code-foundry 1.46.2 → 1.46.4

package/.github/workflows/release.yml

@@ -447,6 +447,9 @@ jobs:
           # when it validated, github.token after fallback. The token value
           # lives only in this masked env expression, never in step outputs.
           AUTO_MERGE: ${{ steps.credentials.outputs.auto_merge }}
+          # Read Actions ownership with the workflow credential, not an
+          # automation token that may only have release/PR write permissions.
+          VALIDATION_TOKEN: ${{ github.token }}
           GH_TOKEN: ${{ steps.credentials.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
         run: |
           set -euo pipefail
@@ -464,12 +467,87 @@ jobs:
           fi
 
           for pr in "${release_prs[@]}"; do
-            PR_DRAFT=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json isDraft --jq '.isDraft')
+            pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+              --json isDraft,headRefOid,headRefName \
+              --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+            read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
+            if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
+              echo 'Unable to verify generated release PR state.' >&2
+              exit 1
+            fi
+            case "$PR_BRANCH" in
+              release-please--branches--main|release-please--branches--main--*) ;;
+              *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
+            esac
             if [ "$AUTO_MERGE" = true ]; then
               if [ "$PR_DRAFT" = false ]; then
-                # A Release Please PR can be updated while already ready. Reset
-                # it so ready_for_review always starts validation for the exact
-                # current release head.
+                # A ready head already receives synchronize validation. Preserve
+                # its live/completed owner instead of cancelling and reallocating
+                # CI every time another queued main release run prepares it.
+                runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
+                  "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
+                  -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
+                validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
+                  --arg repo "$GITHUB_REPOSITORY" '
+                  def active: .status == "queued" or .status == "in_progress" or
+                    .status == "waiting" or .status == "pending" or .status == "requested";
+                  def valid_run:
+                    type == "object" and
+                    (.id | type == "number" and . > 0 and floor == .) and
+                    (.run_attempt | type == "number" and . >= 1 and floor == .) and
+                    (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
+                    (.head_branch | type == "string" and length > 0) and
+                    (.event | type == "string" and length > 0) and
+                    (.repository | type == "object") and
+                    (.repository.full_name | type == "string" and length > 0) and
+                    (.path | type == "string" and length > 0) and
+                    ((active and has("conclusion") and .conclusion == null) or
+                     (.status == "completed" and
+                      (.conclusion == "success" or .conclusion == "failure" or
+                       .conclusion == "timed_out" or .conclusion == "action_required" or
+                       .conclusion == "cancelled" or .conclusion == "skipped" or
+                       .conclusion == "neutral")));
+                  if (.workflow_runs | type) != "array" or
+                     (.total_count | type) != "number" then
+                    error("Invalid validation owner response")
+                  elif .total_count != (.workflow_runs | length) then
+                    error("Incomplete validation owner response")
+                  elif any(.workflow_runs[]; valid_run | not) then
+                    error("Invalid validation run identity or state")
+                  else
+                    [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
+                      .head_sha == $head and .head_branch == $branch and
+                      .event == "pull_request" and .repository.full_name == $repo and
+                      ($workflow == ".github/workflows/validation.yml" or
+                       $workflow == ".github/workflows/validation_self-ci.yml")
+                    )] | sort_by(.id) | last |
+                    if . == null then "missing"
+                    elif active or (.status == "completed" and .conclusion == "success") then "owned"
+                    elif .status == "completed" and
+                         (.conclusion == "failure" or .conclusion == "timed_out" or
+                          .conclusion == "action_required") then "failed"
+                    elif .status == "completed" and
+                         (.conclusion == "cancelled" or .conclusion == "skipped" or
+                          .conclusion == "neutral") then "missing"
+                    else error("Unconfirmed validation owner state") end
+                  end' <<< "$runs")
+                fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                  --json isDraft,headRefOid,headRefName \
+                  --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                if [ "$fresh_state" != "$pr_state" ]; then
+                  echo 'Release PR state changed during validation lookup; refusing a stale readiness mutation.' >&2
+                  exit 1
+                fi
+                if [ "$validation" = owned ]; then
+                  echo "Release PR #$pr already has current-head validation; preserving readiness."
+                  continue
+                fi
+                if [ "$validation" = failed ]; then
+                  echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
+                  exit 1
+                fi
+                # A missing, cancelled or skipped owner still needs the existing
+                # explicit ready_for_review transition with the validated token.
                 gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
               fi
               gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"

