code-foundry 1.48.0 → 1.48.2

package/.github/workflows/ci.yml

@@ -119,6 +119,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   lint:
     name: Lint
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -180,6 +183,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -246,6 +252,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   build:
     name: Build
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -311,3 +320,6 @@ jobs:
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 14
+
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save

package/.github/workflows/eval.yml

@@ -124,3 +124,6 @@ jobs:
             eval-results/summary.json
           if-no-files-found: error
           retention-days: 14
+
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save

package/.github/workflows/security.yml

@@ -311,7 +311,7 @@ jobs:
           steps.audit-toolchain.outputs.package_manager == 'bun'
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.3
       - name: Enable Corepack
         if: >-
           matrix.entry.language == 'javascript' &&

package/.github/workflows/test.yml

@@ -161,6 +161,9 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   performance:
     name: Performance
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -247,6 +250,9 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   integration:
     name: Integration
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
@@ -317,6 +323,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   e2e:
     name: E2E
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
@@ -410,6 +419,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   smoke:
     name: Smoke
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
@@ -479,3 +491,6 @@ jobs:
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 14
+
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save

package/.github/workflows/validation-billing.yml

@@ -469,6 +469,9 @@ jobs:
               if-no-files-found: error
               retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   lint:
     name: Lint
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -530,6 +533,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   type-check:
     name: Type-Check
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -596,6 +602,9 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   unit:
     name: Unit
     if: vars.CI_BILLING_PAUSED != 'true'
@@ -682,6 +691,9 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   e2e:
     name: E2E
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
@@ -775,11 +787,15 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   # Profile and dependency audit merged into one job. The split orchestrators
   # run a profile job that feeds an audit matrix; here the language blocks run
   # sequentially, driven directly by the profile step's outputs, so the second
   # runner spin-up disappears. Python requirements run in one loop inside the
   # audit step because a matrix cannot follow preceding steps in the same job.
+
   audit:
     name: Audit
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
@@ -934,7 +950,7 @@ jobs:
           steps.audit-toolchain.outputs.package_manager == 'bun'
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.0
+          bun-version: 1.4.3
       - name: Enable Corepack
         if: >-
           steps.profile.outputs.javascript == 'true' &&

package/.mise.toml

@@ -1,6 +1,6 @@
 [tools]
 node = "24.18.0"
-bun = "1.4.0"
+bun = "1.4.3"
 
 [settings]
 experimental = true

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.48.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.1...v1.48.2) (2026-10-17)
+
+
+### Maintenance
+
+* **bun:** align Bun runtime pins to 1.4.3 ([#767](https://github.com/0xPlayerOne/code-foundry/issues/767)) ([402343f](https://github.com/0xPlayerOne/code-foundry/commit/402343fed2b41be3b2a55ddbc56d2256cc511b1a))
+
+## [1.48.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.0...v1.48.1) (2026-10-16)
+
+
+### Bug Fixes
+
+* vite-plus-cache-post-job-save ([#765](https://github.com/0xPlayerOne/code-foundry/issues/765)) ([3f82e85](https://github.com/0xPlayerOne/code-foundry/commit/3f82e850f5c09af6cea4de6f1a791d098bbd2f6e))
+
 ## [1.48.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.5...v1.48.0) (2026-10-16)
 
 
@@ -126,23 +140,9 @@
 
 * **release:** retry the token probe and REST fallback writes with backoff ([#729](https://github.com/0xPlayerOne/code-foundry/issues/729)) ([ad28e18](https://github.com/0xPlayerOne/code-foundry/commit/ad28e18326f0ee8c25950fb649eb81cdb3dc0a1a))
 
-## [1.44.10](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.9...v1.44.10) (2026-10-06)
-
-
-### Bug Fixes
-
-* **release:** treat ref-creation errors in the REST fallback as non-fatal ([#727](https://github.com/0xPlayerOne/code-foundry/issues/727)) ([75ea614](https://github.com/0xPlayerOne/code-foundry/commit/75ea61465e7c4cacd39e3aa8c52df93c2ea9bf03))
-
-## [1.44.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.8...v1.44.9) (2026-10-06)
-
-
-### Bug Fixes
-
-* **release:** make the REST fallback draft-aware and idempotent ([#725](https://github.com/0xPlayerOne/code-foundry/issues/725)) ([c29da6e](https://github.com/0xPlayerOne/code-foundry/commit/c29da6efb919d68a568c2328eea2c2f7654334fe))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 248 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 250 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CACHING.md

@@ -34,10 +34,21 @@ When opted in, the setup action:
   remote-cache step runs;
 - restores `node_modules/.vite/task-cache` as its last step, after Install and
   after every step that archives `node_modules` (Install can replace it);
-- saves it push-only like every other cache, so pull requests and scheduled
-  runs cannot poison it;
+- publishes a cache path, key, and save-intent contract for the explicit
+  `.github/actions/vite-plus-cache-save` action to use after repository tasks;
+- saves it push-only, so pull requests and scheduled runs cannot poison it;
 - keeps it out of the generic JavaScript build-state archive.
 
+The generated CI, test, eval, and billing workflows call the save action at the
+end of each task job. Custom workflows that use `.github/actions/setup` must
+also call it after their Vite+ tasks complete; it reads the setup contract from
+the job environment. A job can disable saving with `cache-save: false` on every
+applicable setup call. With multiple setup calls in one job, save intent is
+combined so an enabled Vite+ task setup is not overridden by a later disabled
+setup. The setup action also exposes `vite-plus-cache-path`,
+`vite-plus-cache-key`, and `vite-plus-cache-save` outputs for workflows that
+prefer to pass these values explicitly to the save action.
+
 Keys are `<namespace>-<workflow>-<job>-<lockfiles>-<vite.config>-<run id>-<attempt>`,
 so every push saves a refreshed entry (more storage than a fixed key). Restore
 keys fall back by lockfiles, job, then any job, but never leave the namespace
@@ -45,8 +56,8 @@ keys fall back by lockfiles, job, then any job, but never leave the namespace
 Task does not fingerprint the Node or Bun binary. If the `vite-plus` version
 cannot be resolved, nothing is restored or saved.
 
-If `VITE_CACHE_PATH` (absolute) is set, Vite+ writes its cache there and the
-setup action caches that directory instead.
+If `VITE_CACHE_PATH` (absolute, from any environment source) is set, Vite+
+writes its cache there and the setup action caches that directory too.
 
 Vite+ has no remote cache and this repository does not configure one.
 

package/docs/CONFIGURATION.md

@@ -298,6 +298,10 @@ behavior:
 - `cache-vite-plus: auto`, `true`, or `false` is an input of the setup action
   (not a config key). It controls the local Vite+ task cache only when
   `monorepo_tool: vite-plus` is set.
+- Custom workflows using the setup action must add
+  `.github/actions/vite-plus-cache-save` after task execution. The generated
+  Code Foundry workflows already include this save boundary; see
+  [Caching and remote caching](CACHING.md).
 
 Use these controls only after measuring a repeatable benefit. See [Caching and
 remote caching](CACHING.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.48.0",
+  "version": "1.48.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {
@@ -18,6 +18,7 @@
     "src",
     "docs",
     ".github",
+    "!.github/actions/**",
     ".githooks",
     ".editorconfig",
     ".gitattributes",
@@ -59,5 +60,5 @@
   "engines": {
     "node": ">=24"
   },
-  "packageManager": "bun@1.4.0"
+  "packageManager": "bun@1.4.3"
 }

package/.github/actions/attest-artifact/action.yml

@@ -1,56 +0,0 @@
-name: Attest verified build artifacts
-description: Generate checksums and signed provenance for explicitly selected build outputs.
-inputs:
-  artifacts:
-    description: 'JSON array of nonempty regular artifact files relative to the workspace.'
-    required: true
-outputs:
-  manifest-path:
-    description: Path to the generated SHA-256 JSON manifest.
-    value: ${{ steps.manifest.outputs.manifest-path }}
-  bundle-path:
-    description: Path to the signed provenance bundle.
-    value: ${{ steps.attest.outputs.bundle-path }}
-  attestation-url:
-    description: URL of the published attestation.
-    value: ${{ steps.attest.outputs.attestation-url }}
-runs:
-  using: composite
-  steps:
-    - name: Select and hash build outputs
-      id: manifest
-      shell: bash
-      env:
-        ARTIFACTS: ${{ inputs.artifacts }}
-      run: |
-        set -euo pipefail
-        [[ "$GITHUB_EVENT_NAME" != pull_request && "$GITHUB_EVENT_NAME" != pull_request_target ]]
-        node --input-type=module <<'NODE'
-        import { appendFileSync, mkdtempSync, writeFileSync } from 'node:fs'
-        import { join, resolve } from 'node:path'
-        import { pathToFileURL } from 'node:url'
-        const helper = pathToFileURL(resolve(process.env.GITHUB_ACTION_PATH, '../../../src/commands/release-integrity.mjs'))
-        const { assetManifest } = await import(helper.href)
-        const files = JSON.parse(process.env.ARTIFACTS)
-        if (!Array.isArray(files) || files.some(file => typeof file !== 'string')) throw new Error('artifacts must be a JSON string array')
-        const manifest = assetManifest(process.env.GITHUB_WORKSPACE, files)
-        const directory = mkdtempSync(join(process.env.RUNNER_TEMP, 'foundry-attestation-'))
-        const manifestPath = join(directory, 'manifest.json')
-        const sumsPath = join(directory, 'SHA256SUMS')
-        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n')
-        writeFileSync(sumsPath, manifest.checksums)
-        appendFileSync(process.env.GITHUB_OUTPUT, `manifest-path=${manifestPath}\nchecksums-path=${sumsPath}\n`)
-        NODE
-    - name: Sign build provenance
-      id: attest
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
-      with:
-        subject-checksums: ${{ steps.manifest.outputs.checksums-path }}
-    - name: Verify artifacts were not changed during signing
-      shell: bash
-      env:
-        CHECKSUMS_PATH: ${{ steps.manifest.outputs.checksums-path }}
-      run: |
-        set -euo pipefail
-        cd "$GITHUB_WORKSPACE"
-        sha256sum --check "$CHECKSUMS_PATH"

package/.github/actions/cache/action.yml

@@ -1,47 +0,0 @@
-name: Repository Cache
-description: Restore a cache and optionally enable the post-job save performed by actions/cache.
-
-inputs:
-  path:
-    description: Cache paths.
-    required: true
-  key:
-    description: Primary cache key.
-    required: true
-  restore-keys:
-    description: Optional newline-delimited restore keys.
-    required: false
-    default: ''
-  save:
-    description: Enable cache saving after the job completes.
-    required: false
-    default: 'true'
-
-outputs:
-  cache-hit:
-    description: Whether an exact cache was restored.
-    value: ${{ steps.cache.outputs.cache-hit || steps.restore.outputs.cache-hit }}
-
-runs:
-  using: composite
-  steps:
-    # Caches are restored on every event but saved on push only: scheduled
-    # and dispatched runs share the default branch with untrusted
-    # runtime-ref checkouts, so letting them save would allow cache
-    # poisoning. Push events require write access and stay trusted.
-    - name: Restore cache
-      id: restore
-      if: inputs.save != 'true' || github.event_name != 'push'
-      uses: actions/cache/restore@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        restore-keys: ${{ inputs.restore-keys }}
-    - name: Restore and save cache
-      id: cache
-      if: inputs.save == 'true' && github.event_name == 'push'
-      uses: actions/cache@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        restore-keys: ${{ inputs.restore-keys }}

package/.github/actions/codeql/action.yml

@@ -1,33 +0,0 @@
-name: CodeQL Analyze
-description: Initialize and analyze one CodeQL language using the repository baseline.
-
-inputs:
-  language:
-    description: CodeQL language identifier.
-    required: true
-  build-mode:
-    description: CodeQL build mode.
-    required: false
-    default: none
-  category:
-    description: CodeQL analysis category.
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Initialize
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ inputs.language }}
-        build-mode: ${{ inputs.build-mode }}
-    - name: Analyze
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: ${{ inputs.category }}
-        # Pin pull-request uploads to the contributor's head SHA/ref so a
-        # moving merge ref cannot race the required code-scanning context.
-        ref: ${{ github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}
-        sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        upload-database: false
-        wait-for-processing: false