code-foundry 1.33.2 → 1.34.0

package/.github/workflows/cloudflare-deploy.yml

@@ -285,12 +285,12 @@ jobs:
           set -euo pipefail
           if [ "$WRANGLER_VERSION" = local ]; then
             if [ -n "$BUILD_SCRIPT" ]; then
-              wrangler=(bunx --bun --no-install wrangler)
+              wrangler=(npx --no-install wrangler)
             else
               wrangler=(npx --no-install wrangler)
             fi
           elif [ -n "$BUILD_SCRIPT" ]; then
-            wrangler=(bunx --bun "wrangler@$WRANGLER_VERSION")
+            wrangler=(npx -y "wrangler@$WRANGLER_VERSION")
           else
             wrangler=(npx -y "wrangler@$WRANGLER_VERSION")
           fi

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.34.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.3...v1.34.0) (2026-09-29)
+
+
+### Features
+
+* billing-paused-dependabot ([#651](https://github.com/0xPlayerOne/code-foundry/issues/651)) ([eda05b5](https://github.com/0xPlayerOne/code-foundry/commit/eda05b5cfa28fc7314ec33a94e539a1660549511))
+
+## [1.33.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.2...v1.33.3) (2026-09-29)
+
+
+### Bug Fixes
+
+* **ci:** launch wrangler under Node in the cloudflare deploy step ([#649](https://github.com/0xPlayerOne/code-foundry/issues/649)) ([e797934](https://github.com/0xPlayerOne/code-foundry/commit/e7979343d3ff4d1fe5dc1520568a501cce0c47f3))
+
 ## [1.33.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.1...v1.33.2) (2026-09-26)
 
 

package/docs/CONFIGURATION.md

@@ -45,6 +45,7 @@ to require an existing mise configuration.
 | `runtime_ref`           | tag or commit                                | Runtime version used by generated callers.                           |
 | `features`              | `all` or a list                              | See [Feature selection](#feature-selection).                         |
 | `draft_protection`      | `true`, `false`                              | Skip generated runner-heavy gates for draft PRs when false.          |
+| `billing_paused`        | `true`, `false`                              | Disable Dependabot version updates while CI billing is paused.       |
 | `codeql`                | `auto`, `true`, `false`                      | Enable CodeQL when the repository and GitHub plan support it.        |
 | `dependency_review`     | `auto`, `true`, `false`                      | Enable Dependency Review when supported.                             |
 | `runner` and `*_runner` | GitHub runner labels                         | Override the default runner per workflow.                            |
@@ -62,6 +63,14 @@ intentionally runs generated gates for draft PRs. Cloudflare reusable-workflow
 callers use their equivalent `draft-protection` input. These opt-outs affect
 CI/deployment gates only and do not disable Draft Guard or draft-PR automation.
 
+The `CI_BILLING_PAUSED` repository variable gates every generated workflow job,
+but Dependabot's update runs execute under the `dynamic` event and never see
+that variable. Set `billing_paused: true` alongside the variable and re-run
+`sync` so the rendered `dependabot.yml` sets `open-pull-requests-limit: 0` and
+drops the update cadence to monthly for every ecosystem. Removing the flag and
+syncing again restores the active template. `npx code-foundry ci status` reports
+when a paused repository still has Dependabot updates active.
+
 ## Feature selection
 
 Use `features: all` or a comma/space-separated list. The canonical validation

package/docs/WORKFLOWS.md

@@ -128,6 +128,14 @@ second toggle: the `OPENCODE_SECURITY` repository or organization variable
 (`true`/`false`) is its only enablement control, so individual repositories can
 opt in or out without a code change.
 
+Dependabot is the one billable runner source the variable cannot gate: its
+update runs execute under the `dynamic` event, outside every job-level guard.
+While paused, set `billing_paused: true` in `.github/code-foundry.yml` and run a
+sync so the rendered `dependabot.yml` disables version updates
+(`open-pull-requests-limit: 0`, monthly cadence). Remove the flag and sync to
+restore updates when billing resumes. `npx code-foundry ci status` reports the
+Dependabot state, and `pause` warns when updates are still active.
+
 ## Standard workflow responsibilities
 
 | Workflow    | Responsibility                                                    |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.33.2",
+  "version": "1.34.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/ci.mjs

@@ -1,6 +1,8 @@
 // @ts-check
 
 import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { readConfig } from '../lib/config.mjs'
 
 export const CI_BILLING_PAUSED_VARIABLE = 'CI_BILLING_PAUSED'
 export const CI_BILLING_BACKUP_VARIABLE = 'CI_BILLING_GATE_BACKUP'
@@ -26,11 +28,13 @@ export function manageCiBilling(root, action) {
   const backup = backupText ? parseBackup(backupText) : null
 
   if (action === 'status') {
+    const dependabot = dependabotPauseState(root)
     const result = {
       repository,
       paused,
       requiredCheck: CI_BILLING_REQUIRED_CHECK,
       backupPresent: Boolean(backup),
+      dependabot,
     }
     console.log(JSON.stringify(result, null, 2))
     return result
@@ -87,12 +91,25 @@ export function manageCiBilling(root, action) {
     setVariable(repository, CI_BILLING_PAUSED_VARIABLE, 'true')
     const cancelledRuns = cancelActiveRuns(repository)
     for (const change of changes) updateRuleset(repository, change.ruleset)
+    const dependabot = dependabotPauseState(root)
     const result = {
       repository,
       paused: true,
       changed: true,
       cancelledRuns,
       rulesets: changes.map((change) => change.ruleset.name),
+      // Dependabot update runs execute under the `dynamic` event, so the
+      // repository variable alone never stops them. Surface the gap every
+      // time so a paused repository cannot keep burning minutes silently.
+      dependabot,
+      ...(dependabot.active
+        ? {
+            dependabotWarning:
+              'Dependabot version updates are still active and are not gated by ' +
+              `${CI_BILLING_PAUSED_VARIABLE}. Set billing_paused: true in .github/code-foundry.yml ` +
+              'and run a sync so dependabot.yml renders open-pull-requests-limit: 0.',
+          }
+        : {}),
     }
     console.log(JSON.stringify(result, null, 2))
     return result
@@ -133,6 +150,31 @@ export function manageCiBilling(root, action) {
   return result
 }
 
+/**
+ * Inspect whether Dependabot version updates are still active in the working
+ * tree. The repository variable gates workflow jobs but not Dependabot's own
+ * `dynamic` update runs, so a paused repository also needs dependabot.yml to
+ * render `open-pull-requests-limit: 0` (the `billing_paused` config does this
+ * during sync). An ecosystem without an explicit limit of 0 counts as active
+ * because Dependabot defaults the limit to 5.
+ *
+ * @param {string} root
+ * @returns {{ configured: boolean, active: boolean, file: string }}
+ */
+export function dependabotPauseState(root) {
+  const file = '.github/dependabot.yml'
+  const path = `${root.replace(/\/$/, '')}/${file}`
+  if (!existsSync(path)) return { configured: false, active: false, file }
+  const source = readFileSync(path, 'utf8')
+  const configured =
+    readConfig(`${root.replace(/\/$/, '')}/.github/code-foundry.yml`).billing_paused === 'true'
+  const blocks = source
+    .split(/(?=^  - package-ecosystem: )/m)
+    .filter((block) => block.startsWith('  - package-ecosystem: '))
+  const active = blocks.some((block) => !/^    open-pull-requests-limit: 0(\s|#|$)/m.test(block))
+  return { configured, active, file }
+}
+
 /** @param {any} ruleset */
 export function buildPausedRuleset(ruleset) {
   const requiredRuleIndexes = (ruleset.rules ?? []).flatMap(

package/src/commands/sync.mjs

@@ -823,12 +823,21 @@ function removeWorkflowBlock(content, blockId) {
  * part of the configured language set, respectively; weekly updater runs
  * fail when an ecosystem has no manifests to read, so unconfigured
  * ecosystems are dropped instead of left to error.
+ *
+ * The billing pause must also cover Dependabot: its update runs execute as
+ * Actions workflows under the `dynamic` event, so the `CI_BILLING_PAUSED`
+ * repository variable that gates every workflow job cannot stop them. When
+ * `billing_paused: true` is configured, version updates are disabled by
+ * rendering `open-pull-requests-limit: 0` and dropping the cadence to
+ * monthly; `schedule` is a required key, so the ecosystem blocks stay
+ * structurally valid and a later sync with the flag removed restores the
+ * template verbatim.
  * @param {string} content
  * @param {Record<string,string>} config
  * @param {string} languages
  * @returns {string}
  */
-function renderDependabot(content, config, languages) {
+export function renderDependabot(content, config, languages) {
   let rendered = content
   if (!includesValue(languages, 'rust')) {
     rendered = stripDependabotEcosystem(rendered, 'cargo')
@@ -839,10 +848,33 @@ function renderDependabot(content, config, languages) {
   if (!includesValue(languages, 'python')) {
     rendered = stripDependabotEcosystem(rendered, 'pip')
   }
+  if (configured(config.billing_paused, 'false') === 'true') {
+    rendered = pauseDependabot(rendered)
+  }
   if (isStagingRelease(config.git_workflow)) return rendered
   return rendered.replaceAll('target-branch: staging', 'target-branch: main')
 }
 
+/**
+ * Disable Dependabot version updates for every remaining ecosystem. The
+ * transformations are regex-based so they hold for any ecosystem count and
+ * any future template default; an unchanged file after both replacements
+ * means the template stopped defining schedules or limits, which is a loud
+ * template drift the next sync test will catch.
+ * @param {string} content
+ * @returns {string}
+ */
+function pauseDependabot(content) {
+  const limited = content.replace(
+    /^(\s*)open-pull-requests-limit:\s*\d+\s*$/gm,
+    `$1open-pull-requests-limit: 0 # billing_paused: version updates disabled`
+  )
+  return limited.replace(
+    /^(\s*)interval:\s*weekly\s*$/gm,
+    `$1interval: monthly # billing_paused: reduced cadence`
+  )
+}
+
 /**
  * Remove one package-ecosystem update block from a dependabot template.
  * Blocks are split on their leading list marker so removal never disturbs