code-foundry 1.34.0 → 1.36.0

package/.github/workflows/cloudflare-deploy.yml

@@ -8,6 +8,11 @@ on:
         required: false
         type: string
         default: preview
+      deploy-tool:
+        description: 'Deployment CLI: wrangler (default, reads a wrangler config) or cf (Cloudflare cf CLI; deploys the cf Build Output produced by cf-wrangler build).'
+        required: false
+        type: string
+        default: wrangler
       draft-protection:
         description: 'Skip draft pull requests by default; set false to run deployments for drafts.'
         required: false
@@ -77,31 +82,71 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  affected:
-    name: Check Turbo deployment impact
+  deploy:
+    name: Cloudflare Deploy / ${{ inputs.mode }}
+    # The Turbo impact check lives here as steps instead of a separate job:
+    # one checkout and one dependency install serve both the query and the
+    # deploy. Every deployment step is skipped when the check reports the
+    # package unaffected, and the check defaults to deploying whenever it
+    # cannot run.
     if: >-
-      inputs['turbo-filter'] != '' &&
-      (github.event_name == 'pull_request' || github.event_name == 'push') &&
       vars.CI_BILLING_PAUSED != 'true' &&
       (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    permissions:
-      contents: read
+    timeout-minutes: 30
+    # The explicit deployment record below is the sole GitHub deployment record.
+    # Keep the environment for approvals, secrets, and branch protection without
+    # creating a second, competing PR timeline entry.
+    environment:
+      name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+      deployment: false
+      url: ${{ steps.deploy.outputs.url }}
     outputs:
-      should_deploy: ${{ steps.check.outputs.should_deploy || steps.resolve.outputs.should_deploy }}
+      url: ${{ steps.deploy.outputs.url }}
+      version-id: ${{ steps.deploy.outputs.version-id }}
+      github-deployment-id: ${{ steps.start.outputs.id }}
     steps:
-      - name: Checkout full history
+      - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          fetch-depth: 0
           persist-credentials: false
+          # The Turbo affected query compares the head tree against the base
+          # commit, so the checkout needs history; blob:none keeps it light.
+          fetch-depth: 0
+          filter: blob:none
+      - name: Validate deployment inputs
+        env:
+          MODE: ${{ inputs.mode }}
+          WRANGLER_VERSION: ${{ inputs.wrangler-version }}
+          DEPLOY_TOOL: ${{ inputs.deploy-tool }}
+          BUILD_SCRIPT: ${{ inputs.build-script }}
+        run: |
+          set -euo pipefail
+          [[ "$MODE" == preview || "$MODE" == production ]]
+          [[ "$DEPLOY_TOOL" == wrangler || "$DEPLOY_TOOL" == cf ]]
+          [[ "$WRANGLER_VERSION" == local || "$WRANGLER_VERSION" == latest || "$WRANGLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
+          # The cf path runs the project's cf-wrangler delegate to refresh the
+          # Build Output; that delegate comes from the app's own dependencies,
+          # which only the build step installs.
+          [[ "$DEPLOY_TOOL" != cf || -n "$BUILD_SCRIPT" ]]
+          [[ "$WRANGLER_VERSION" == local || "$WRANGLER_VERSION" == latest || "$WRANGLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
+      - name: Set up Bun
+        if: inputs.build-script != '' || inputs['turbo-filter'] != ''
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+          cache: true
+          cache-dependency-path: ${{ inputs.install-working-directory }}/bun.lock
+      - name: Install dependencies
+        if: inputs.build-script != '' || inputs['turbo-filter'] != ''
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile
       - name: Resolve Turbo package
         id: resolve
+        if: inputs['turbo-filter'] != ''
         working-directory: ${{ inputs.install-working-directory }}
         env:
           TURBO_FILTER: ${{ inputs.turbo-filter }}
@@ -150,20 +195,9 @@ jobs:
             }
           }
           NODE
-      - name: Set up Bun
-        if: steps.resolve.outputs.turbo_enabled == 'true'
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: ${{ inputs.bun-version }}
-          cache: true
-          cache-dependency-path: ${{ inputs.install-working-directory }}/bun.lock
-      - name: Install dependencies for Turbo
-        if: steps.resolve.outputs.turbo_enabled == 'true'
-        working-directory: ${{ inputs.install-working-directory }}
-        run: bun install --frozen-lockfile --ignore-scripts
       - name: Check affected build task
-        if: steps.resolve.outputs.turbo_enabled == 'true'
         id: check
+        if: inputs['turbo-filter'] != '' && steps.resolve.outputs.turbo_enabled == 'true'
         working-directory: ${{ inputs.install-working-directory }}
         env:
           TURBO_PACKAGE: ${{ steps.resolve.outputs.turbo_package }}
@@ -193,49 +227,8 @@ jobs:
           console.log(`${packageName}: ${affected ? 'affected' : 'unaffected'}`)
           appendFileSync(process.env.GITHUB_OUTPUT, `should_deploy=${affected}\n`)
           NODE
-
-  deploy:
-    name: Cloudflare Deploy / ${{ inputs.mode }}
-    needs: affected
-    if: >-
-      always() &&
-      vars.CI_BILLING_PAUSED != 'true' &&
-      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
-      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
-      github.event_name != 'pull_request_target' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
-      (
-        inputs['turbo-filter'] == '' ||
-        needs.affected.result == 'skipped' ||
-        needs.affected.outputs.should_deploy == 'true'
-      )
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    # The explicit deployment record below is the sole GitHub deployment record.
-    # Keep the environment for approvals, secrets, and branch protection without
-    # creating a second, competing PR timeline entry.
-    environment:
-      name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
-      deployment: false
-      url: ${{ steps.deploy.outputs.url }}
-    outputs:
-      url: ${{ steps.deploy.outputs.url }}
-      version-id: ${{ steps.deploy.outputs.version-id }}
-      github-deployment-id: ${{ steps.start.outputs.id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Validate deployment inputs
-        env:
-          MODE: ${{ inputs.mode }}
-          WRANGLER_VERSION: ${{ inputs.wrangler-version }}
-        run: |
-          set -euo pipefail
-          [[ "$MODE" == preview || "$MODE" == production ]]
-          [[ "$WRANGLER_VERSION" == local || "$WRANGLER_VERSION" == latest || "$WRANGLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]
       - name: Record pending deployment
+        if: steps.check.outputs.should_deploy != 'false'
         id: start
         env:
           GH_TOKEN: ${{ github.token }}
@@ -263,7 +256,7 @@ jobs:
         working-directory: ${{ inputs.install-working-directory }}
         run: bun install --frozen-lockfile
       - name: Build Worker
-        if: inputs.build-script != ''
+        if: inputs.build-script != '' && steps.check.outputs.should_deploy != 'false'
         working-directory: ${{ inputs.working-directory }}
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
@@ -273,6 +266,7 @@ jobs:
         run: bun run "$BUILD_SCRIPT"
       - name: Deploy to Cloudflare
         id: deploy
+        if: steps.check.outputs.should_deploy != 'false'
         working-directory: ${{ inputs.working-directory }}
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -281,8 +275,41 @@ jobs:
           WRANGLER_VERSION: ${{ inputs.wrangler-version }}
           MODE: ${{ inputs.mode }}
           DEPLOYMENT_URL: ${{ inputs.deployment-url }}
+          DEPLOY_TOOL: ${{ inputs.deploy-tool }}
+          PREVIEW_NAME: ${{ github.event.pull_request.number && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
         run: |
           set -euo pipefail
+          if [ "$DEPLOY_TOOL" = cf ]; then
+            # cf path: refresh the Build Output with the project's own
+            # cf-wrangler delegate, then deploy/preview it with the cf CLI.
+            # Both CLIs come from the app's devDependencies installed by the
+            # build step; the Node launcher avoids the Bun-runtime trap.
+            cfbin=(npx --no-install)
+            "${cfbin[@]}" cf-wrangler build
+            if [ "$MODE" = production ]; then
+              out="$("${cfbin[@]}" cf deploy --prebuilt)"
+              printf '%s\n' "$out"
+              version_id="$(printf '%s\n' "$out" | sed -n 's/.*Current Version ID: *//p' | head -1 | tr -d '[:space:]')"
+              value="${DEPLOYMENT_URL:-$(printf '%s\n' "$out" | grep -o 'https://[^[:space:]]*' | head -1)}"
+            else
+              "${cfbin[@]}" cf previews deploy "$PREVIEW_NAME" > "$RUNNER_TEMP/cf-preview.json"
+              value="$(jq -r '.preview_urls[0] // empty' "$RUNNER_TEMP/cf-preview.json")"
+              version_id="$(jq -r '.deployment_id // empty' "$RUNNER_TEMP/cf-preview.json")"
+            fi
+            if [[ ! "$version_id" =~ ^[0-9a-f-]{36}$ ]]; then
+              echo 'cf deploy did not report a Worker version ID' >&2
+              exit 1
+            fi
+            if [[ -z "$value" || "$value" != https://* || "$value" == *'@'* || "$value" == *'#'* || "$value" == *' '* ]]; then
+              echo 'cf deploy did not report a valid deployment URL' >&2
+              exit 1
+            fi
+            {
+              echo "url=$value"
+              echo "version-id=$version_id"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           if [ "$WRANGLER_VERSION" = local ]; then
             if [ -n "$BUILD_SCRIPT" ]; then
               wrangler=(npx --no-install wrangler)
@@ -318,7 +345,7 @@ jobs:
           appendFileSync(process.env.GITHUB_OUTPUT, `url=${url.href}\nversion-id=${record.version_id}\n`)
           NODE
       - name: Complete deployment status
-        if: always() && steps.start.outputs.id != ''
+        if: always() && steps.check.outputs.should_deploy != 'false' && steps.start.outputs.id != ''
         env:
           GH_TOKEN: ${{ github.token }}
           DEPLOYMENT_ID: ${{ steps.start.outputs.id }}

package/.github/workflows/codeql.yml

@@ -125,10 +125,47 @@ jobs:
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: List pull request files
+        id: changed
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          # Newline-separated changed paths for the runtime's change
+          # detection. A failed listing leaves the file absent and the
+          # runtime fails open toward analyzing every language and shard.
+          gh api "repos/$GITHUB_REPOSITORY/pulls/$PULL_REQUEST_NUMBER/files?per_page=100" \
+            --paginate --jq '.[].filename' > "$RUNNER_TEMP/changed-files.txt" || true
+          echo "file=$RUNNER_TEMP/changed-files.txt" >> "$GITHUB_OUTPUT"
+      - name: Detect code scanning merge gate
+        id: gate
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # The code-scanning merge gate waits for results in every tracked
+          # category, so change detection must never skip an upload while it
+          # is active. Any ruleset API failure also disables change
+          # detection: full analysis is the safe default.
+          gated=false
+          for id in $(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
+            -q '.[] | select(.enforcement == "active") | .id' 2>/dev/null); do
+            if gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
+              -q 'any(.rules[]?; .type == "code_scanning")' 2>/dev/null | grep -q true; then
+              gated=true
+              break
+            fi
+          done
+          echo "gated=$gated" >> "$GITHUB_OUTPUT"
       - id: languages
         name: Detect languages
         env:
           CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          FOUNDRY_CODEQL_CHANGED_FILES_FILE: ${{ steps.changed.outputs.file }}
+          FOUNDRY_CODEQL_MERGE_GATE: ${{ steps.gate.outputs.gated }}
           REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
@@ -166,14 +203,24 @@ jobs:
                 changed: entry.changed === true,
               }));
             const rust = languages.find((entry) => entry.language === "rust");
-            for (const shard of rust ? shards : []) {
+            // The runtime emits per-shard change flags when the event is a
+            // pull request with a usable changed-file list; fall back to the
+            // shard list of the caller with the language-level flag
+            // otherwise. No single quotes: this script runs through node -e.
+            const rustShards =
+              rust && Array.isArray(rust.shards) && rust.shards.length
+                ? rust.shards
+                : (rust
+                    ? shards.map((shard) => ({ shard: String(shard), changed: rust.changed === true }))
+                    : []);
+            for (const entry of rustShards) {
               matrix.push({
-                display: String(shard) === "all" ? "Rust" : "Rust (" + shard + ")",
+                display: entry.shard === "all" ? "Rust" : "Rust (" + entry.shard + ")",
                 language: "rust",
                 category: "/language:rust",
                 build_mode: "none",
-                changed: rust.changed === true,
-                shard: String(shard),
+                changed: entry.changed === true,
+                shard: String(entry.shard),
               });
             }
             if (!matrix.length) {

package/.github/workflows/opencode-security_self-ci.yml

@@ -14,7 +14,13 @@ permissions:
 jobs:
   detect:
     name: OpenCode Security / Detect
-    if: vars.CI_BILLING_PAUSED != 'true' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
+    # The OPENCODE_SECURITY repository or organization variable is the only
+    # enablement control, so gate the detector itself on it: a disabled
+    # repository must not allocate a runner just to report that it is off.
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      vars.OPENCODE_SECURITY == 'true' &&
+      (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
     runs-on: ubuntu-slim
     timeout-minutes: 10
     outputs:

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [1.36.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.35.0...v1.36.0) (2026-09-29)
+
+
+### Features
+
+* **cloudflare:** add a cf deploy mode to cloudflare-deploy.yml ([#658](https://github.com/0xPlayerOne/code-foundry/issues/658)) ([31ef8ca](https://github.com/0xPlayerOne/code-foundry/commit/31ef8ca607c189d7ca0bbe4f42de85ee27edabc9))
+
+## [1.35.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.34.0...v1.35.0) (2026-09-29)
+
+
+### Features
+
+* fold the Turbo impact check into the cloudflare deploy job ([#655](https://github.com/0xPlayerOne/code-foundry/issues/655)) ([b72f5f2](https://github.com/0xPlayerOne/code-foundry/commit/b72f5f26f045103755bb2795f2fc3a84e7625b3c))
+* scope CodeQL analysis to changed languages and Rust shards on pull requests ([#654](https://github.com/0xPlayerOne/code-foundry/issues/654)) ([d5ce743](https://github.com/0xPlayerOne/code-foundry/commit/d5ce74377601c2efb3be4831320cb62cdfbd999b))
+* skip the security detector entirely while OpenCode Security is disabled ([#653](https://github.com/0xPlayerOne/code-foundry/issues/653)) ([9e4271e](https://github.com/0xPlayerOne/code-foundry/commit/9e4271e597d65b4f63c571baab5507eacaab1ce5))
+
+
+### Maintenance
+
+* raise the packed artifact budget to 286 kB ([#657](https://github.com/0xPlayerOne/code-foundry/issues/657)) ([4512af7](https://github.com/0xPlayerOne/code-foundry/commit/4512af75fc18a36292f495c5e7f51791ba38f3d6))
+
 ## [1.34.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.3...v1.34.0) (2026-09-29)
 
 

package/docs/CONFIGURATION.md

@@ -280,6 +280,15 @@ every tracked category. Two practical consequences:
   categories in the shard list keeps the gate green but re-runs their analysis
   on every pull request and is not a substitute for cleanup.
 
+On pull requests without a code-scanning merge gate, analyzers run only for
+languages with changed files, and Rust shards run only when their scope (or a
+workspace-wide `Cargo` manifest or toolchain file) changed; unchanged matrix
+entries report `Not applicable` instead of analyzing. Repositories whose
+rulesets enforce a code-scanning requirement are detected automatically and
+analyze everything, because that merge gate waits for results in every tracked
+category. Push, schedule, and merge-queue events always analyze the complete
+set so the default branch keeps one full, comparable baseline.
+
 ## Cloudflare Workers
 
 Repositories that deploy to Cloudflare Workers can use the opt-in verified
@@ -292,7 +301,13 @@ repository and configure environment reviewers separately.
 The legacy `cloudflare-deploy.yml` workflow remains available for direct
 (unverified) deployments. It runs `wrangler versions upload` for previews and
 `wrangler deploy` for production, records a GitHub deployment plus status, and
-respects `CI_BILLING_PAUSED`. Preview deployment records use the pull request
+respects `CI_BILLING_PAUSED`. With `deploy-tool: cf` it instead deploys through
+the Cloudflare cf CLI: production runs `cf-wrangler build` plus
+`cf deploy --prebuilt` (consuming the project's cf Build Output), previews run
+`cf previews deploy` named after the pull request or branch, and the cf/wrangler
+CLIs must be devDependencies of the deployed package (the build step installs
+them), so `build-script` is required. Deployment URLs and version IDs are
+extracted from the same job outputs either way. Preview deployment records use the pull request
 head SHA when called from a PR, which lets GitHub show the completed preview in
 the PR's Deployments section; direct pushes use the workflow SHA. Its
 legacy-compatible Wrangler default is `latest`; callers should prefer `local` or

package/docs/WORKFLOWS.md

@@ -126,7 +126,11 @@ Custom workflows are repository-owned and are not rewritten by sync. Add
 honor the shared billing pause. The optional OpenCode Security scan honors a
 second toggle: the `OPENCODE_SECURITY` repository or organization variable
 (`true`/`false`) is its only enablement control, so individual repositories can
-opt in or out without a code change.
+opt in or out without a code change. When the variable is not `true`, no
+Security job runs at all — a disabled repository allocates no runner for it.
+Repository variables override the organization value, so an organization-level
+variable toggles every consumer in one place while a single repository can
+still opt out (or in) independently.
 
 Dependabot is the one billable runner source the variable cannot gate: its
 update runs execute under the `dynamic` event, outside every job-level guard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.34.0",
+  "version": "1.36.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/runtime-core.mjs

@@ -1011,8 +1011,13 @@ function codeql() {
     available.push('javascript-typescript')
   if (hasLanguage('python')) available.push('python')
   if (hasLanguage('rust')) available.push('rust')
-  // Upload every configured language on every analysis run so GitHub can
-  // compare pull requests against the base branch's code-scanning config.
+  // On pull requests, analyzers whose language has no changed files skip
+  // their analysis steps, and Rust shards skip individually by scope. Every
+  // other event analyzes the complete set so the default branch keeps one
+  // full, comparable code-scanning baseline; a missing or unreadable
+  // changed-file list also fails open toward analyzing everything.
+  const changedPaths = pullRequestChangedPaths()
+  /** @type {CodeqlLanguageEntry[]} */
   const languagesJson = available.map((language) => ({
     language,
     name:
@@ -1020,8 +1025,17 @@ function codeql() {
         ? 'TypeScript'
         : language[0].toUpperCase() + language.slice(1),
     'build-mode': 'none',
-    changed: true,
+    changed: changedPaths === null || languageChanged(language, changedPaths),
   }))
+  const rustEntry = languagesJson.find((item) => item.language === 'rust')
+  if (rustEntry && changedPaths !== null) {
+    const shards = configuredRustShards().map((shard) => ({
+      shard,
+      changed: shardChanged(shard, changedPaths),
+    }))
+    rustEntry.shards = shards
+    rustEntry.changed = shards.some((entry) => entry.changed)
+  }
   writeOutput('languages', languagesJson)
   for (const language of ['actions', 'javascript-typescript', 'python', 'rust']) {
     const entry = languagesJson.find((item) => item.language === language)
@@ -1032,6 +1046,105 @@ function codeql() {
   }
 }
 
+/**
+ * Changed file paths for the current pull request, read from the list the
+ * caller materializes with the pull request files API. Returns null when
+ * change detection does not apply — any event other than pull_request, a
+ * repository whose rulesets enforce the code-scanning merge gate (that gate
+ * waits for results in every tracked category, so skipped uploads deadlock
+ * merges), or a missing, unreadable, or truncated list — so callers fail
+ * open toward analyzing everything.
+ * @returns {Set<string> | null}
+ */
+function pullRequestChangedPaths() {
+  if ((process.env.FOUNDRY_EVENT_NAME ?? '') !== 'pull_request') return null
+  if (process.env.FOUNDRY_CODEQL_MERGE_GATE === 'true') return null
+  const file = process.env.FOUNDRY_CODEQL_CHANGED_FILES_FILE ?? ''
+  if (!file) return null
+  let contents = ''
+  try {
+    contents = readFileSync(file, 'utf8')
+  } catch {
+    return null
+  }
+  const paths = contents
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+  // The pull request files endpoint stops at 3000 entries; a list that large
+  // cannot prove any language unchanged.
+  if (paths.length >= 3000) return null
+  return new Set(paths)
+}
+
+/**
+ * One detected CodeQL language for the analysis matrix. `shards` carries
+ * per-scope change flags for Rust on pull requests; the matrix builder in
+ * codeql.yml falls back to the language-level flag when it is absent.
+ * @typedef {{
+ *   language: string,
+ *   name: string,
+ *   'build-mode': string,
+ *   changed: boolean,
+ *   shards?: Array<{ shard: string, changed: boolean }>,
+ * }} CodeqlLanguageEntry
+ */
+
+/**
+ * Path predicates per CodeQL language. Manifests and lockfiles count as
+ * language changes: dependency bumps alter what the analyzer sees.
+ * @type {Record<string, RegExp>}
+ */
+const CODEQL_LANGUAGE_PATHS = {
+  actions: /^\.github\/(workflows|actions)\//,
+  'javascript-typescript':
+    /\.(js|jsx|ts|tsx|mjs|cjs|mts|cts)$|(^|\/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lock|bun\.lockb|tsconfig[^/]*\.json|jsconfig[^/]*\.json)$/,
+  python: /\.py$|(^|\/)(pyproject\.toml|poetry\.lock|setup\.py|setup\.cfg|requirements[^/]*\.txt)$/,
+  rust: /\.rs$|(^|\/)(Cargo\.(toml|lock)|rust-toolchain(\.toml)?)$/,
+}
+
+/** @param {string} language @param {Set<string>} changedPaths */
+function languageChanged(language, changedPaths) {
+  const pattern = CODEQL_LANGUAGE_PATHS[language]
+  if (!pattern) return true
+  for (const path of changedPaths) if (pattern.test(path)) return true
+  return false
+}
+
+/** @returns {string[]} */
+function configuredRustShards() {
+  const raw = configured(config.codeql_rust_shards, '["all"]')
+  try {
+    const parsed = JSON.parse(raw)
+    return Array.isArray(parsed) && parsed.length ? parsed.map(String) : ['all']
+  } catch {
+    return ['all']
+  }
+}
+
+/**
+ * A scoped shard runs when a changed path falls inside one of its scope
+ * prefixes, or when a workspace-wide manifest changed: the analysis config
+ * appends the Cargo manifests and toolchain to every shard, so those files
+ * re-arm all shards at once. The `all` shard never skips.
+ * @param {string} shard @param {Set<string>} changedPaths
+ */
+function shardChanged(shard, changedPaths) {
+  if (shard === 'all') return true
+  const scopes = shard
+    .split(',')
+    .map((scope) => scope.trim())
+    .filter(Boolean)
+  for (const path of changedPaths) {
+    if (/^(Cargo\.toml|Cargo\.lock|rust-toolchain(\.toml)?)$/.test(path)) return true
+    for (const scope of scopes) {
+      const prefix = scope.endsWith('/') ? scope : `${scope}/`
+      if (path === scope || path.startsWith(prefix)) return true
+    }
+  }
+  return false
+}
+
 /** @param {string} command */
 function printProfile(command) {
   if (command === 'get') {