package/.github/workflows/validation-billing.yml

@@ -227,17 +227,6 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run eval >> "$GITHUB_OUTPUT"
-      # --- Lint lane (mirror of ci.yml lint) ---
-      - name: Detect lint
-        id: lint_applicability
-        if: ${{ !cancelled() }}
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-          BEFORE_SHA: ${{ github.event.before }}
-        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run lint >> "$GITHUB_OUTPUT"
       # --- Integration lane (mirror of test.yml integration; audit tier only) ---
       - name: Detect integration
         id: integration_applicability
@@ -314,13 +303,6 @@ jobs:
           install: 'true'
           cache-build: 'true'
           task: eval
-      - name: Setup lint
-        if: ${{ !cancelled() && steps.lint_applicability.outputs.applicable == 'true' && steps.lint_applicability.outputs.affected != 'false' }}
-        uses: ./.github/actions/setup
-        with:
-          install: 'true'
-          cache-lint: 'true'
-          task: lint
       - name: Setup integration
         if: ${{ !cancelled() && inputs.mode == 'audit' && steps.integration_applicability.outputs.applicable == 'true' && steps.integration_applicability.outputs.affected != 'false' }}
         uses: ./.github/actions/setup
@@ -365,11 +347,6 @@ jobs:
             id: eval_execute
             if: ${{ !cancelled() && inputs.mode == 'audit' && steps.eval_applicability.outputs.applicable == 'true' && steps.eval_applicability.outputs.affected != 'false' }}
             run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci eval
-          # --- Lint execute ---
-          - name: Lint
-            id: lint_execute
-            if: ${{ !cancelled() && steps.lint_applicability.outputs.applicable == 'true' && steps.lint_applicability.outputs.affected != 'false' }}
-            run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci lint
           # --- Integration execute ---
           - name: Integration
             id: integration_execute
@@ -477,19 +454,6 @@ jobs:
                 eval-results/summary.json
               if-no-files-found: error
               retention-days: 14
-          - name: Retain lint task receipt
-            if: >-
-              always() &&
-              (steps.lint_execute.outcome == 'success' || steps.lint_execute.outcome == 'failure' ||
-              steps.lint_applicability.outputs.applicable == 'false' || steps.lint_applicability.outputs.affected == 'false') &&
-              hashFiles('.code-foundry/results/lint.json') != ''
-            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-            with:
-              name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-lint
-              path: .code-foundry/results/lint.json
-              include-hidden-files: true
-              if-no-files-found: error
-              retention-days: 14
           - name: Retain integration task receipt
             if: >-
               always() &&
@@ -505,6 +469,67 @@ jobs:
               if-no-files-found: error
               retention-days: 14
 
+  lint:
+    name: Lint
+    if: vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ${{ inputs.ci-runner }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            .github/actions
+            src/lib
+            src/runtime-core.mjs
+            src/runtime.mjs
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions
+          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Detect
+        id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run lint >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        uses: ./.github/actions/setup
+        with:
+          install: 'true'
+          cache-lint: 'true'
+          task: lint
+      - name: Lint
+        id: execute
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci lint
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
+          hashFiles('.code-foundry/results/lint.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-lint
+          path: .code-foundry/results/lint.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
+
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -1074,7 +1099,7 @@ jobs:
   # evaluateValidationGate's mode truth table is reused unchanged.
   gate:
     name: Gate
-    needs: [fast-lanes, type-check, unit, e2e, audit, codeql]
+    needs: [fast-lanes, lint, type-check, unit, e2e, audit, codeql]
     if: vars.CI_BILLING_PAUSED != 'true' && always()
     runs-on: ubuntu-slim
     timeout-minutes: 10
@@ -1082,7 +1107,7 @@ jobs:
       FOUNDRY_MODE: ${{ inputs.mode }}
       # CI category: lint and type-check always run; the merged fast-lanes job
       # carries the format and build lanes.
-      FOUNDRY_CI: ${{ (needs.type-check.result != 'success' && needs.type-check.result) || (needs.fast-lanes.result != 'success' && needs.fast-lanes.result) || 'success' }}
+      FOUNDRY_CI: ${{ (needs.lint.result != 'success' && needs.lint.result) || (needs.type-check.result != 'success' && needs.type-check.result) || (needs.fast-lanes.result != 'success' && needs.fast-lanes.result) || 'success' }}
       # Test category: unit always runs and must succeed; integration and e2e
       # are audit-tier jobs whose expected skip on fast/release is not a
       # failure; the merged fast-lanes job carries performance, smoke, and

