code-foundry 1.44.3 → 1.44.5

package/.github/workflows/release.yml

@@ -187,17 +187,35 @@ jobs:
           # with HTTP 403 even on REST, so the configured automation token is
           # validated against the current repository before any write. gh api
           # authenticates through the GH_TOKEN environment variable and never
-          # prints the token; the
-          # response body is discarded and only the exit status selects the
-          # credential for the rest of the job.
+          # prints the token; the response body is discarded and only the exit
+          # status selects the credential for the rest of the job.
+          #
+          # Reading the repository does not imply the write this workflow
+          # needs: fine-grained tokens can pass the read probe and even create
+          # draft releases while the git-refs endpoint still rejects them, and
+          # release-please creates the release tag through that endpoint when
+          # the manifest config enables force-tag-creation. Probe the write
+          # directly with a throwaway tag on the current commit; delete it on
+          # success so the probe leaves no trace. Any failure falls back to
+          # the short-lived workflow token, whose integration role creates
+          # refs without this limitation.
+          write_ok=false
           if [ "$HAS_AUTOMATION_TOKEN" = true ] && gh api "repos/${GITHUB_REPOSITORY}" --jq '.full_name' >/dev/null 2>&1; then
+            probe_ref="refs/tags/token-write-probe-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+            if gh api -X POST "repos/${GITHUB_REPOSITORY}/git/refs" \
+                -f "ref=$probe_ref" -f "sha=${GITHUB_SHA}" >/dev/null 2>&1; then
+              gh api -X DELETE "repos/${GITHUB_REPOSITORY}/git/refs/tags/token-write-probe-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >/dev/null 2>&1 || true
+              write_ok=true
+            fi
+          fi
+          if [ "$write_ok" = true ]; then
             echo "auto_merge=true" >> "$GITHUB_OUTPUT"
             echo "token_source=configured" >> "$GITHUB_OUTPUT"
           else
             echo "auto_merge=false" >> "$GITHUB_OUTPUT"
             echo "token_source=fallback" >> "$GITHUB_OUTPUT"
             if [ "$HAS_AUTOMATION_TOKEN" = true ]; then
-              echo "::warning title=Release token fallback::The configured CODE_FOUNDRY_TOKEN was rejected by GitHub; failing over to the short-lived workflow token. The version pull request will be left for manual merge."
+              echo "::warning title=Release token fallback::The configured CODE_FOUNDRY_TOKEN was rejected by GitHub for the tag-creation write release-please needs; failing over to the short-lived workflow token. The version pull request will be left for manual merge."
             fi
           fi
       - name: Release Please (automation token)

package/.github/workflows/validation-no-codeql.yml

@@ -75,6 +75,16 @@ on:
         required: false
         type: string
         default: task-result
+      e2e-shard-list:
+        description: Comma-separated E2E shard indices passed to the test lane's matrix, e.g. "1,2".
+        required: false
+        type: string
+        default: '1'
+      e2e-total-shards:
+        description: Total E2E shard count passed to the repository script as E2E_TOTAL_SHARDS.
+        required: false
+        type: string
+        default: '1'
     secrets:
       TURBO_TOKEN:
         required: false
@@ -119,6 +129,8 @@ jobs:
       # smoke, and performance lanes stay in the audit and scheduled lanes.
       unit-only: ${{ inputs.mode == 'fast' || inputs.mode == 'release' }}
       artifact-prefix: ${{ inputs.artifact-prefix }}
+      e2e-shard-list: ${{ inputs.e2e-shard-list }}
+      e2e-total-shards: ${{ inputs.e2e-total-shards }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.44.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.4...v1.44.5) (2026-10-05)
+
+
+### Bug Fixes
+
+* **release:** probe the tag-creation write before trusting the automation token ([#716](https://github.com/0xPlayerOne/code-foundry/issues/716)) ([fabaddc](https://github.com/0xPlayerOne/code-foundry/commit/fabaddcb05d5dc701248b693f91be6ee433f8d39))
+
+## [1.44.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.3...v1.44.4) (2026-10-03)
+
+
+### Bug Fixes
+
+* **ci:** declare the e2e shard inputs on the no-codeql orchestrator ([#714](https://github.com/0xPlayerOne/code-foundry/issues/714)) ([7500208](https://github.com/0xPlayerOne/code-foundry/commit/7500208f3b25dfe55c41ea45b382e021cf804012))
+
 ## [1.44.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.2...v1.44.3) (2026-10-03)
 
 
@@ -136,23 +150,9 @@
 
 * **cloudflare:** surface the cf deploy error instead of discarding it ([66de0d1](https://github.com/0xPlayerOne/code-foundry/commit/66de0d1e8238315dbd910abbd907e921cbc6764f))
 
-## [1.37.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.37.0...v1.37.1) (2026-09-30)
-
-
-### Bug Fixes
-
-* **cloudflare:** build the production Build Output before the prebuilt deploy ([5f2f83c](https://github.com/0xPlayerOne/code-foundry/commit/5f2f83c6d6135c403b520f83469c0c5ca350cdba))
-
-## [1.37.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.4...v1.37.0) (2026-09-30)
-
-
-### Features
-
-* preserve repository-owned sections of managed policy documents ([#668](https://github.com/0xPlayerOne/code-foundry/issues/668)) ([26e9f4b](https://github.com/0xPlayerOne/code-foundry/commit/26e9f4bfeaca8b01087626bafbfc5090d891530f)), closes [#667](https://github.com/0xPlayerOne/code-foundry/issues/667)
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 223 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 225 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.44.3",
+  "version": "1.44.5",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {