code-foundry 1.38.1 → 1.39.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.39.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.0...v1.39.1) (2026-10-01)
+
+
+### Bug Fixes
+
+* report inactive main rulesets in github doctor ([#682](https://github.com/0xPlayerOne/code-foundry/issues/682)) ([695a0b4](https://github.com/0xPlayerOne/code-foundry/commit/695a0b437910aa8e664a481c1648dbadcc1a2de8))
+
+## [1.39.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.38.1...v1.39.0) (2026-10-01)
+
+
+### Features
+
+* **ci:** surface ungated scheduled workflows in the billing pause controls ([#681](https://github.com/0xPlayerOne/code-foundry/issues/681)) ([ef48f9a](https://github.com/0xPlayerOne/code-foundry/commit/ef48f9a25aa0b22f82b0ed8a512bc1a65d08d8e9))
+
+
+### Maintenance
+
+* register the adea-ai ui and themes consumers in the fleet manifest ([#680](https://github.com/0xPlayerOne/code-foundry/issues/680)) ([f50e6c6](https://github.com/0xPlayerOne/code-foundry/commit/f50e6c6a4ef4b7f0396cdce21f53070fec818c50))
+
 ## [1.38.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.38.0...v1.38.1) (2026-09-30)
 
 

package/docs/WORKFLOWS.md

@@ -123,7 +123,10 @@ throughout the bounded release flow.
 
 Custom workflows are repository-owned and are not rewritten by sync. Add
 `if: vars.CI_BILLING_PAUSED != 'true'` to each custom root job that should
-honor the shared billing pause. The optional OpenCode Security scan honors a
+honor the shared billing pause. `npx code-foundry ci status` lists custom
+scheduled workflows that lack the guard, and `pause` warns about them: a cron
+workflow without the guard keeps allocating runners while CI is paused. The
+optional OpenCode Security scan honors a
 second toggle: the `OPENCODE_SECURITY` repository or organization variable
 (`true`/`false`) is its only enablement control, so individual repositories can
 opt in or out without a code change. When the variable is not `true`, no
@@ -308,6 +311,12 @@ features and enforce only checks that actually run:
 Apply only checks for enabled workflows.
 ```
 
+`code-foundry doctor --github` treats a matching `main` ruleset in `disabled`
+or `evaluate` mode as an error because neither mode blocks merges. If GitHub
+does not expose branch protection or rulesets for the repository, the doctor
+warns that enforcement could not be confirmed instead of inferring an active
+policy from unavailable data.
+
 Keep strict status checks, linear history, and conversation resolution enabled
 where required. For a repository with optional features disabled, do not require
 checks that will never run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.38.1",
+  "version": "1.39.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/ci.mjs

@@ -1,7 +1,7 @@
 // @ts-check
 
 import { spawnSync } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { readConfig } from '../lib/config.mjs'
 
 export const CI_BILLING_PAUSED_VARIABLE = 'CI_BILLING_PAUSED'
@@ -29,12 +29,14 @@ export function manageCiBilling(root, action) {
 
   if (action === 'status') {
     const dependabot = dependabotPauseState(root)
+    const ungatedSchedules = ungatedScheduledWorkflows(root)
     const result = {
       repository,
       paused,
       requiredCheck: CI_BILLING_REQUIRED_CHECK,
       backupPresent: Boolean(backup),
       dependabot,
+      ungatedSchedules,
     }
     console.log(JSON.stringify(result, null, 2))
     return result
@@ -92,6 +94,7 @@ export function manageCiBilling(root, action) {
     const cancelledRuns = cancelActiveRuns(repository)
     for (const change of changes) updateRuleset(repository, change.ruleset)
     const dependabot = dependabotPauseState(root)
+    const ungatedSchedules = ungatedScheduledWorkflows(root)
     const result = {
       repository,
       paused: true,
@@ -110,6 +113,19 @@ export function manageCiBilling(root, action) {
               'and run a sync so dependabot.yml renders open-pull-requests-limit: 0.',
           }
         : {}),
+      // Cron workflows are repository-owned, so sync cannot add the guard.
+      // List any that would keep firing on schedule while paused.
+      ungatedSchedules,
+      ...(ungatedSchedules.length
+        ? {
+            scheduleWarning:
+              `Scheduled workflows without a ${CI_BILLING_PAUSED_VARIABLE} job guard keep ` +
+              `running while paused: ${ungatedSchedules
+                .map((/** @type {{ file: string }} */ entry) => entry.file)
+                .join(', ')}. Add ` +
+              "`if: vars.CI_BILLING_PAUSED != 'true'` to each of their jobs.",
+          }
+        : {}),
     }
     console.log(JSON.stringify(result, null, 2))
     return result
@@ -175,6 +191,52 @@ export function dependabotPauseState(root) {
   return { configured, active, file }
 }
 
+/**
+ * List custom cron workflows that the `CI_BILLING_PAUSED` variable does not
+ * gate. Sync keeps every managed workflow referencing the variable, so a
+ * scheduled workflow without that token is repository-owned, and its cron
+ * jobs keep allocating runners while CI is paused — the same gap Dependabot
+ * has, but one a one-line job guard can close.
+ *
+ * @param {string} root
+ * @returns {{ file: string, crons: string[] }[]}
+ */
+export function ungatedScheduledWorkflows(root) {
+  const dir = `${root.replace(/\/$/, '')}/.github/workflows`
+  if (!existsSync(dir)) return []
+  const gated = []
+  for (const entry of readdirSync(dir)) {
+    if (!/\.ya?ml$/.test(entry)) continue
+    const source = readFileSync(`${dir}/${entry}`, 'utf8')
+    if (source.includes(CI_BILLING_PAUSED_VARIABLE)) continue
+    const triggers = workflowTriggerBlock(source)
+    if (!triggers || !/^  schedule:/m.test(triggers)) continue
+    const crons = [...triggers.matchAll(/^\s*-\s*cron:\s*(.+?)\s*$/gm)].flatMap(
+      (/** @type {RegExpMatchArray} */ match) => [
+        match[1].replace(/^['"]|['"]$/g, '').replace(/\s+#.*$/, ''),
+      ]
+    )
+    gated.push({ file: `.github/workflows/${entry}`, crons })
+  }
+  return gated
+}
+
+/**
+ * Return the block-form `on:` section of a workflow, or null when the file
+ * has none. Dependency-free on purpose: the runtime avoids a YAML parser,
+ * and the block ends at the next top-level key.
+ *
+ * @param {string} source
+ * @returns {string | null}
+ */
+function workflowTriggerBlock(source) {
+  const start = source.search(/^on:\s*$/m)
+  if (start < 0) return null
+  const rest = source.slice(start + 3)
+  const end = rest.search(/^[A-Za-z_-]+:/m)
+  return end >= 0 ? rest.slice(0, end) : rest
+}
+
 /** @param {any} ruleset */
 export function buildPausedRuleset(ruleset) {
   const requiredRuleIndexes = (ruleset.rules ?? []).flatMap(

package/src/lib/github-doctor.mjs

@@ -18,6 +18,24 @@ export function doctorGithub(root) {
   const details = { repository }
   const rulesets = hydrateRulesets(repository, ghJson(['api', `repos/${repository}/rulesets`]))
   const mainRulesets = rulesetsForBranch(rulesets, 'main')
+  details.mainRulesets = mainRulesets.map((ruleset) => ({
+    id: ruleset.id ?? null,
+    name: ruleset.name ?? String(ruleset.id ?? 'unnamed'),
+    enforcement: ruleset.enforcement ?? null,
+  }))
+  for (const ruleset of mainRulesets) {
+    const name = ruleset.name ?? ruleset.id ?? 'unnamed'
+    if (ruleset.enforcement === 'disabled') {
+      errors.push(`main ruleset ${name} is disabled; its branch rules are not enforced.`)
+    } else if (ruleset.enforcement === 'evaluate') {
+      errors.push(`main ruleset ${name} is evaluate-only; its branch rules are not enforced.`)
+    } else if (ruleset.enforcement !== 'active') {
+      const state = ruleset.enforcement ?? 'missing'
+      warnings.push(
+        `main ruleset ${name} enforcement state '${state}' could not be confirmed; expected active.`
+      )
+    }
+  }
   const protection = ghJson(['api', `repos/${repository}/branches/main/protection`])
   const required = mainRulesets.length
     ? requiredContextsFromRulesets(mainRulesets)