code-foundry 1.48.7 → 1.50.0

package/.github/workflows/release.yml

@@ -43,6 +43,11 @@ on:
         required: false
         type: boolean
         default: false
+      npm-publish-auth:
+        description: Select automatic token compatibility or force trusted OIDC publication.
+        required: false
+        type: string
+        default: auto
     outputs:
       release_created:
         description: Whether Release Please created a release (possibly a draft).
@@ -63,6 +68,8 @@ on:
         required: false
       NPM_TOKEN:
         required: false
+      NPM_READ_TOKEN:
+        required: false
 
 permissions:
   actions: write
@@ -271,11 +278,12 @@ jobs:
           // Writes intermittently hit GitHub's secondary rate limiting from
           // busy automation accounts (403 with the generic not-accessible
           // message); back off and retry before giving up.
-          const gh = (args) => {
+          const gh = (args, options = {}) => {
             for (const wait of [0, 10, 30]) {
               try {
                 if (wait) sleep(wait);
                 return execFileSync('gh', args, {
+                  ...options,
                   encoding: 'utf8',
                   maxBuffer: 32 * 1024 * 1024,
                 });
@@ -316,6 +324,18 @@ jobs:
           const latestTag = versionedTags[0] ?? '';
           const prefix = latestTag.replace(/v?\d+\.\d+\.\d+.*$/, '') || 'v';
 
+          // Include drafts and every page before deciding an object is absent.
+          const releasePages = JSON.parse(gh([
+            'api', `repos/${repo}/releases`, '-X', 'GET', '-f', 'per_page=100',
+            '--paginate', '--slurp',
+          ]));
+          if (!Array.isArray(releasePages) || releasePages.some((page) =>
+            !Array.isArray(page) || page.some((release) =>
+              !release || typeof release.tag_name !== 'string' || !release.tag_name))) {
+            throw new Error('Invalid existing release listing; refusing release creation');
+          }
+          const existingReleaseTags = new Set(releasePages.flat().map((release) => release.tag_name));
+
           let ensured = 0;
           let failures = 0;
           let lastTag = '';
@@ -324,12 +344,7 @@ jobs:
             const version = /^chore\(main\): release (\S+)/.exec(pull.title)?.[1];
             if (!version) continue;
             const tag = `${prefix}v${version}`;
-            // Draft releases are invisible to get-release-by-tag, so scan
-            // the list endpoint (which returns drafts) for the tag.
-            const releasesForCheck = JSON.parse(gh([
-              'api', `repos/${repo}/releases`, '-X', 'GET', '-f', 'per_page=100',
-            ]));
-            if (releasesForCheck.some((release) => release.tag_name === tag)) {
+            if (existingReleaseTags.has(tag)) {
               console.log(`${tag}: release object already exists`);
             } else {
               // No release object for this tag: create it. The tag may also
@@ -354,6 +369,7 @@ jobs:
                   prerelease: version.includes('-'),
                 });
                 gh(['api', `repos/${repo}/releases`, '-X', 'POST', '--input', '-'], { input: body });
+                existingReleaseTags.add(tag);
                 console.log(`${tag}: release object created`);
               } catch (error) {
                 failures += 1;
@@ -514,96 +530,106 @@ jobs:
           fi
 
           for pr in "${release_prs[@]}"; do
-            pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-              --json isDraft,headRefOid,headRefName \
-              --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
-            read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
-            if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
-              echo 'Unable to verify generated release PR state.' >&2
-              exit 1
-            fi
-            case "$PR_BRANCH" in
-              release-please--branches--main|release-please--branches--main--*) ;;
-              *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
-            esac
-            if [ "$AUTO_MERGE" = true ]; then
-              if [ "$PR_DRAFT" = false ]; then
-                # A ready head already receives synchronize validation. Preserve
-                # its live/completed owner instead of cancelling and reallocating
-                # CI every time another queued main release run prepares it.
-                runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
-                  "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
-                  -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
-                validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
-                  --arg repo "$GITHUB_REPOSITORY" '
-                  def active: .status == "queued" or .status == "in_progress" or
-                    .status == "waiting" or .status == "pending" or .status == "requested";
-                  def valid_run:
-                    type == "object" and
-                    (.id | type == "number" and . > 0 and floor == .) and
-                    (.run_attempt | type == "number" and . >= 1 and floor == .) and
-                    (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
-                    (.head_branch | type == "string" and length > 0) and
-                    (.event | type == "string" and length > 0) and
-                    (.repository | type == "object") and
-                    (.repository.full_name | type == "string" and length > 0) and
-                    (.path | type == "string" and length > 0) and
-                    ((active and has("conclusion") and .conclusion == null) or
-                     (.status == "completed" and
-                      (.conclusion == "success" or .conclusion == "failure" or
-                       .conclusion == "timed_out" or .conclusion == "action_required" or
-                       .conclusion == "cancelled" or .conclusion == "skipped" or
-                       .conclusion == "neutral")));
-                  if (.workflow_runs | type) != "array" or
-                     (.total_count | type) != "number" then
-                    error("Invalid validation owner response")
-                  elif .total_count != (.workflow_runs | length) then
-                    error("Incomplete validation owner response")
-                  elif any(.workflow_runs[]; valid_run | not) then
-                    error("Invalid validation run identity or state")
-                  else
-                    [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
-                      .head_sha == $head and .head_branch == $branch and
-                      .event == "pull_request" and .repository.full_name == $repo and
-                      ($workflow == ".github/workflows/validation.yml" or
-                       $workflow == ".github/workflows/validation_self-ci.yml")
-                    )] | sort_by(.id) | last |
-                    if . == null then "missing"
-                    elif active or (.status == "completed" and .conclusion == "success") then "owned"
-                    elif .status == "completed" and
-                         (.conclusion == "failure" or .conclusion == "timed_out" or
-                          .conclusion == "action_required") then "failed"
-                    elif .status == "completed" and
-                         (.conclusion == "cancelled" or .conclusion == "skipped" or
-                          .conclusion == "neutral") then "missing"
-                    else error("Unconfirmed validation owner state") end
-                  end' <<< "$runs")
-                fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-                  --json isDraft,headRefOid,headRefName \
-                  --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
-                if [ "$fresh_state" != "$pr_state" ]; then
-                  echo 'Release PR state changed during validation lookup; refusing a stale readiness mutation.' >&2
-                  exit 1
-                fi
-                if [ "$validation" = owned ]; then
-                  echo "Release PR #$pr already has current-head validation; preserving readiness."
-                  continue
+            # A lock-sync/synchronize transition can move the PR while Actions is
+            # being read. Re-evaluate the whole tuple and its owner; never carry
+            # eligibility across heads or retry a stable failed qualification.
+            for state_attempt in 1 2 3; do
+              pr_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                --json isDraft,headRefOid,headRefName \
+                --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+              read -r PR_DRAFT PR_HEAD PR_BRANCH <<< "$pr_state"
+              if [[ ! "$PR_DRAFT" =~ ^(true|false)$ || ! "$PR_HEAD" =~ ^[a-f0-9]{40}$ ]]; then
+                echo 'Unable to verify generated release PR state.' >&2
+                exit 1
+              fi
+              case "$PR_BRANCH" in
+                release-please--branches--main|release-please--branches--main--*) ;;
+                *) echo 'Release PR head left the generated namespace; refusing readiness mutation.' >&2; exit 1 ;;
+              esac
+              if [ "$AUTO_MERGE" = true ]; then
+                if [ "$PR_DRAFT" = false ]; then
+                  # A ready head already receives synchronize validation. Preserve
+                  # its live/completed owner instead of cancelling and reallocating
+                  # CI every time another queued main release run prepares it.
+                  runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
+                    "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
+                    -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
+                  validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
+                    --arg repo "$GITHUB_REPOSITORY" '
+                    def active: .status == "queued" or .status == "in_progress" or
+                      .status == "waiting" or .status == "pending" or .status == "requested";
+                    def valid_run:
+                      type == "object" and
+                      (.id | type == "number" and . > 0 and floor == .) and
+                      (.run_attempt | type == "number" and . >= 1 and floor == .) and
+                      (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
+                      (.head_branch | type == "string" and length > 0) and
+                      (.event | type == "string" and length > 0) and
+                      (.repository | type == "object") and
+                      (.repository.full_name | type == "string" and length > 0) and
+                      (.path | type == "string" and length > 0) and
+                      ((active and has("conclusion") and .conclusion == null) or
+                       (.status == "completed" and
+                        (.conclusion == "success" or .conclusion == "failure" or
+                         .conclusion == "timed_out" or .conclusion == "action_required" or
+                         .conclusion == "cancelled" or .conclusion == "skipped" or
+                         .conclusion == "neutral")));
+                    if (.workflow_runs | type) != "array" or
+                       (.total_count | type) != "number" then
+                      error("Invalid validation owner response")
+                    elif .total_count != (.workflow_runs | length) then
+                      error("Incomplete validation owner response")
+                    elif any(.workflow_runs[]; valid_run | not) then
+                      error("Invalid validation run identity or state")
+                    else
+                      [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
+                        .head_sha == $head and .head_branch == $branch and
+                        .event == "pull_request" and .repository.full_name == $repo and
+                        ($workflow == ".github/workflows/validation.yml" or
+                         $workflow == ".github/workflows/validation_self-ci.yml")
+                      )] | sort_by(.id) | last |
+                      if . == null then "missing"
+                      elif active or (.status == "completed" and .conclusion == "success") then "owned"
+                      elif .status == "completed" and
+                           (.conclusion == "failure" or .conclusion == "timed_out" or
+                            .conclusion == "action_required") then "failed"
+                      elif .status == "completed" and
+                           (.conclusion == "cancelled" or .conclusion == "skipped" or
+                            .conclusion == "neutral") then "missing"
+                      else error("Unconfirmed validation owner state") end
+                    end' <<< "$runs")
+                  fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                    --json isDraft,headRefOid,headRefName \
+                    --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                  if [ "$fresh_state" != "$pr_state" ]; then
+                    if [ "$state_attempt" -eq 3 ]; then
+                      echo 'Release PR state did not stabilize during validation lookup; refusing readiness mutation.' >&2
+                      exit 1
+                    fi
+                    echo "Release PR #$pr changed during validation lookup; reading its complete state and owner again."
+                    continue
+                  fi
+                  if [ "$validation" = owned ]; then
+                    echo "Release PR #$pr already has current-head validation; preserving readiness."
+                    break
+                  fi
+                  if [ "$validation" = failed ]; then
+                    echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
+                    exit 1
+                  fi
+                  # A missing, cancelled or skipped owner still needs the existing
+                  # explicit ready_for_review transition with the validated token.
+                  gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
                 fi
-                if [ "$validation" = failed ]; then
-                  echo "Current-head validation failed for release PR #$pr; resolve or explicitly retry it before release." >&2
-                  exit 1
+                gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
+              else
+                if [ "$PR_DRAFT" = false ]; then
+                  gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
                 fi
-                # A missing, cancelled or skipped owner still needs the existing
-                # explicit ready_for_review transition with the validated token.
-                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
+                echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. No valid automation token is available (absent or rejected by GitHub), so release PRs are left in draft and need manual readiness before validation and merge workflows trigger."
               fi
-              gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
-            else
-              if [ "$PR_DRAFT" = false ]; then
-                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
-              fi
-              echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. No valid automation token is available (absent or rejected by GitHub), so release PRs are left in draft and need manual readiness before validation and merge workflows trigger."
-            fi
+              break
+            done
           done
       - name: Leave release pull request for manual merge
         if: steps.release.outputs.prs_created == 'true' && steps.credentials.outputs.auto_merge != 'true'
@@ -824,24 +850,30 @@ jobs:
       contents: read
       id-token: write
     env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      NPM_PUBLISH_AUTH: ${{ inputs['npm-publish-auth'] }}
+      HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }}
+      HAS_NPM_READ_TOKEN: ${{ secrets.NPM_READ_TOKEN != '' }}
     steps:
       - name: Checkout release
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
           ref: ${{ needs.release.outputs.tag_name }}
-      - name: Setup Node (trusted)
-        if: env.NPM_TOKEN == ''
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-      - name: Setup Node (token)
-        if: env.NPM_TOKEN != ''
+      - name: Validate npm publication authentication
+        run: |
+          set -euo pipefail
+          case "$NPM_PUBLISH_AUTH" in
+            auto|oidc|token) ;;
+            *) echo "Unsupported npm-publish-auth: $NPM_PUBLISH_AUTH" >&2; exit 1 ;;
+          esac
+          if [ "$NPM_PUBLISH_AUTH" = token ] && [ "$HAS_NPM_TOKEN" != true ]; then
+            echo 'npm-publish-auth token requires the NPM_TOKEN secret.' >&2
+            exit 1
+          fi
+      - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org
       - name: Setup Bun (lockfile managers)
         # The install step below dispatches on lockfile: bun, pnpm, yarn, or
         # npm. Stock runners only provide Node, so provision Bun (oven-sh)
@@ -855,8 +887,18 @@ jobs:
       - name: Install dependencies
         # npm publish runs prepublishOnly (usually a build), which needs
         # devDependencies present. Install with the project's own manager.
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_READ_TOKEN || (inputs['npm-publish-auth'] != 'oidc' && secrets.NPM_TOKEN) || '' }}
         run: |
           set -euo pipefail
+          npmrc=''
+          if [ -n "${NODE_AUTH_TOKEN:-}" ]; then
+            npmrc="$(mktemp)"
+            chmod 600 "$npmrc"
+            printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > "$npmrc"
+            export NPM_CONFIG_USERCONFIG="$npmrc"
+          fi
+          trap '[ -z "$npmrc" ] || rm -f "$npmrc"' EXIT
           if [ -f bun.lock ] || [ -f bun.lockb ]; then bun install --frozen-lockfile
           elif [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile
           elif [ -f yarn.lock ]; then yarn install --immutable
@@ -864,10 +906,16 @@ jobs:
           elif [ -f package.json ]; then npm install --no-audit --fund=false --package-lock=false
           fi
       - name: Publish npm with token
-        if: env.NPM_TOKEN != ''
+        if: inputs['npm-publish-auth'] == 'token' || (inputs['npm-publish-auth'] == 'auto' && env.HAS_NPM_TOKEN == 'true')
         env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
-        run: npm publish --provenance --access public
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          npmrc="$(mktemp)"
+          chmod 600 "$npmrc"
+          printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > "$npmrc"
+          trap 'rm -f "$npmrc"' EXIT
+          NPM_CONFIG_USERCONFIG="$npmrc" npm publish --provenance --access public
       - name: Publish npm with trusted publishing
-        if: env.NPM_TOKEN == ''
+        if: inputs['npm-publish-auth'] == 'oidc' || (inputs['npm-publish-auth'] == 'auto' && env.HAS_NPM_TOKEN != 'true')
         run: npm publish --provenance --access public

package/.github/workflows/release_self-ci.yml

@@ -256,5 +256,3 @@ jobs:
       tag: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
       asset: ${{ needs.qualification.outputs.filename }}
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/security.yml

@@ -140,7 +140,9 @@ jobs:
   dependency-audit:
     name: Dependency Audit (${{ matrix.entry.display }})
     needs: profile
-    if: vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success'
+    # Avoid expanding an empty matrix; skip only the explicitly empty result.
+    # Missing or malformed output still fails closed during matrix expansion.
+    if: vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success' && needs.profile.outputs.audit_matrix != '[]'
     strategy:
       fail-fast: false
       max-parallel: 8

package/.github/workflows/test.yml

@@ -38,6 +38,11 @@ on:
         required: false
         type: string
         default: task-result
+      integration-total-shards:
+        description: Integration partitions (1 or 2); sharded scripts must honor INTEGRATION_SHARD_INDEX and INTEGRATION_TOTAL_SHARDS.
+        required: false
+        type: string
+        default: '1'
       e2e-shard-list:
         description: Comma-separated E2E shard indices, for example "1,2". A single index runs one unsharded job.
         required: false
@@ -255,10 +260,14 @@ jobs:
 
   integration:
     name: Integration
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true && inputs.integration-total-shards != '2'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
+      - name: Validate integration shard count
+        env:
+          SHARDS: ${{ inputs.integration-total-shards }}
+        run: test "$SHARDS" = 1
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -326,6 +335,86 @@ jobs:
       - name: Save Vite+ task cache
         uses: ./.github/actions/vite-plus-cache-save
 
+  integration-sharded:
+    name: Integration shard
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true && inputs.integration-total-shards == '2'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+      - name: Runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            .github/actions
+            src/lib
+            src/runtime-core.mjs
+            src/runtime.mjs
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions
+          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Detect
+        id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile integration >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
+          install-python: ${{ steps.applicability.outputs.python == 'true' }}
+          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-build: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-environment: false
+          cache-save: ${{ github.event_name == 'push' }}
+          task: integration
+          task-javascript: ${{ steps.applicability.outputs.javascript }}
+          task-python: ${{ steps.applicability.outputs.python }}
+          task-rust: ${{ steps.applicability.outputs.rust }}
+      - name: Integration
+        id: execute
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          INTEGRATION_SHARD_INDEX: ${{ matrix.shard }}
+          INTEGRATION_TOTAL_SHARDS: ${{ inputs.integration-total-shards }}
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
+          hashFiles('.code-foundry/results/integration.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-integration-s${{ matrix.shard }}
+          path: .code-foundry/results/integration.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   e2e:
     name: E2E
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true