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.46.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.3...v1.46.4) (2026-10-08)
+
+
+### Bug Fixes
+
+* **release:** preserve current-head validation ownership ([#737](https://github.com/0xPlayerOne/code-foundry/issues/737)) ([aa8bfcf](https://github.com/0xPlayerOne/code-foundry/commit/aa8bfcfbfcd3c213d15ba9e1fbfb5c65ab8ddb6b))
+
+## [1.46.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.2...v1.46.3) (2026-10-07)
+
+
+### Bug Fixes
+
+* **billing:** keep lint standalone; join fast-lane receipts in parallel ([#744](https://github.com/0xPlayerOne/code-foundry/issues/744)) ([574690b](https://github.com/0xPlayerOne/code-foundry/commit/574690b707abffe9350ccc67589540afb82323ee))
+
 ## [1.46.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.1...v1.46.2) (2026-10-07)
 
 
@@ -126,23 +140,9 @@
 
 * **pre-commit:** make the commit gate change-aware ([#702](https://github.com/0xPlayerOne/code-foundry/issues/702)) ([f5bca91](https://github.com/0xPlayerOne/code-foundry/commit/f5bca91c177b30b99f5d62287255d191617b4788))
 
-## [1.43.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.43.1...v1.43.2) (2026-10-03)
-
-
-### Bug Fixes
-
-* require candidate asset qualification before stable promotion ([#705](https://github.com/0xPlayerOne/code-foundry/issues/705)) ([f42e4f5](https://github.com/0xPlayerOne/code-foundry/commit/f42e4f5fb063ea22fa25791a13c75c90d41bf17a))
-
-## [1.43.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.43.0...v1.43.1) (2026-10-03)
-
-
-### Bug Fixes
-
-* **release:** make batched publication and stable promotion reliable ([#703](https://github.com/0xPlayerOne/code-foundry/issues/703)) ([271731d](https://github.com/0xPlayerOne/code-foundry/commit/271731d8fac3bff42a99b3d5f4a774eccc0a7788))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 237 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 239 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/WORKFLOWS.md

@@ -82,6 +82,23 @@ to run generated gates for drafts. Cloudflare callers use their equivalent
 `draft-protection: false` input. These opt-outs do not remove Draft Guard or
 draft-PR automation; they only allow the protected gates to run for drafts.
 
+Generated release PR preparation preserves a ready head when the canonical
+generated `.github/workflows/validation.yml` (or Code Foundry
+`validation_self-ci.yml`) pull-request run for that exact head, branch, and
+repository is the newest matching run and is active or successful. API workflow
+paths may include a Git ref suffix; ownership compares the canonical filename.
+The workflow credential reads Actions ownership; the validated automation credential still performs readiness writes.
+A newer failed qualification blocks release preparation until it is resolved or
+explicitly retried. Missing, cancelled, or skipped validation still receives the
+explicit draft/ready transition; a new draft receives its first readiness event.
+An unavailable or malformed ownership response, an incomplete Actions page, or a
+PR state change during the lookup fails before mutation. An older live run cannot
+mask a newer failed qualification. Invalid automation credentials retain the
+manual draft fallback. This changes readiness only: release creation, qualification,
+tag publication, and branch-policy-gated exact-head merging still run through
+the existing release pipeline. Consumers must adopt the fixed reusable workflow
+pin before they receive this behavior; older pins still reset ready heads.
+
 ## Billing pause
 
 Code Foundry consumers can stop all generated jobs from allocating GitHub-hosted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.46.2",
+  "version": "1.46.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {