code-foundry 1.33.0 → 1.33.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [1.33.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.0...v1.33.1) (2026-09-25)
+
+
+### Bug Fixes
+
+* **security:** stop a clean pip-audit result from failing the audit gate ([#643](https://github.com/0xPlayerOne/code-foundry/issues/643)) ([7260291](https://github.com/0xPlayerOne/code-foundry/commit/7260291fc24e851678ddbf9cc9dfcf99bea48f59))
+
+
+### Maintenance
+
+* **perf:** recalibrate the packed artifact budget ([#645](https://github.com/0xPlayerOne/code-foundry/issues/645)) ([64b6504](https://github.com/0xPlayerOne/code-foundry/commit/64b65049ba313f01f6989bf52a83efe31d2b91dd))
+
 ## [1.33.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.32.0...v1.33.0) (2026-09-22)
 
 

package/docs/WORKFLOWS.md

@@ -282,6 +282,10 @@ The repository's format and lint jobs are ordinary CI checks. Set `codeql:
 false` or `dependency_review: false` when a public repository also needs those
 checks disabled.
 
+The Python audit fails only on a reported advisory: `pip-audit` can report a
+clean result with a non-zero status, so the runtime decides from the report,
+replays it to the job log, and emits a `::warning::` when it downgrades.
+
 ## Branch protection
 
 Use repository rulesets (or legacy branch protection settings) to mirror the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.33.0",
+  "version": "1.33.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/runtime-core.mjs

@@ -432,6 +432,25 @@ function run(command, args = [], options = {}) {
   if (result.status !== 0) process.exit(result.status ?? 1)
 }
 
+// pip-audit can report its clean result with a non-zero status when the
+// inspected environment hits a resolution problem, so decide from the report.
+const CLEAN_AUDIT = 'No known vulnerabilities found'
+const ADVISORY = /\b(?:PYSEC|GHSA|CVE|OSV)-[A-Za-z0-9._-]+/
+
+/** @param {string} command @param {string[]} [args] */
+function runAudited(command, args = []) {
+  const result = spawnSync(command, args, { cwd: root, encoding: 'utf8', env: process.env })
+  if (result.error) throw result.error
+  const stdout = result.stdout ?? ''
+  const stderr = result.stderr ?? ''
+  if (stdout) process.stdout.write(stdout)
+  if (stderr) process.stderr.write(stderr)
+  if (result.status === 0) return
+  const report = `${stdout}\n${stderr}`
+  if (!report.includes(CLEAN_AUDIT) || ADVISORY.test(report)) process.exit(result.status ?? 1)
+  console.warn(`::warning::${command} exited ${result.status} with no known vulnerabilities`)
+}
+
 /** @param {string} command @param {string[]} [args] */
 function capture(command, args = []) {
   const result = spawnSync(command, args, { cwd: root, encoding: 'utf8', env: process.env })
@@ -879,10 +898,10 @@ function security(task, ecosystem) {
     const auditArgs =
       requirement && !['project', 'none'].includes(requirement) ? ['-r', requirement] : []
     if (commandExists('uv'))
-      run('uv', ['tool', 'run', '--from', 'pip-audit==2.10.1', 'pip-audit', ...auditArgs])
+      runAudited('uv', ['tool', 'run', '--from', 'pip-audit==2.10.1', 'pip-audit', ...auditArgs])
     else {
       run('python', ['-m', 'pip', 'install', '--quiet', 'pip-audit==2.10.1'])
-      run('python', ['-m', 'pip_audit', ...auditArgs])
+      runAudited('python', ['-m', 'pip_audit', ...auditArgs])
     }
   }
 }