code-foundry 1.44.1 → 1.44.3

package/.github/CONTRIBUTING.md

@@ -225,7 +225,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 
-Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
+Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Pushes to `main`, release, promotion, publication, and deployment runs never cancel in progress; a newer run queues behind the current one. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Pull-request and scheduled/manual callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate. Main pushes run the default-branch CodeQL lane separately.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 

package/.github/workflows/ci.yml

@@ -47,7 +47,10 @@ env:
 
 concurrency:
   group: code-foundry-ci-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   format:

package/.github/workflows/codeql.yml

@@ -52,7 +52,10 @@ env:
 
 concurrency:
   group: code-foundry-codeql-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   detect:

package/.github/workflows/draft-control_self-ci.yml

@@ -10,6 +10,10 @@ permissions:
   actions: write
   contents: read
 
+concurrency:
+  group: code-foundry-draft-control-${{ github.repository }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   cancel:
     name: Draft Control / Halt CI

package/.github/workflows/eval.yml

@@ -43,7 +43,10 @@ env:
 
 concurrency:
   group: code-foundry-eval-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   eval:

package/.github/workflows/opencode-security_self-ci.yml

@@ -11,6 +11,11 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: code-foundry-opencode-security-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  # Only superseded pull-request scans are cancelled; dispatches queue.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   detect:
     name: OpenCode Security / Detect

package/.github/workflows/release-pr.yml

@@ -28,7 +28,9 @@ jobs:
     timeout-minutes: 10
     concurrency:
       group: code-foundry-release-pr-${{ github.repository }}-${{ github.ref }}
-      cancel-in-progress: true
+      # Promotion updates a release pull request; never cancel it mid-update.
+      # A newer push waits, and GitHub keeps only the newest pending run.
+      cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

package/.github/workflows/security.yml

@@ -31,7 +31,10 @@ env:
 
 concurrency:
   group: code-foundry-security-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   profile:

package/.github/workflows/test.yml

@@ -69,7 +69,10 @@ env:
 
 concurrency:
   group: code-foundry-test-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   unit:

package/.github/workflows/validation_self-ci.yml

@@ -16,7 +16,10 @@ permissions: {}
 # Superseded PR updates cancel the previous run.
 concurrency:
   group: code-foundry-validation-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
+  # Superseded pull-request runs are cancelled so the newest head owns the
+  # group; push and scheduled runs queue instead, because cancelling a main
+  # push can drop default-branch analysis or release-adjacent work.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   mode:

package/AGENTS.md

@@ -240,7 +240,8 @@ readying a pull request.
 - Keep workflows concise, independently runnable, and safe to re-run.
 - Use `push` for `main` and `pull_request` for `main` unless a workflow has a documented event-specific reason.
 - Give workflows clear names and jobs concise names; avoid repeating the workflow name in the job name.
-- Use per-workflow concurrency groups that cancel superseded runs while allowing independent workflows to run in parallel.
+- Use per-workflow concurrency groups keyed by pull request or ref that cancel superseded pull-request runs while allowing independent workflows to run in parallel. Do not cancel in progress for pushes to `main`, release, publication, or deployment runs; let them queue.
+- Do not put `always()` on heavy jobs: it keeps a cancelled run alive and holding its concurrency group. Use `!cancelled()` for jobs that must run after upstream failures, and keep `always()` for lightweight aggregate gates only.
 - Keep setup language-aware and cache dependency downloads by lockfile; do not cache secrets, `node_modules`, virtual environments, or broad build output without a measured reason.
 - Use least-privilege permissions and pin action versions consistently with the template.
 - Keep CI, Test, Security, CodeQL, Draft Guard, Draft PR, Release PR, and Release concerns separated.

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.44.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.2...v1.44.3) (2026-10-03)
+
+
+### Tests
+
+* **cli:** assert expected doctor warnings ([#712](https://github.com/0xPlayerOne/code-foundry/issues/712)) ([d036bee](https://github.com/0xPlayerOne/code-foundry/commit/d036beee79a9b200315cdbee5509fc3c2a6c4a04))
+
+## [1.44.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.1...v1.44.2) (2026-10-03)
+
+
+### Bug Fixes
+
+* **ci:** cancel only superseded pull-request runs in managed workflows ([#710](https://github.com/0xPlayerOne/code-foundry/issues/710)) ([f5fead6](https://github.com/0xPlayerOne/code-foundry/commit/f5fead677c032d253f2e1a2a256da4f207ddfa2a))
+
 ## [1.44.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.0...v1.44.1) (2026-10-03)
 
 
@@ -136,23 +150,9 @@
 
 * preserve repository-owned sections of managed policy documents ([#668](https://github.com/0xPlayerOne/code-foundry/issues/668)) ([26e9f4b](https://github.com/0xPlayerOne/code-foundry/commit/26e9f4bfeaca8b01087626bafbfc5090d891530f)), closes [#667](https://github.com/0xPlayerOne/code-foundry/issues/667)
 
-## [1.36.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.3...v1.36.4) (2026-09-29)
-
-
-### Bug Fixes
-
-* **cloudflare:** deploy previews from the prebuilt Preview Build Output ([#664](https://github.com/0xPlayerOne/code-foundry/issues/664)) ([34966ea](https://github.com/0xPlayerOne/code-foundry/commit/34966ea3917c145c441a460c741c125c60f84d25))
-
-## [1.36.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.2...v1.36.3) (2026-09-29)
-
-
-### Maintenance
-
-* track the JavaScript Dependabot ecosystem as bun by default ([#648](https://github.com/0xPlayerOne/code-foundry/issues/648)) ([6aa9712](https://github.com/0xPlayerOne/code-foundry/commit/6aa9712904340a7e4783f697a0e02d2be6ab1dce))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 221 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 223 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.44.1",
+  "version": "1.44.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {