code-foundry 1.44.0 → 1.44.2

package/.github/CONTRIBUTING.md

@@ -225,7 +225,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 
-Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
+Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Pushes to `main`, release, promotion, publication, and deployment runs never cancel in progress; a newer run queues behind the current one. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 

package/.github/workflows/ci.yml

@@ -47,7 +47,10 @@ env:
 
 concurrency:
   group: code-foundry-ci-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   format:

package/.github/workflows/codeql.yml

@@ -52,7 +52,10 @@ env:
 
 concurrency:
   group: code-foundry-codeql-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   detect:

package/.github/workflows/consumer-qualification.yml

@@ -46,6 +46,10 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'
+      - name: Trim the packaged changelog to recent releases
+        # Rewrites only this job's ephemeral checkout; the repository keeps the
+        # full CHANGELOG.md that Release Please maintains.
+        run: node scripts/package-changelog.mjs CHANGELOG.md
       - name: Pack the distributable once
         id: pack
         run: |

package/.github/workflows/draft-control_self-ci.yml

@@ -10,6 +10,10 @@ permissions:
   actions: write
   contents: read
 
+concurrency:
+  group: code-foundry-draft-control-${{ github.repository }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   cancel:
     name: Draft Control / Halt CI

package/.github/workflows/eval.yml

@@ -43,7 +43,10 @@ env:
 
 concurrency:
   group: code-foundry-eval-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   eval:

package/.github/workflows/opencode-security_self-ci.yml

@@ -11,6 +11,11 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: code-foundry-opencode-security-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  # Only superseded pull-request scans are cancelled; dispatches queue.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   detect:
     name: OpenCode Security / Detect

package/.github/workflows/release-pr.yml

@@ -28,7 +28,9 @@ jobs:
     timeout-minutes: 10
     concurrency:
       group: code-foundry-release-pr-${{ github.repository }}-${{ github.ref }}
-      cancel-in-progress: true
+      # Promotion updates a release pull request; never cancel it mid-update.
+      # A newer push waits, and GitHub keeps only the newest pending run.
+      cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

package/.github/workflows/security.yml

@@ -31,7 +31,10 @@ env:
 
 concurrency:
   group: code-foundry-security-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   profile:

package/.github/workflows/test.yml

@@ -69,7 +69,10 @@ env:
 
 concurrency:
   group: code-foundry-test-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   unit:

package/.github/workflows/validation_self-ci.yml

@@ -16,7 +16,10 @@ permissions: {}
 # Superseded PR updates cancel the previous run.
 concurrency:
   group: code-foundry-validation-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   mode:

package/AGENTS.md

@@ -240,7 +240,8 @@ readying a pull request.
 - Keep workflows concise, independently runnable, and safe to re-run.
 - Use `push` for `main` and `pull_request` for `main` unless a workflow has a documented event-specific reason.
 - Give workflows clear names and jobs concise names; avoid repeating the workflow name in the job name.
-- Use per-workflow concurrency groups that cancel superseded runs while allowing independent workflows to run in parallel.
+- Use per-workflow concurrency groups keyed by pull request or ref that cancel superseded pull-request runs while allowing independent workflows to run in parallel. Do not cancel in progress for pushes to `main`, release, publication, or deployment runs; let them queue.
+- Do not put `always()` on heavy jobs: it keeps a cancelled run alive and holding its concurrency group. Use `!cancelled()` for jobs that must run after upstream failures, and keep `always()` for lightweight aggregate gates only.
 - Keep setup language-aware and cache dependency downloads by lockfile; do not cache secrets, `node_modules`, virtual environments, or broad build output without a measured reason.
 - Use least-privilege permissions and pin action versions consistently with the template.
 - Keep CI, Test, Security, CodeQL, Draft Guard, Draft PR, Release PR, and Release concerns separated.