::warning::${command} exited ${result.status} with no known vulnerabilities`)
+}
+
 /** @param {string} command @param {string[]} [args] */
 function capture(command, args = []) {
   const result = spawnSync(command, args, { cwd: root, encoding: 'utf8', env: process.env })
@@ -879,10 +898,10 @@ function security(task, ecosystem) {
     const auditArgs =
       requirement && !['project', 'none'].includes(requirement) ? ['-r', requirement] : []
     if (commandExists('uv'))
-      run('uv', ['tool', 'run', '--from', 'pip-audit==2.10.1', 'pip-audit', ...auditArgs])
+      runAudited('uv', ['tool', 'run', '--from', 'pip-audit==2.10.1', 'pip-audit', ...auditArgs])
     else {
       run('python', ['-m', 'pip', 'install', '--quiet', 'pip-audit==2.10.1'])
-      run('python', ['-m', 'pip_audit', ...auditArgs])
+      runAudited('python', ['-m', 'pip_audit', ...auditArgs])
     }
   }
 }