code-foundry 1.48.7 → 1.48.8

package/.github/workflows/release.yml

@@ -514,96 +514,106 @@ jobs:
           fi
 
           for pr in "${release_prs[@]}"; do
-            pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-              --json isDraft,headRefOid,headRefName \
-              --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
-            read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
-            if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
-              echo 'Unable to verify generated release PR state.' >&2
-              exit 1
-            fi
-            case "$PR_BRANCH" in
-              release-please--branches--main|release-please--branches--main--*) ;;
-              *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
-            esac
-            if [ "$AUTO_MERGE" = true ]; then
-              if [ "$PR_DRAFT" = false ]; then
-                # A ready head already receives synchronize validation. Preserve
-                # its live/completed owner instead of cancelling and reallocating
-                # CI every time another queued main release run prepares it.
-                runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
-                  "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
-                  -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
-                validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
-                  --arg repo "$GITHUB_REPOSITORY" '
-                  def active: .status == "queued" or .status == "in_progress" or
-                    .status == "waiting" or .status == "pending" or .status == "requested";
-                  def valid_run:
-                    type == "object" and
-                    (.id | type == "number" and . > 0 and floor == .) and
-                    (.run_attempt | type == "number" and . >= 1 and floor == .) and
-                    (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
-                    (.head_branch | type == "string" and length > 0) and
-                    (.event | type == "string" and length > 0) and
-                    (.repository | type == "object") and
-                    (.repository.full_name | type == "string" and length > 0) and
-                    (.path | type == "string" and length > 0) and
-                    ((active and has("conclusion") and .conclusion == null) or
-                     (.status == "completed" and
-                      (.conclusion == "success" or .conclusion == "failure" or
-                       .conclusion == "timed_out" or .conclusion == "action_required" or
-                       .conclusion == "cancelled" or .conclusion == "skipped" or
-                       .conclusion == "neutral")));
-                  if (.workflow_runs | type) != "array" or
-                     (.total_count | type) != "number" then
-                    error("Invalid validation owner response")
-                  elif .total_count != (.workflow_runs | length) then
-                    error("Incomplete validation owner response")
-                  elif any(.workflow_runs[]; valid_run | not) then
-                    error("Invalid validation run identity or state")
-                  else
-                    [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
-                      .head_sha == $head and .head_branch == $branch and
-                      .event == "pull_request" and .repository.full_name == $repo and
-                      ($workflow == ".github/workflows/validation.yml" or
-                       $workflow == ".github/workflows/validation_self-ci.yml")
-                    )] | sort_by(.id) | last |
-                    if . == null then "missing"
-                    elif active or (.status == "completed" and .conclusion == "success") then "owned"
-                    elif .status == "completed" and
-                         (.conclusion == "failure" or .conclusion == "timed_out" or
-                          .conclusion == "action_required") then "failed"
-                    elif .status == "completed" and
-                         (.conclusion == "cancelled" or .conclusion == "skipped" or
-                          .conclusion == "neutral") then "missing"
-                    else error("Unconfirmed validation owner state") end
-                  end' <<< "$runs")
-                fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-                  --json isDraft,headRefOid,headRefName \
-                  --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
-                if [ "$fresh_state" != "$pr_state" ]; then
-                  echo 'Release PR state changed during validation lookup; refusing a stale readiness mutation.' >&2
-                  exit 1
-                fi
-                if [ "$validation" = owned ]; then
-                  echo "Release PR #$pr already has current-head validation; preserving readiness."
-                  continue
+            # A lock-sync/synchronize transition can move the PR while Actions is
+            # being read. Re-evaluate the whole tuple and its owner; never carry
+            # eligibility across heads or retry a stable failed qualification.
+            for state_attempt in 1 2 3; do
+              pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                --json isDraft,headRefOid,headRefName \
+                --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+              read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
+              if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
+                echo 'Unable to verify generated release PR state.' >&2
+                exit 1
+              fi
+              case "$PR_BRANCH" in
+                release-please--branches--main|release-please--branches--main--*) ;;
+                *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
+              esac
+              if [ "$AUTO_MERGE" = true ]; then
+                if [ "$PR_DRAFT" = false ]; then
+                  # A ready head already receives synchronize validation. Preserve
+                  # its live/completed owner instead of cancelling and reallocating
+                  # CI every time another queued main release run prepares it.
+                  runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
+                    "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
+                    -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
+                  validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
+                    --arg repo "$GITHUB_REPOSITORY" '
+                    def active: .status == "queued" or .status == "in_progress" or
+                      .status == "waiting" or .status == "pending" or .status == "requested";
+                    def valid_run:
+                      type == "object" and
+                      (.id | type == "number" and . > 0 and floor == .) and
+                      (.run_attempt | type == "number" and . >= 1 and floor == .) and
+                      (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
+                      (.head_branch | type == "string" and length > 0) and
+                      (.event | type == "string" and length > 0) and
+                      (.repository | type == "object") and
+                      (.repository.full_name | type == "string" and length > 0) and
+                      (.path | type == "string" and length > 0) and
+                      ((active and has("conclusion") and .conclusion == null) or
+                       (.status == "completed" and
+                        (.conclusion == "success" or .conclusion == "failure" or
+                         .conclusion == "timed_out" or .conclusion == "action_required" or
+                         .conclusion == "cancelled" or .conclusion == "skipped" or
+                         .conclusion == "neutral")));
+                    if (.workflow_runs | type) != "array" or
+                       (.total_count | type) != "number" then
+                      error("Invalid validation owner response")
+                    elif .total_count != (.workflow_runs | length) then
+                      error("Incomplete validation owner response")
+                    elif any(.workflow_runs[]; valid_run | not) then
+                      error("Invalid validation run identity or state")
+                    else
+                      [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
+                        .head_sha == $head and .head_branch == $branch and
+                        .event == "pull_request" and .repository.full_name == $repo and
+                        ($workflow == ".github/workflows/validation.yml" or
+                         $workflow == ".github/workflows/validation_self-ci.yml")
+                      )] | sort_by(.id) | last |
+                      if . == null then "missing"
+                      elif active or (.status == "completed" and .conclusion == "success") then "owned"
+                      elif .status == "completed" and
+                           (.conclusion == "failure" or .conclusion == "timed_out" or
+                            .conclusion == "action_required") then "failed"
+                      elif .status == "completed" and
+                           (.conclusion == "cancelled" or .conclusion == "skipped" or
+                            .conclusion == "neutral") then "missing"
+                      else error("Unconfirmed validation owner state") end
+                    end' <<< "$runs")
+                  fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                    --json isDraft,headRefOid,headRefName \
+                    --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                  if [ "$fresh_state" != "$pr_state" ]; then
+                    if [ "$state_attempt" -eq 3 ]; then
+                      echo 'Release PR state did not stabilize during validation lookup; refusing readiness mutation.' >&2
+                      exit 1
+                    fi
+                    echo "Release PR #$pr changed during validation lookup; reading its complete state and owner again."
+                    continue
+                  fi
+                  if [ "$validation" = owned ]; then
+                    echo "Release PR #$pr already has current-head validation; preserving readiness."
+                    break
+                  fi
+                  if [ "$validation" = failed ]; then
+                    echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
+                    exit 1
+                  fi
+                  # A missing, cancelled or skipped owner still needs the existing
+                  # explicit ready_for_review transition with the validated token.
+                  gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
                 fi
-                if [ "$validation" = failed ]; then
-                  echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
-                  exit 1
+                gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
+              else
+                if [ "$PR_DRAFT" = false ]; then
+                  gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
                 fi
-                # A missing, cancelled or skipped owner still needs the existing
-                # explicit ready_for_review transition with the validated token.
-                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
+                echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. No valid automation token is available (absent or rejected by GitHub), so release PRs are left in draft and need manual readiness before validation and merge workflows trigger."
               fi
-              gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
-            else
-              if [ "$PR_DRAFT" = false ]; then
-                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
-              fi
-              echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. No valid automation token is available (absent or rejected by GitHub), so release PRs are left in draft and need manual readiness before validation and merge workflows trigger."
-            fi
+              break
+            done
           done
       - name: Leave release pull request for manual merge
         if: steps.release.outputs.prs_created == 'true' && steps.credentials.outputs.auto_merge != 'true'

package/.github/workflows/validation-billing.yml

@@ -1161,8 +1161,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The content audit needs historical blobs after checkout removes credentials.
           fetch-depth: 0
-          filter: blob:none
       - name: Validate generated release diff
         if: ${{ inputs.mode == 'release' }}
         env:

package/.github/workflows/validation-no-codeql.yml

@@ -205,8 +205,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The content audit needs historical blobs after checkout removes credentials.
           fetch-depth: 0
-          filter: blob:none
       - name: Validate generated release diff
         if: ${{ inputs.mode == 'release' }}
         env:

package/.github/workflows/validation.yml

@@ -216,8 +216,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The content audit needs historical blobs after checkout removes credentials.
           fetch-depth: 0
-          filter: blob:none
       - name: Validate generated release diff
         if: ${{ inputs.mode == 'release' }}
         env:

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.48.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.7...v1.48.8) (2026-10-24)
+
+
+### Bug Fixes
+
+* **release:** hydrate audit blobs and refresh changing PR state ([#779](https://github.com/0xPlayerOne/code-foundry/issues/779)) ([8734ed7](https://github.com/0xPlayerOne/code-foundry/commit/8734ed77d159818cd5ff613f40a5dab796789d8a))
+
 ## [1.48.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.6...v1.48.7) (2026-10-23)
 
 
@@ -133,16 +140,9 @@
 
 * **billing:** join fast-lane receipts in a second parallel group ([#742](https://github.com/0xPlayerOne/code-foundry/issues/742)) ([c63a39c](https://github.com/0xPlayerOne/code-foundry/commit/c63a39cf5e236d6747bd85cf10b04bd10f690b11))
 
-## [1.46.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.0...v1.46.1) (2026-10-07)
-
-
-### Bug Fixes
-
-* **qualification:** skip parallel-syntax files until actionlint supports them ([#740](https://github.com/0xPlayerOne/code-foundry/issues/740)) ([db98c7f](https://github.com/0xPlayerOne/code-foundry/commit/db98c7f40cae080cdc9dcab7baac4976e5e0656e))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 255 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 256 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.48.7",
+  "version": "1.48.8",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/lib/node-package-performance.mjs

@@ -17,6 +17,42 @@ const METRICS = new Set([
   'productionDependencyCount',
 ])
 
+/**
+ * npm 12 keys pack reports by package name; older npm versions return an array.
+ * Count reports before validating their shape so an extra malformed entry cannot be ignored.
+ * @param {unknown} value
+ * @returns {{filename: string, size: number, unpackedSize: number, files: Array<{path: string}>}}
+ */
+export function singleNpmPackReport(value) {
+  let reports
+  if (Array.isArray(value)) reports = value
+  else if (value && typeof value === 'object') {
+    const object = /** @type {Record<string, unknown>} */ (value)
+    reports = typeof object.filename === 'string' ? [object] : Object.values(object)
+  } else reports = []
+  if (reports.length !== 1) throw new Error('Expected one npm pack report.')
+  const packed = reports[0]
+  if (!packed || typeof packed !== 'object' || Array.isArray(packed))
+    throw new Error('npm pack returned no package result.')
+  if (typeof packed.filename !== 'string' || packed.filename.length === 0)
+    throw new Error('npm pack result is missing filename.')
+  for (const field of ['size', 'unpackedSize'])
+    if (typeof packed[field] !== 'number' || !Number.isFinite(packed[field]) || packed[field] < 0)
+      throw new Error(`npm pack result is missing non-negative numeric ${field}.`)
+  if (
+    !Array.isArray(packed.files) ||
+    !packed.files.every(
+      (/** @type {unknown} */ file) =>
+        file !== null &&
+        typeof file === 'object' &&
+        !Array.isArray(file) &&
+        typeof (/** @type {{path?: unknown}} */ (file).path) === 'string'
+    )
+  )
+    throw new Error('npm pack result is missing a valid files list.')
+  return packed
+}
+
 /** @param {number[]} values @param {number} percent */
 export function percentile(values, percent) {
   if (values.length === 0) throw new Error('percentile requires at least one value')
@@ -59,8 +95,7 @@ export function runNodePackagePerformance(
     ? measureImports(root, String(policy.controlImport), samples)
     : null
   const pack = npmJson(root, ['pack', '--dry-run', '--json', '--ignore-scripts'], 'npm pack')
-  const packed = Array.isArray(pack) ? pack[0] : pack
-  if (!packed || typeof packed !== 'object') throw new Error('npm pack returned no package result.')
+  const packed = singleNpmPackReport(pack)
   /** @type {Array<{path?: string}>} */
   const files = Array.isArray(packed.files) ? packed.files : []
   const productionDependencyCount = npmProductionDependencyCount(root)

package/src/lib/product-quality.mjs

@@ -17,6 +17,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { tmpdir } from 'node:os'
 import { gzipSync } from 'node:zlib'
+import { singleNpmPackReport } from './node-package-performance.mjs'
 
 /** @typedef {Record<string, any>} Profile */
 /** @param {unknown} condition @param {string} message @returns {asserts condition} */
@@ -602,24 +603,23 @@ export function checkPackage(root, profile, output) {
   // Pack outside the consumer repository so test installations cannot become package input.
   const temporary = mkdtempSync(join(tmpdir(), 'foundry-package-quality-'))
   try {
-    const pack = JSON.parse(
-      runQualityCommand(
-        ['npm', 'pack', '--ignore-scripts', '--json', '--pack-destination', temporary],
-        root,
-        output
+    const pack = singleNpmPackReport(
+      JSON.parse(
+        runQualityCommand(
+          ['npm', 'pack', '--ignore-scripts', '--json', '--pack-destination', temporary],
+          root,
+          output
+        )
       )
     )
+    requireValue(/^[A-Za-z0-9._-]+\.tgz$/.test(pack.filename), 'Expected one package archive')
     requireValue(
-      Array.isArray(pack) && pack.length === 1 && /^[A-Za-z0-9._-]+\.tgz$/.test(pack[0].filename),
-      'Expected one package archive'
-    )
-    requireValue(
-      pack[0].files.every(
+      pack.files.every(
         (/** @type {{path:string}} */ file) => !/^\.code-foundry(?:\/|$)/.test(file.path)
       ),
       'Exclude .code-foundry quality evidence from the published package'
     )
-    const archive = ownedPath(temporary, pack[0].filename)
+    const archive = ownedPath(temporary, pack.filename)
     const archiveSha256 = createHash('sha256').update(readFileSync(archive)).digest('hex')
     const consumer = join(temporary, 'consumer')
     mkdirSync(consumer)

package/src/runtime-core.mjs

@@ -404,6 +404,28 @@ function validation(task) {
           { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
         )
       : undefined
+    if (diff && diff.status !== 0) {
+      // Git can relay arbitrary remote messages, URLs and credentials on stderr. Emit only
+      // bounded, recognised failure facts; never replay remote text as workflow annotations.
+      const stderr = (diff.stderr ?? '').slice(0, 8192)
+      const missingBlob = /could not fetch ([0-9a-f]{40,64}) from promisor remote/i.exec(stderr)
+      const reason = missingBlob
+        ? `historical blob ${missingBlob[1]} unavailable from promisor remote`
+        : /authentication failed|could not read (?:username|password)|terminal prompts disabled/i.test(
+              stderr
+            )
+          ? 'authentication unavailable'
+          : /could not read from remote repository/i.test(stderr)
+            ? 'remote repository unavailable'
+            : /bad object|unknown revision|invalid symmetric difference|ambiguous argument/i.test(
+                  stderr
+                )
+              ? 'revision unavailable'
+              : 'Git error details omitted'
+      console.error(
+        `::error::Git content diff failed (status ${diff.status ?? 'unavailable'}): ${reason}.`
+      )
+    }
     const result = validateGeneratedReleaseDiff({
       headRef: process.env.FOUNDRY_HEAD_REF ?? '',
       headRepo: process.env.FOUNDRY_HEAD_REPO ?? '',