code-foundry 1.33.3 → 1.35.0

package/.github/workflows/cloudflare-deploy.yml

@@ -77,31 +77,63 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  affected:
-    name: Check Turbo deployment impact
+  deploy:
+    name: Cloudflare Deploy / ${{ inputs.mode }}
+    # The Turbo impact check lives here as steps instead of a separate job:
+    # one checkout and one dependency install serve both the query and the
+    # deploy. Every deployment step is skipped when the check reports the
+    # package unaffected, and the check defaults to deploying whenever it
+    # cannot run.
     if: >-
-      inputs['turbo-filter'] != '' &&
-      (github.event_name == 'pull_request' || github.event_name == 'push') &&
       vars.CI_BILLING_PAUSED != 'true' &&
       (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    permissions:
-      contents: read
+    timeout-minutes: 30
+    # The explicit deployment record below is the sole GitHub deployment record.
+    # Keep the environment for approvals, secrets, and branch protection without
+    # creating a second, competing PR timeline entry.
+    environment:
+      name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+      deployment: false
+      url: ${{ steps.deploy.outputs.url }}
     outputs:
-      should_deploy: ${{ steps.check.outputs.should_deploy || steps.resolve.outputs.should_deploy }}
+      url: ${{ steps.deploy.outputs.url }}
+      version-id: ${{ steps.deploy.outputs.version-id }}
+      github-deployment-id: ${{ steps.start.outputs.id }}
     steps:
-      - name: Checkout full history
+      - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          fetch-depth: 0
           persist-credentials: false
+          # The Turbo affected query compares the head tree against the base
+          # commit, so the checkout needs history; blob:none keeps it light.
+          fetch-depth: 0
+          filter: blob:none
+      - name: Validate deployment inputs
+        env:
+          MODE: ${{ inputs.mode }}
+          WRANGLER_VERSION: ${{ inputs.wrangler-version }}
+        run: |
+          set -euo pipefail
+          [[ "$MODE" == preview || "$MODE" == production ]]
+          [[ "$WRANGLER_VERSION" == local || "$WRANGLER_VERSION" == latest || "$WRANGLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
+      - name: Set up Bun
+        if: inputs.build-script != '' || inputs['turbo-filter'] != ''
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+          cache: true
+          cache-dependency-path: ${{ inputs.install-working-directory }}/bun.lock
+      - name: Install dependencies
+        if: inputs.build-script != '' || inputs['turbo-filter'] != ''
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile
       - name: Resolve Turbo package
         id: resolve
+        if: inputs['turbo-filter'] != ''
         working-directory: ${{ inputs.install-working-directory }}
         env:
           TURBO_FILTER: ${{ inputs.turbo-filter }}
@@ -150,20 +182,9 @@ jobs:
             }
           }
           NODE
-      - name: Set up Bun
-        if: steps.resolve.outputs.turbo_enabled == 'true'
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: ${{ inputs.bun-version }}
-          cache: true
-          cache-dependency-path: ${{ inputs.install-working-directory }}/bun.lock
-      - name: Install dependencies for Turbo
-        if: steps.resolve.outputs.turbo_enabled == 'true'
-        working-directory: ${{ inputs.install-working-directory }}
-        run: bun install --frozen-lockfile --ignore-scripts
       - name: Check affected build task
-        if: steps.resolve.outputs.turbo_enabled == 'true'
         id: check
+        if: inputs['turbo-filter'] != '' && steps.resolve.outputs.turbo_enabled == 'true'
         working-directory: ${{ inputs.install-working-directory }}
         env:
           TURBO_PACKAGE: ${{ steps.resolve.outputs.turbo_package }}
@@ -193,49 +214,8 @@ jobs:
           console.log(`${packageName}: ${affected ? 'affected' : 'unaffected'}`)
           appendFileSync(process.env.GITHUB_OUTPUT, `should_deploy=${affected}\n`)
           NODE
-
-  deploy:
-    name: Cloudflare Deploy / ${{ inputs.mode }}
-    needs: affected
-    if: >-
-      always() &&
-      vars.CI_BILLING_PAUSED != 'true' &&
-      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
-      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
-      github.event_name != 'pull_request_target' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
-      (
-        inputs['turbo-filter'] == '' ||
-        needs.affected.result == 'skipped' ||
-        needs.affected.outputs.should_deploy == 'true'
-      )
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    # The explicit deployment record below is the sole GitHub deployment record.
-    # Keep the environment for approvals, secrets, and branch protection without
-    # creating a second, competing PR timeline entry.
-    environment:
-      name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
-      deployment: false
-      url: ${{ steps.deploy.outputs.url }}
-    outputs:
-      url: ${{ steps.deploy.outputs.url }}
-      version-id: ${{ steps.deploy.outputs.version-id }}
-      github-deployment-id: ${{ steps.start.outputs.id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Validate deployment inputs
-        env:
-          MODE: ${{ inputs.mode }}
-          WRANGLER_VERSION: ${{ inputs.wrangler-version }}
-        run: |
-          set -euo pipefail
-          [[ "$MODE" == preview || "$MODE" == production ]]
-          [[ "$WRANGLER_VERSION" == local || "$WRANGLER_VERSION" == latest || "$WRANGLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
       - name: Record pending deployment
+        if: steps.check.outputs.should_deploy != 'false'
         id: start
         env:
           GH_TOKEN: ${{ github.token }}
@@ -263,7 +243,7 @@ jobs:
         working-directory: ${{ inputs.install-working-directory }}
         run: bun install --frozen-lockfile
       - name: Build Worker
-        if: inputs.build-script != ''
+        if: inputs.build-script != '' && steps.check.outputs.should_deploy != 'false'
         working-directory: ${{ inputs.working-directory }}
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
@@ -273,6 +253,7 @@ jobs:
         run: bun run "$BUILD_SCRIPT"
       - name: Deploy to Cloudflare
         id: deploy
+        if: steps.check.outputs.should_deploy != 'false'
         working-directory: ${{ inputs.working-directory }}
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -318,7 +299,7 @@ jobs:
           appendFileSync(process.env.GITHUB_OUTPUT, `url=${url.href}\nversion-id=${record.version_id}\n`)
           NODE
       - name: Complete deployment status
-        if: always() && steps.start.outputs.id != ''
+        if: always() && steps.check.outputs.should_deploy != 'false' && steps.start.outputs.id != ''
         env:
           GH_TOKEN: ${{ github.token }}
           DEPLOYMENT_ID: ${{ steps.start.outputs.id }}

package/.github/workflows/codeql.yml

@@ -125,10 +125,47 @@ jobs:
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: List pull request files
+        id: changed
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          # Newline-separated changed paths for the runtime's change
+          # detection. A failed listing leaves the file absent and the
+          # runtime fails open toward analyzing every language and shard.
+          gh api "repos/$GITHUB_REPOSITORY/pulls/$PULL_REQUEST_NUMBER/files?per_page=100" \
+            --paginate --jq '.[].filename' > "$RUNNER_TEMP/changed-files.txt" || true
+          echo "file=$RUNNER_TEMP/changed-files.txt" >> "$GITHUB_OUTPUT"
+      - name: Detect code scanning merge gate
+        id: gate
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # The code-scanning merge gate waits for results in every tracked
+          # category, so change detection must never skip an upload while it
+          # is active. Any ruleset API failure also disables change
+          # detection: full analysis is the safe default.
+          gated=false
+          for id in $(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
+            -q '.[] | select(.enforcement == "active") | .id' 2>/dev/null); do
+            if gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
+              -q 'any(.rules[]?; .type == "code_scanning")' 2>/dev/null | grep -q true; then
+              gated=true
+              break
+            fi
+          done
+          echo "gated=$gated" >> "$GITHUB_OUTPUT"
       - id: languages
         name: Detect languages
         env:
           CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          FOUNDRY_CODEQL_CHANGED_FILES_FILE: ${{ steps.changed.outputs.file }}
+          FOUNDRY_CODEQL_MERGE_GATE: ${{ steps.gate.outputs.gated }}
           REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
@@ -166,14 +203,24 @@ jobs:
                 changed: entry.changed === true,
               }));
             const rust = languages.find((entry) => entry.language === "rust");
-            for (const shard of rust ? shards : []) {
+            // The runtime emits per-shard change flags when the event is a
+            // pull request with a usable changed-file list; fall back to the
+            // shard list of the caller with the language-level flag
+            // otherwise. No single quotes: this script runs through node -e.
+            const rustShards =
+              rust && Array.isArray(rust.shards) && rust.shards.length
+                ? rust.shards
+                : (rust
+                    ? shards.map((shard) => ({ shard: String(shard), changed: rust.changed === true }))
+                    : []);
+            for (const entry of rustShards) {
               matrix.push({
-                display: String(shard) === "all" ? "Rust" : "Rust (" + shard + ")",
+                display: entry.shard === "all" ? "Rust" : "Rust (" + entry.shard + ")",
                 language: "rust",
                 category: "/language:rust",
                 build_mode: "none",
-                changed: rust.changed === true,
-                shard: String(shard),
+                changed: entry.changed === true,
+                shard: String(entry.shard),
               });
             }
             if (!matrix.length) {

package/.github/workflows/opencode-security_self-ci.yml

@@ -14,7 +14,13 @@ permissions:
 jobs:
   detect:
     name: OpenCode Security / Detect
-    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
+    # The OPENCODE_SECURITY repository or organization variable is the only
+    # enablement control, so gate the detector itself on it: a disabled
+    # repository must not allocate a runner just to report that it is off.
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      vars.OPENCODE_SECURITY == 'true' &&
+      (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
     runs-on: ubuntu-slim
     timeout-minutes: 10
     outputs:

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [1.35.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.34.0...v1.35.0) (2026-09-29)
+
+
+### Features
+
+* fold the Turbo impact check into the cloudflare deploy job ([#655](https://github.com/0xPlayerOne/code-foundry/issues/655)) ([b72f5f2](https://github.com/0xPlayerOne/code-foundry/commit/b72f5f26f045103755bb2795f2fc3a84e7625b3c))
+* scope CodeQL analysis to changed languages and Rust shards on pull requests ([#654](https://github.com/0xPlayerOne/code-foundry/issues/654)) ([d5ce743](https://github.com/0xPlayerOne/code-foundry/commit/d5ce74377601c2efb3be4831320cb62cdfbd999b))
+* skip the security detector entirely while OpenCode Security is disabled ([#653](https://github.com/0xPlayerOne/code-foundry/issues/653)) ([9e4271e](https://github.com/0xPlayerOne/code-foundry/commit/9e4271e597d65b4f63c571baab5507eacaab1ce5))
+
+
+### Maintenance
+
+* raise the packed artifact budget to 286 kB ([#657](https://github.com/0xPlayerOne/code-foundry/issues/657)) ([4512af7](https://github.com/0xPlayerOne/code-foundry/commit/4512af75fc18a36292f495c5e7f51791ba38f3d6))
+
+## [1.34.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.3...v1.34.0) (2026-09-29)
+
+
+### Features
+
+* billing-paused-dependabot ([#651](https://github.com/0xPlayerOne/code-foundry/issues/651)) ([eda05b5](https://github.com/0xPlayerOne/code-foundry/commit/eda05b5cfa28fc7314ec33a94e539a1660549511))
+
 ## [1.33.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.2...v1.33.3) (2026-09-29)
 
 

package/docs/CONFIGURATION.md

@@ -45,6 +45,7 @@ to require an existing mise configuration.
 | `runtime_ref`           | tag or commit                                | Runtime version used by generated callers.                           |
 | `features`              | `all` or a list                              | See [Feature selection](#feature-selection).                         |
 | `draft_protection`      | `true`, `false`                              | Skip generated runner-heavy gates for draft PRs when false.          |
+| `billing_paused`        | `true`, `false`                              | Disable Dependabot version updates while CI billing is paused.       |
 | `codeql`                | `auto`, `true`, `false`                      | Enable CodeQL when the repository and GitHub plan support it.        |
 | `dependency_review`     | `auto`, `true`, `false`                      | Enable Dependency Review when supported.                             |
 | `runner` and `*_runner` | GitHub runner labels                         | Override the default runner per workflow.                            |
@@ -62,6 +63,14 @@ intentionally runs generated gates for draft PRs. Cloudflare reusable-workflow
 callers use their equivalent `draft-protection` input. These opt-outs affect
 CI/deployment gates only and do not disable Draft Guard or draft-PR automation.
 
+The `CI_BILLING_PAUSED` repository variable gates every generated workflow job,
+but Dependabot's update runs execute under the `dynamic` event and never see
+that variable. Set `billing_paused: true` alongside the variable and re-run
+`sync` so the rendered `dependabot.yml` sets `open-pull-requests-limit: 0` and
+drops the update cadence to monthly for every ecosystem. Removing the flag and
+syncing again restores the active template. `npx code-foundry ci status` reports
+when a paused repository still has Dependabot updates active.
+
 ## Feature selection
 
 Use `features: all` or a comma/space-separated list. The canonical validation
@@ -271,6 +280,15 @@ every tracked category. Two practical consequences:
   categories in the shard list keeps the gate green but re-runs their analysis
   on every pull request and is not a substitute for cleanup.
 
+On pull requests without a code-scanning merge gate, analyzers run only for
+languages with changed files, and Rust shards run only when their scope (or a
+workspace-wide `Cargo` manifest or toolchain file) changed; unchanged matrix
+entries report `Not applicable` instead of analyzing. Repositories whose
+rulesets enforce a code-scanning requirement are detected automatically and
+analyze everything, because that merge gate waits for results in every tracked
+category. Push, schedule, and merge-queue events always analyze the complete
+set so the default branch keeps one full, comparable baseline.
+
 ## Cloudflare Workers
 
 Repositories that deploy to Cloudflare Workers can use the opt-in verified

package/docs/WORKFLOWS.md

@@ -126,7 +126,19 @@ Custom workflows are repository-owned and are not rewritten by sync. Add
 honor the shared billing pause. The optional OpenCode Security scan honors a
 second toggle: the `OPENCODE_SECURITY` repository or organization variable
 (`true`/`false`) is its only enablement control, so individual repositories can
-opt in or out without a code change.
+opt in or out without a code change. When the variable is not `true`, no
+Security job runs at all — a disabled repository allocates no runner for it.
+Repository variables override the organization value, so an organization-level
+variable toggles every consumer in one place while a single repository can
+still opt out (or in) independently.
+
+Dependabot is the one billable runner source the variable cannot gate: its
+update runs execute under the `dynamic` event, outside every job-level guard.
+While paused, set `billing_paused: true` in `.github/code-foundry.yml` and run a
+sync so the rendered `dependabot.yml` disables version updates
+(`open-pull-requests-limit: 0`, monthly cadence). Remove the flag and sync to
+restore updates when billing resumes. `npx code-foundry ci status` reports the
+Dependabot state, and `pause` warns when updates are still active.
 
 ## Standard workflow responsibilities
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.33.3",
+  "version": "1.35.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/ci.mjs

@@ -1,6 +1,8 @@
 // @ts-check
 
 import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { readConfig } from '../lib/config.mjs'
 
 export const CI_BILLING_PAUSED_VARIABLE = 'CI_BILLING_PAUSED'
 export const CI_BILLING_BACKUP_VARIABLE = 'CI_BILLING_GATE_BACKUP'
@@ -26,11 +28,13 @@ export function manageCiBilling(root, action) {
   const backup = backupText ? parseBackup(backupText) : null
 
   if (action === 'status') {
+    const dependabot = dependabotPauseState(root)
     const result = {
       repository,
       paused,
       requiredCheck: CI_BILLING_REQUIRED_CHECK,
       backupPresent: Boolean(backup),
+      dependabot,
     }
     console.log(JSON.stringify(result, null, 2))
     return result
@@ -87,12 +91,25 @@ export function manageCiBilling(root, action) {
     setVariable(repository, CI_BILLING_PAUSED_VARIABLE, 'true')
     const cancelledRuns = cancelActiveRuns(repository)
     for (const change of changes) updateRuleset(repository, change.ruleset)
+    const dependabot = dependabotPauseState(root)
     const result = {
       repository,
       paused: true,
       changed: true,
       cancelledRuns,
       rulesets: changes.map((change) => change.ruleset.name),
+      // Dependabot update runs execute under the `dynamic` event, so the
+      // repository variable alone never stops them. Surface the gap every
+      // time so a paused repository cannot keep burning minutes silently.
+      dependabot,
+      ...(dependabot.active
+        ? {
+            dependabotWarning:
+              'Dependabot version updates are still active and are not gated by ' +
+              `${CI_BILLING_PAUSED_VARIABLE}. Set billing_paused: true in .github/code-foundry.yml ` +
+              'and run a sync so dependabot.yml renders open-pull-requests-limit: 0.',
+          }
+        : {}),
     }
     console.log(JSON.stringify(result, null, 2))
     return result
@@ -133,6 +150,31 @@ export function manageCiBilling(root, action) {
   return result
 }
 
+/**
+ * Inspect whether Dependabot version updates are still active in the working
+ * tree. The repository variable gates workflow jobs but not Dependabot's own
+ * `dynamic` update runs, so a paused repository also needs dependabot.yml to
+ * render `open-pull-requests-limit: 0` (the `billing_paused` config does this
+ * during sync). An ecosystem without an explicit limit of 0 counts as active
+ * because Dependabot defaults the limit to 5.
+ *
+ * @param {string} root
+ * @returns {{ configured: boolean, active: boolean, file: string }}
+ */
+export function dependabotPauseState(root) {
+  const file = '.github/dependabot.yml'
+  const path = `${root.replace(/\/$/, '')}/${file}`
+  if (!existsSync(path)) return { configured: false, active: false, file }
+  const source = readFileSync(path, 'utf8')
+  const configured =
+    readConfig(`${root.replace(/\/$/, '')}/.github/code-foundry.yml`).billing_paused === 'true'
+  const blocks = source
+    .split(/(?=^  - package-ecosystem: )/m)
+    .filter((block) => block.startsWith('  - package-ecosystem: '))
+  const active = blocks.some((block) => !/^    open-pull-requests-limit: 0(\s|#|$)/m.test(block))
+  return { configured, active, file }
+}
+
 /** @param {any} ruleset */
 export function buildPausedRuleset(ruleset) {
   const requiredRuleIndexes = (ruleset.rules ?? []).flatMap(

package/src/commands/sync.mjs

@@ -823,12 +823,21 @@ function removeWorkflowBlock(content, blockId) {
  * part of the configured language set, respectively; weekly updater runs
  * fail when an ecosystem has no manifests to read, so unconfigured
  * ecosystems are dropped instead of left to error.
+ *
+ * The billing pause must also cover Dependabot: its update runs execute as
+ * Actions workflows under the `dynamic` event, so the `CI_BILLING_PAUSED`
+ * repository variable that gates every workflow job cannot stop them. When
+ * `billing_paused: true` is configured, version updates are disabled by
+ * rendering `open-pull-requests-limit: 0` and dropping the cadence to
+ * monthly; `schedule` is a required key, so the ecosystem blocks stay
+ * structurally valid and a later sync with the flag removed restores the
+ * template verbatim.
  * @param {string} content
  * @param {Record<string,string>} config
  * @param {string} languages
  * @returns {string}
  */
-function renderDependabot(content, config, languages) {
+export function renderDependabot(content, config, languages) {
   let rendered = content
   if (!includesValue(languages, 'rust')) {
     rendered = stripDependabotEcosystem(rendered, 'cargo')
@@ -839,10 +848,33 @@ function renderDependabot(content, config, languages) {
   if (!includesValue(languages, 'python')) {
     rendered = stripDependabotEcosystem(rendered, 'pip')
   }
+  if (configured(config.billing_paused, 'false') === 'true') {
+    rendered = pauseDependabot(rendered)
+  }
   if (isStagingRelease(config.git_workflow)) return rendered
   return rendered.replaceAll('target-branch: staging', 'target-branch: main')
 }
 
+/**
+ * Disable Dependabot version updates for every remaining ecosystem. The
+ * transformations are regex-based so they hold for any ecosystem count and
+ * any future template default; an unchanged file after both replacements
+ * means the template stopped defining schedules or limits, which is a loud
+ * template drift the next sync test will catch.
+ * @param {string} content
+ * @returns {string}
+ */
+function pauseDependabot(content) {
+  const limited = content.replace(
+    /^(\s*)open-pull-requests-limit:\s*\d+\s*$/gm,
+    `$1open-pull-requests-limit: 0 # billing_paused: version updates disabled`
+  )
+  return limited.replace(
+    /^(\s*)interval:\s*weekly\s*$/gm,
+    `$1interval: monthly # billing_paused: reduced cadence`
+  )
+}
+
 /**
  * Remove one package-ecosystem update block from a dependabot template.
  * Blocks are split on their leading list marker so removal never disturbs

package/src/runtime-core.mjs

@@ -1011,8 +1011,13 @@ function codeql() {
     available.push('javascript-typescript')
   if (hasLanguage('python')) available.push('python')
   if (hasLanguage('rust')) available.push('rust')
-  // Upload every configured language on every analysis run so GitHub can
-  // compare pull requests against the base branch's code-scanning config.
+  // On pull requests, analyzers whose language has no changed files skip
+  // their analysis steps, and Rust shards skip individually by scope. Every
+  // other event analyzes the complete set so the default branch keeps one
+  // full, comparable code-scanning baseline; a missing or unreadable
+  // changed-file list also fails open toward analyzing everything.
+  const changedPaths = pullRequestChangedPaths()
+  /** @type {CodeqlLanguageEntry[]} */
   const languagesJson = available.map((language) => ({
     language,
     name:
@@ -1020,8 +1025,17 @@ function codeql() {
         ? 'TypeScript'
         : language[0].toUpperCase() + language.slice(1),
     'build-mode': 'none',
-    changed: true,
+    changed: changedPaths === null || languageChanged(language, changedPaths),
   }))
+  const rustEntry = languagesJson.find((item) => item.language === 'rust')
+  if (rustEntry && changedPaths !== null) {
+    const shards = configuredRustShards().map((shard) => ({
+      shard,
+      changed: shardChanged(shard, changedPaths),
+    }))
+    rustEntry.shards = shards
+    rustEntry.changed = shards.some((entry) => entry.changed)
+  }
   writeOutput('languages', languagesJson)
   for (const language of ['actions', 'javascript-typescript', 'python', 'rust']) {
     const entry = languagesJson.find((item) => item.language === language)
@@ -1032,6 +1046,105 @@ function codeql() {
   }
 }
 
+/**
+ * Changed file paths for the current pull request, read from the list the
+ * caller materializes with the pull request files API. Returns null when
+ * change detection does not apply — any event other than pull_request, a
+ * repository whose rulesets enforce the code-scanning merge gate (that gate
+ * waits for results in every tracked category, so skipped uploads deadlock
+ * merges), or a missing, unreadable, or truncated list — so callers fail
+ * open toward analyzing everything.
+ * @returns {Set<string> | null}
+ */
+function pullRequestChangedPaths() {
+  if ((process.env.FOUNDRY_EVENT_NAME ?? '') !== 'pull_request') return null
+  if (process.env.FOUNDRY_CODEQL_MERGE_GATE === 'true') return null
+  const file = process.env.FOUNDRY_CODEQL_CHANGED_FILES_FILE ?? ''
+  if (!file) return null
+  let contents = ''
+  try {
+    contents = readFileSync(file, 'utf8')
+  } catch {
+    return null
+  }
+  const paths = contents
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+  // The pull request files endpoint stops at 3000 entries; a list that large
+  // cannot prove any language unchanged.
+  if (paths.length >= 3000) return null
+  return new Set(paths)
+}
+
+/**
+ * One detected CodeQL language for the analysis matrix. `shards` carries
+ * per-scope change flags for Rust on pull requests; the matrix builder in
+ * codeql.yml falls back to the language-level flag when it is absent.
+ * @typedef {{
+ *   language: string,
+ *   name: string,
+ *   'build-mode': string,
+ *   changed: boolean,
+ *   shards?: Array<{ shard: string, changed: boolean }>,
+ * }} CodeqlLanguageEntry
+ */
+
+/**
+ * Path predicates per CodeQL language. Manifests and lockfiles count as
+ * language changes: dependency bumps alter what the analyzer sees.
+ * @type {Record<string, RegExp>}
+ */
+const CODEQL_LANGUAGE_PATHS = {
+  actions: /^\.github\/(workflows|actions)\//,
+  'javascript-typescript':
+    /\.(js|jsx|ts|tsx|mjs|cjs|mts|cts)$|(^|\/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lock|bun\.lockb|tsconfig[^/]*\.json|jsconfig[^/]*\.json)$/,
+  python: /\.py$|(^|\/)(pyproject\.toml|poetry\.lock|setup\.py|setup\.cfg|requirements[^/]*\.txt)$/,
+  rust: /\.rs$|(^|\/)(Cargo\.(toml|lock)|rust-toolchain(\.toml)?)$/,
+}
+
+/** @param {string} language @param {Set<string>} changedPaths */
+function languageChanged(language, changedPaths) {
+  const pattern = CODEQL_LANGUAGE_PATHS[language]
+  if (!pattern) return true
+  for (const path of changedPaths) if (pattern.test(path)) return true
+  return false
+}
+
+/** @returns {string[]} */
+function configuredRustShards() {
+  const raw = configured(config.codeql_rust_shards, '["all"]')
+  try {
+    const parsed = JSON.parse(raw)
+    return Array.isArray(parsed) && parsed.length ? parsed.map(String) : ['all']
+  } catch {
+    return ['all']
+  }
+}
+
+/**
+ * A scoped shard runs when a changed path falls inside one of its scope
+ * prefixes, or when a workspace-wide manifest changed: the analysis config
+ * appends the Cargo manifests and toolchain to every shard, so those files
+ * re-arm all shards at once. The `all` shard never skips.
+ * @param {string} shard @param {Set<string>} changedPaths
+ */
+function shardChanged(shard, changedPaths) {
+  if (shard === 'all') return true
+  const scopes = shard
+    .split(',')
+    .map((scope) => scope.trim())
+    .filter(Boolean)
+  for (const path of changedPaths) {
+    if (/^(Cargo\.toml|Cargo\.lock|rust-toolchain(\.toml)?)$/.test(path)) return true
+    for (const scope of scopes) {
+      const prefix = scope.endsWith('/') ? scope : `${scope}/`
+      if (path === scope || path.startsWith(prefix)) return true
+    }
+  }
+  return false
+}
+
 /** @param {string} command */
 function printProfile(command) {
   if (command === 'get') {