code-foundry 1.37.3 → 1.38.0

package/.github/workflows/cloudflare-delivery.yml

@@ -120,31 +120,105 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  affected:
-    name: Check Turbo delivery impact
+  candidate:
+    # The Turbo impact check lives here as steps instead of a separate job:
+    # one checkout and one dependency install serve both the query and the
+    # candidate build (mirrors the cloudflare-deploy.yml fold). Every
+    # delivery step is skipped when the package is unaffected, and the check
+    # defaults to deploying whenever it cannot run.
     if: >-
-      inputs['turbo-filter'] != '' &&
-      (github.event_name == 'pull_request' || github.event_name == 'push') &&
       vars.CI_BILLING_PAUSED != 'true' &&
       (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
       (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
+    timeout-minutes: 40
+    # The explicit deployment record below is the sole GitHub deployment record.
+    # Keep the environment for approvals, secrets, and branch protection without
+    # creating a second, competing PR timeline entry.
+    environment:
+      name: Preview
+      deployment: false
+      url: ${{ steps.upload.outputs.url }}
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      FOUNDRY_MODE: ${{ inputs.mode }}
+      FOUNDRY_WORKER: ${{ inputs.worker-name }}
+      FOUNDRY_PHASE: candidate
+      FOUNDRY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+      ARTIFACT_PATH: ${{ inputs.artifact-path }}
+      VERIFY_COMMAND: ${{ inputs.verify-command }}
+      SMOKE_PATH: ${{ inputs.smoke-path }}
+      WRANGLER_VERSION: ${{ inputs.wrangler-version }}
+      WRANGLER_ENVIRONMENT: ${{ inputs.wrangler-environment }}
+      WRANGLER_CONFIG: ${{ inputs.wrangler-config }}
+      BINDING_POLICY_FILE: ${{ inputs.binding-policy-file }}
+      DEPLOYMENT_ENVIRONMENT: Preview
     outputs:
-      should_deploy: ${{ steps.check.outputs.should_deploy || steps.resolve.outputs.should_deploy }}
+      url: ${{ steps.upload.outputs.url }}
+      version-id: ${{ steps.upload.outputs.version-id }}
+      artifact-digest: ${{ steps.upload.outputs.artifact-digest }}
+      source-sha: ${{ steps.upload.outputs.source-sha }}
+      verified: ${{ steps.verify.outputs.verified }}
+      github-deployment-id: ${{ steps.start.outputs.github-deployment-id }}
     steps:
-      - name: Checkout full history
+      - name: Checkout source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          # The Turbo affected query compares the head tree against the base
+          # commit, so the checkout needs history; blob:none keeps it light.
           fetch-depth: 0
+          filter: blob:none
+      - name: Validate inputs
+        env:
+          RUNTIME_REF: ${{ inputs.runtime-ref }}
+          CANARY_PERCENTAGE: ${{ inputs.canary-percentage }}
+          CANARY_VERIFY_COMMAND: ${{ inputs.canary-verify-command }}
+          PRODUCTION_URL: ${{ inputs.production-url }}
+        run: |
+          set -euo pipefail
+          [[ "$RUNTIME_REF" =~ ^[0-9a-fA-F]{40}$ ]]
+          [[ "$FOUNDRY_MODE" == preview || "$FOUNDRY_MODE" == production ]]
+          node --input-type=module <<'NODE'
+          const percentage = Number(process.env.CANARY_PERCENTAGE)
+          if (!Number.isFinite(percentage) || percentage < 0.01 || percentage > 100 || (percentage < 100 && percentage > 99.99)) process.exit(1)
+          if (process.env.FOUNDRY_MODE === 'production' && percentage < 100) {
+            let argv
+            try { argv = JSON.parse(process.env.CANARY_VERIFY_COMMAND ?? '') } catch { process.exit(1) }
+            if (!Array.isArray(argv) || !argv.length || argv.some((arg) => typeof arg !== 'string' || !arg.length || arg.includes('\0'))) process.exit(1)
+          }
+          NODE
+          if [[ "$FOUNDRY_MODE" == production ]]; then
+            [[ "$GITHUB_REF" == "refs/heads/$FOUNDRY_DEFAULT_BRANCH" ]]
+            [[ "$PRODUCTION_URL" == https://* ]]
+          fi
+      - name: Checkout delivery runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: 0xPlayerOne/code-foundry
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry-delivery
           persist-credentials: false
+          sparse-checkout: src
+      - name: Prepare delivery state
+        run: |
+          echo "FOUNDRY_EXECUTOR=$GITHUB_WORKSPACE/.github/.code-foundry-delivery/src/commands/cloudflare-delivery.mjs" >> "$GITHUB_ENV"
+          echo "FOUNDRY_STATE_FILE=$RUNNER_TEMP/cloudflare-candidate.json" >> "$GITHUB_ENV"
+      - name: Set up Bun
+        if: inputs.build-script != '' || inputs['turbo-filter'] != ''
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install locked dependencies
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile
       - name: Resolve Turbo package
         id: resolve
+        if: inputs['turbo-filter'] != ''
         working-directory: ${{ inputs.install-working-directory }}
         env:
           TURBO_FILTER: ${{ inputs.turbo-filter }}
@@ -193,17 +267,7 @@ jobs:
             }
           }
           NODE
-      - name: Set up Bun
-        if: steps.resolve.outputs.turbo_enabled == 'true'
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: ${{ inputs.bun-version }}
-      - name: Install dependencies for Turbo
-        if: steps.resolve.outputs.turbo_enabled == 'true'
-        working-directory: ${{ inputs.install-working-directory }}
-        run: bun install --frozen-lockfile --ignore-scripts
       - name: Check affected build task
-        if: steps.resolve.outputs.turbo_enabled == 'true'
         id: check
         working-directory: ${{ inputs.install-working-directory }}
         env:
@@ -234,138 +298,48 @@ jobs:
           console.log(`${packageName}: ${affected ? 'affected' : 'unaffected'}`)
           appendFileSync(process.env.GITHUB_OUTPUT, `should_deploy=${affected}\n`)
           NODE
-
-  candidate:
-    needs: affected
-    if: >-
-      always() &&
-      vars.CI_BILLING_PAUSED != 'true' &&
-      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
-      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
-      github.event_name != 'pull_request_target' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
-      (
-        inputs['turbo-filter'] == '' ||
-        needs.affected.result == 'skipped' ||
-        needs.affected.outputs.should_deploy == 'true'
-      )
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # The explicit deployment record below is the sole GitHub deployment record.
-    # Keep the environment for approvals, secrets, and branch protection without
-    # creating a second, competing PR timeline entry.
-    environment:
-      name: Preview
-      deployment: false
-      url: ${{ steps.upload.outputs.url }}
-    defaults:
-      run:
-        working-directory: ${{ inputs.working-directory }}
-    env:
-      FOUNDRY_MODE: ${{ inputs.mode }}
-      FOUNDRY_WORKER: ${{ inputs.worker-name }}
-      FOUNDRY_PHASE: candidate
-      FOUNDRY_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-      ARTIFACT_PATH: ${{ inputs.artifact-path }}
-      VERIFY_COMMAND: ${{ inputs.verify-command }}
-      SMOKE_PATH: ${{ inputs.smoke-path }}
-      WRANGLER_VERSION: ${{ inputs.wrangler-version }}
-      WRANGLER_ENVIRONMENT: ${{ inputs.wrangler-environment }}
-      WRANGLER_CONFIG: ${{ inputs.wrangler-config }}
-      BINDING_POLICY_FILE: ${{ inputs.binding-policy-file }}
-      DEPLOYMENT_ENVIRONMENT: Preview
-    outputs:
-      url: ${{ steps.upload.outputs.url }}
-      version-id: ${{ steps.upload.outputs.version-id }}
-      artifact-digest: ${{ steps.upload.outputs.artifact-digest }}
-      source-sha: ${{ steps.upload.outputs.source-sha }}
-      verified: ${{ steps.verify.outputs.verified }}
-      github-deployment-id: ${{ steps.start.outputs.github-deployment-id }}
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Validate inputs
-        env:
-          RUNTIME_REF: ${{ inputs.runtime-ref }}
-          CANARY_PERCENTAGE: ${{ inputs.canary-percentage }}
-          CANARY_VERIFY_COMMAND: ${{ inputs.canary-verify-command }}
-          PRODUCTION_URL: ${{ inputs.production-url }}
-        run: |
-          set -euo pipefail
-          [[ "$RUNTIME_REF" =~ ^[0-9a-fA-F]{40}$ ]]
-          [[ "$FOUNDRY_MODE" == preview || "$FOUNDRY_MODE" == production ]]
-          node --input-type=module <<'NODE'
-          const percentage = Number(process.env.CANARY_PERCENTAGE)
-          if (!Number.isFinite(percentage) || percentage < 0.01 || percentage > 100 || (percentage < 100 && percentage > 99.99)) process.exit(1)
-          if (process.env.FOUNDRY_MODE === 'production' && percentage < 100) {
-            let argv
-            try { argv = JSON.parse(process.env.CANARY_VERIFY_COMMAND ?? '') } catch { process.exit(1) }
-            if (!Array.isArray(argv) || !argv.length || argv.some((arg) => typeof arg !== 'string' || !arg.length || arg.includes('\0'))) process.exit(1)
-          }
-          NODE
-          if [[ "$FOUNDRY_MODE" == production ]]; then
-            [[ "$GITHUB_REF" == "refs/heads/$FOUNDRY_DEFAULT_BRANCH" ]]
-            [[ "$PRODUCTION_URL" == https://* ]]
-          fi
-      - name: Checkout delivery runtime
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          repository: 0xPlayerOne/code-foundry
-          ref: ${{ inputs.runtime-ref }}
-          path: .github/.code-foundry-delivery
-          persist-credentials: false
-          sparse-checkout: src
-      - name: Prepare delivery state
-        run: |
-          echo "FOUNDRY_EXECUTOR=$GITHUB_WORKSPACE/.github/.code-foundry-delivery/src/commands/cloudflare-delivery.mjs" >> "$GITHUB_ENV"
-          echo "FOUNDRY_STATE_FILE=$RUNNER_TEMP/cloudflare-candidate.json" >> "$GITHUB_ENV"
       - name: Record pending application deployment
+        if: steps.check.outputs.should_deploy != 'false'
         id: start
         env:
           GH_TOKEN: ${{ github.token }}
           GITHUB_DEPLOYMENT_REF: ${{ github.event.pull_request.head.sha || github.sha }}
         run: node "$FOUNDRY_EXECUTOR" record-start
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: ${{ inputs.bun-version }}
-      - name: Install locked dependencies
-        working-directory: ${{ inputs.install-working-directory }}
-        run: bun install --frozen-lockfile
       - name: Build candidate
-        if: inputs.build-script != ''
+        if: inputs.build-script != '' && steps.check.outputs.should_deploy != 'false'
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
         run: bun run "$BUILD_SCRIPT"
       - name: Reject stale production source
-        if: inputs.mode == 'production'
+        if: inputs.mode == 'production' && steps.check.outputs.should_deploy != 'false'
         env:
           GH_TOKEN: ${{ github.token }}
         run: node "$FOUNDRY_EXECUTOR" assert-current
       - name: Upload candidate without changing traffic
+        if: steps.check.outputs.should_deploy != 'false'
         id: upload
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         run: node "$FOUNDRY_EXECUTOR" upload
       - name: Inspect actual candidate bindings
+        if: steps.check.outputs.should_deploy != 'false'
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         run: node "$FOUNDRY_EXECUTOR" inspect
       - name: Verify candidate
+        if: steps.check.outputs.should_deploy != 'false'
         id: verify
         run: node "$FOUNDRY_EXECUTOR" verify
       - name: Complete application deployment status
-        if: always() && steps.start.outputs.github-deployment-id != ''
+        if: always() && steps.check.outputs.should_deploy != 'false' && steps.start.outputs.github-deployment-id != ''
         env:
           GH_TOKEN: ${{ github.token }}
           DEPLOYMENT_STATUS: ${{ job.status }}
         run: node "$FOUNDRY_EXECUTOR" record-finish
       - name: Preserve candidate evidence
-        if: always() && steps.start.outputs.github-deployment-id != ''
+        if: always() && steps.check.outputs.should_deploy != 'false' && steps.start.outputs.github-deployment-id != ''
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cloudflare-candidate-${{ inputs.worker-name }}-${{ github.run_id }}-${{ github.run_attempt }}

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.38.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.37.3...v1.38.0) (2026-09-30)
+
+
+### Features
+
+* fold the Turbo impact check into the delivery candidate job ([#676](https://github.com/0xPlayerOne/code-foundry/issues/676)) ([fd99d29](https://github.com/0xPlayerOne/code-foundry/commit/fd99d29ae7e10ef9346b8059dcad0ed4df6df109))
+
 ## [1.37.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.37.2...v1.37.3) (2026-09-30)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.37.3",
+  "version": "1.38.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {