code-foundry 1.48.7 → 1.50.0

package/src/commands/sync.mjs

@@ -164,6 +164,16 @@ function synchronize(options) {
   if (!['true', 'false'].includes(draftProtection)) {
     throw new Error(`Unsupported draft_protection: ${draftProtection}; use true or false.`)
   }
+  const qualificationReceipts = configured(config.release_qualification_receipts, 'false')
+  if (!['true', 'false'].includes(qualificationReceipts)) {
+    throw new Error(
+      `Unsupported release_qualification_receipts: ${qualificationReceipts}; use true or false.`
+    )
+  }
+  const npmPublishAuth = configured(config.npm_publish_auth, 'auto')
+  if (!['auto', 'oidc', 'token'].includes(npmPublishAuth)) {
+    throw new Error(`Unsupported npm_publish_auth: ${npmPublishAuth}; use auto, oidc, or token.`)
+  }
   // Validate the dependency-update bot policy before any sync writes so a
   // typo fails fast instead of leaving a half-switched updater behind.
   const dependencyUpdater = configured(config.dependency_updater, 'dependabot')
@@ -1094,6 +1104,7 @@ export function renderDevChannel(config) {
  * @param {boolean} selfRepository
  */
 function renderWorkflow(content, config, repository, ref, rustCodeql, file, selfRepository) {
+  const npmPublishAuth = configured(config.npm_publish_auth, 'auto')
   const localPrefix = 'uses: ./.github/workflows/'
   const remotePrefix = `uses: ${repository}/.github/workflows/`
   let rendered = content.replaceAll(localPrefix, remotePrefix)
@@ -1162,7 +1173,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
   if (workflow === 'release' && !selfRepository) {
     rendered = rendered.replace(
       /^(\s+runtime-ref:)\s+.*$/m,
-      `$1 ${ref}\n      git-workflow: ${isStagingRelease(config.git_workflow) ? 'staging-release' : 'direct'}`
+      `$1 ${ref}\n      git-workflow: ${isStagingRelease(config.git_workflow) ? 'staging-release' : 'direct'}\n      npm-publish-auth: ${npmPublishAuth}`
     )
   }
   // Generated PR callers protect drafts by default. Consumers that intentionally
@@ -1170,6 +1181,22 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
   if (configured(config.draft_protection, 'true') === 'false') {
     rendered = rendered.replaceAll(' && github.event.pull_request.draft == false', '')
   }
+  const integrationShards =
+    config.integration_shards === undefined || config.integration_shards === ''
+      ? 1
+      : Number(config.integration_shards)
+  if (!Number.isInteger(integrationShards) || integrationShards < 1 || integrationShards > 2) {
+    throw new Error(`Unsupported integration_shards: ${config.integration_shards}; use 1 or 2.`)
+  }
+  if (integrationShards > 1 && configured(config.billing_lanes, 'false') === 'true') {
+    throw new Error('integration_shards cannot be combined with billing_lanes.')
+  }
+  if (integrationShards > 1 && file === '.github/workflows/validation.yml') {
+    rendered = rendered.replace(
+      /^(\s+integration-total-shards:)\s+.*$/gm,
+      `$1 ${integrationShards}`
+    )
+  }
   // E2E sharding fans the managed E2E job into one runner per shard; shards
   // stay isolated because each job owns a runner-local test database. Fail
   // closed on a malformed count rather than silently rendering a single shard.
@@ -1225,9 +1252,13 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
         )
       }
     }
+    const npmSecrets =
+      configured(config.npm_publish, 'false') !== 'true'
+        ? ''
+        : `${npmPublishAuth === 'oidc' ? '' : '      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}\n'}      NPM_READ_TOKEN: \${{ secrets.NPM_READ_TOKEN }}\n`
     rendered = rendered.replace(
       /(\n    secrets:\n      CODE_FOUNDRY_TOKEN: \$\{\{ secrets\.CODE_FOUNDRY_TOKEN \}\}\n)/,
-      '$1      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}\n'
+      `$1${npmSecrets}`
     )
   }
   // The staging-release topology validates and scans pull requests against
@@ -1286,6 +1317,19 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       if (!value) continue
       rendered = rendered.replace(new RegExp(`^(\\s+${input}:)\\s+.*$`, 'm'), `$1 ${value}`)
     }
+    if (
+      workflow === 'validation' &&
+      configured(config.release_qualification_receipts, 'false') === 'true'
+    ) {
+      const qualified = rendered.replace(
+        /^(\s+mode:)\s+(\$\{\{\s*needs\.mode\.outputs\.mode\s*\}\})\s*$/m,
+        '$1 $2\n      release-qualification-receipts: true'
+      )
+      if (qualified === rendered) {
+        throw new Error('Validation caller cannot render release-qualification-receipts opt-in.')
+      }
+      rendered = qualified
+    }
     // Every Rust CodeQL lane in the caller must carry the configured shard
     // list. A SARIF category is derived from the shard string, so a caller that
     // renders the configuration into the pull-request lane while a second lane
@@ -1525,8 +1569,8 @@ const DIRECT_DOC_REPLACEMENTS = {
       '7. Push to the fork and open a pull request targeting `main`.',
     ],
     [
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |\n',
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |\n',
+      '| Event                                              | Expected automation                                                                                                                       |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                                                                        |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                                                     |\n| Exact Release Please PR targeting `main`           | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests                                      |\n| Scheduled or manual validation                     | Full audit tier                                                                                                                           |\n| Push to a working branch                           | Draft PR workflow                                                                                                                         |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                                                                        |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)                                                                    |\n',
+      '| Event                                    | Expected automation                                                                                  |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`      | No runner-heavy validation; run local checks before requesting review                                |\n| Ready pull request targeting `main`      | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation           | Full audit tier                                                                                      |\n| Push to a working branch                 | Draft PR workflow                                                                                    |\n| Push to `main`                           | Release workflow; CodeQL skips release-only merges (audit covers drift)                              |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
@@ -2149,6 +2193,7 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     languages,
     features: 'all',
     codeql: 'auto',
+    release_qualification_receipts: 'false',
     dependency_review: 'auto',
     package_manager: packageManager,
     codeql_rust_shards: '["all"]',
@@ -2176,6 +2221,7 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     monorepo_tool: 'auto',
     release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node',
     npm_publish: 'false',
+    npm_publish_auth: 'auto',
     post_release: 'false',
     post_release_workflow: '',
     post_release_mode: 'auto',

package/src/lib/github-doctor.mjs

@@ -144,6 +144,7 @@ export function doctorGithub(root) {
     : undefined
   const credentialChecks = {
     npmTokenPresent: secretNames.includes('NPM_TOKEN'),
+    npmReadTokenPresent: secretNames.includes('NPM_READ_TOKEN'),
     turboTokenPresent: secretNames.includes('TURBO_TOKEN'),
     turboTeamPresent: Boolean(
       repositoryVariables.some(
@@ -153,10 +154,30 @@ export function doctorGithub(root) {
     opencodeApiKeyPresent: secretNames.includes('OPENCODE_API_KEY'),
   }
   details.credentials = credentialChecks
-  if (config.npm_publish === 'true' && !credentialChecks.npmTokenPresent)
+  const npmPublishAuth = config.npm_publish_auth ?? 'auto'
+  details.credentials.npmPublishAuth = npmPublishAuth
+  if (!['auto', 'oidc', 'token'].includes(npmPublishAuth)) {
+    errors.push('npm_publish_auth must be auto, oidc, or token.')
+  } else if (config.npm_publish === 'true' && npmPublishAuth === 'token') {
+    if (!credentialChecks.npmTokenPresent)
+      errors.push('npm_publish_auth is token but NPM_TOKEN is not configured.')
+  } else if (
+    config.npm_publish === 'true' &&
+    npmPublishAuth === 'auto' &&
+    !credentialChecks.npmTokenPresent
+  ) {
     warnings.push(
-      'npm_publish is enabled but NPM_TOKEN is not configured; npm trusted publishing must be configured for tokenless publication.'
+      'npm_publish_auth is auto and NPM_TOKEN is absent; publication uses OIDC, so npm trust must match this repository and the generated release.yml caller.'
     )
+  } else if (
+    config.npm_publish === 'true' &&
+    npmPublishAuth === 'oidc' &&
+    credentialChecks.npmTokenPresent
+  ) {
+    warnings.push(
+      'npm_publish_auth is oidc; NPM_TOKEN is not used for publishing or install. Use NPM_READ_TOKEN only when private dependencies require read access.'
+    )
+  }
   if (
     ['true', 'auto'].includes(config.turbo_remote ?? 'false') &&
     (!credentialChecks.turboTokenPresent || !credentialChecks.turboTeamPresent)

package/src/lib/node-package-performance.mjs

@@ -17,6 +17,62 @@ const METRICS = new Set([
   'productionDependencyCount',
 ])
 
+/**
+ * npm 12 keys pack reports by package name; older npm versions return an array.
+ * Count reports before validating their shape so an extra malformed entry cannot be ignored.
+ * @param {unknown} value
+ * @returns {{filename: string, size: number, unpackedSize: number, files: Array<{path: string}>, name?: string, version?: string}}
+ */
+export function singleNpmPackReport(value) {
+  let reports
+  if (Array.isArray(value)) reports = value
+  else if (value && typeof value === 'object') {
+    const object = /** @type {Record<string, unknown>} */ (value)
+    reports = typeof object.filename === 'string' ? [object] : Object.values(object)
+  } else reports = []
+  if (reports.length !== 1) throw new Error('Expected one npm pack report.')
+  const packed = reports[0]
+  if (!packed || typeof packed !== 'object' || Array.isArray(packed))
+    throw new Error('npm pack returned no package result.')
+  if (typeof packed.filename !== 'string' || packed.filename.length === 0)
+    throw new Error('npm pack result is missing filename.')
+  for (const field of ['size', 'unpackedSize'])
+    if (typeof packed[field] !== 'number' || !Number.isFinite(packed[field]) || packed[field] < 0)
+      throw new Error(`npm pack result is missing non-negative numeric ${field}.`)
+  if (
+    !Array.isArray(packed.files) ||
+    !packed.files.every(
+      (/** @type {unknown} */ file) =>
+        file !== null &&
+        typeof file === 'object' &&
+        !Array.isArray(file) &&
+        typeof (/** @type {{path?: unknown}} */ (file).path) === 'string'
+    )
+  )
+    throw new Error('npm pack result is missing a valid files list.')
+  return packed
+}
+
+/**
+ * Verify the single npm pack report used to inspect a versioned root package.
+ * Supports both npm's legacy array and npm 12's package-name keyed object.
+ * @param {unknown} value
+ * @param {{name?:unknown,version?:unknown}} manifest
+ */
+export function verifyNpmPackPackage(value, manifest) {
+  const packed = singleNpmPackReport(value)
+  if (
+    typeof manifest?.name !== 'string' ||
+    typeof manifest.version !== 'string' ||
+    packed.name !== manifest.name ||
+    packed.version !== manifest.version ||
+    !packed.files.some((file) => file.path === 'package.json')
+  ) {
+    throw new Error('npm pack result does not match the root package manifest.')
+  }
+  return packed
+}
+
 /** @param {number[]} values @param {number} percent */
 export function percentile(values, percent) {
   if (values.length === 0) throw new Error('percentile requires at least one value')
@@ -59,8 +115,7 @@ export function runNodePackagePerformance(
     ? measureImports(root, String(policy.controlImport), samples)
     : null
   const pack = npmJson(root, ['pack', '--dry-run', '--json', '--ignore-scripts'], 'npm pack')
-  const packed = Array.isArray(pack) ? pack[0] : pack
-  if (!packed || typeof packed !== 'object') throw new Error('npm pack returned no package result.')
+  const packed = singleNpmPackReport(pack)
   /** @type {Array<{path?: string}>} */
   const files = Array.isArray(packed.files) ? packed.files : []
   const productionDependencyCount = npmProductionDependencyCount(root)

package/src/lib/product-quality.mjs

@@ -17,6 +17,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { tmpdir } from 'node:os'
 import { gzipSync } from 'node:zlib'
+import { singleNpmPackReport } from './node-package-performance.mjs'
 
 /** @typedef {Record<string, any>} Profile */
 /** @param {unknown} condition @param {string} message @returns {asserts condition} */
@@ -602,24 +603,23 @@ export function checkPackage(root, profile, output) {
   // Pack outside the consumer repository so test installations cannot become package input.
   const temporary = mkdtempSync(join(tmpdir(), 'foundry-package-quality-'))
   try {
-    const pack = JSON.parse(
-      runQualityCommand(
-        ['npm', 'pack', '--ignore-scripts', '--json', '--pack-destination', temporary],
-        root,
-        output
+    const pack = singleNpmPackReport(
+      JSON.parse(
+        runQualityCommand(
+          ['npm', 'pack', '--ignore-scripts', '--json', '--pack-destination', temporary],
+          root,
+          output
+        )
       )
     )
+    requireValue(/^[A-Za-z0-9._-]+\.tgz$/.test(pack.filename), 'Expected one package archive')
     requireValue(
-      Array.isArray(pack) && pack.length === 1 && /^[A-Za-z0-9._-]+\.tgz$/.test(pack[0].filename),
-      'Expected one package archive'
-    )
-    requireValue(
-      pack[0].files.every(
+      pack.files.every(
         (/** @type {{path:string}} */ file) => !/^\.code-foundry(?:\/|$)/.test(file.path)
       ),
       'Exclude .code-foundry quality evidence from the published package'
     )
-    const archive = ownedPath(temporary, pack[0].filename)
+    const archive = ownedPath(temporary, pack.filename)
     const archiveSha256 = createHash('sha256').update(readFileSync(archive)).digest('hex')
     const consumer = join(temporary, 'consumer')
     mkdirSync(consumer)

package/src/lib/validation-policy.mjs

@@ -82,13 +82,9 @@ export function classifyValidationMode(input) {
 const REQUIRED_JOBS_BY_MODE = {
   fast: ['ci', 'test'],
   audit: ['ci', 'test', 'security', 'codeql', 'eval'],
-  // Release Please pull requests change version metadata only, and the gate
-  // validates that diff against the release policy before anything publishes.
-  // The content tree was already fully audited by the pull requests that
-  // merged into main, and the scheduled audit lane re-covers drift. The
-  // release tier therefore requires the fast suite plus CodeQL, whose
-  // per-pull-request code scanning results some repository rulesets require
-  // to keep the release from deadlocking.
+  // Release Please uses the full CI and unit-test fallback unless the
+  // orchestrator has verified an exact short-lived source receipt. CodeQL
+  // remains required because some rulesets require a PR analysis to merge.
   release: ['ci', 'test', 'codeql'],
 }
 
@@ -96,9 +92,13 @@ const REQUIRED_JOBS_BY_MODE = {
  * Job ids that the aggregate gate requires for a mode. Expected skips never
  * appear here: anything outside the returned list is not part of the gate.
  * @param {string} mode
+ * @param {{sourceQualification?:boolean}} [options]
  * @returns {string[]}
  */
-export function requiredValidationJobs(mode) {
+export function requiredValidationJobs(mode, options = {}) {
+  if (mode === 'release' && options.sourceQualification === true) {
+    return ['ci', 'codeql', 'qualification']
+  }
   const jobs = REQUIRED_JOBS_BY_MODE[/** @type {'fast'|'audit'|'release'} */ (mode)]
   if (!jobs) {
     throw new Error(
@@ -114,14 +114,14 @@ export function requiredValidationJobs(mode) {
  * non-required jobs never fail the gate. Every required job must report
  * exactly `success`; failure, cancellation, an unexpected skip, a missing
  * result, or an unknown result fails the gate (fail closed).
- * @param {{ mode: string, results?: Record<string, string | null | undefined> }} input
+ * @param {{ mode: string, results?: Record<string, string | null | undefined>, sourceQualification?:boolean }} input
  * @returns {{ valid: boolean, required: string[], failures: Array<{ job: string, result: string }> }}
  */
 export function evaluateValidationGate(input) {
-  const { mode, results = {} } = input
+  const { mode, results = {}, sourceQualification = false } = input
   let required
   try {
-    required = requiredValidationJobs(mode)
+    required = requiredValidationJobs(mode, { sourceQualification })
   } catch (error) {
     return {
       valid: false,

package/src/runtime-core.mjs

@@ -380,7 +380,9 @@ function validation(task) {
         security: process.env.FOUNDRY_SECURITY,
         codeql: process.env.FOUNDRY_CODEQL,
         eval: process.env.FOUNDRY_EVAL,
+        qualification: process.env.FOUNDRY_QUALIFICATION,
       },
+      sourceQualification: process.env.FOUNDRY_SOURCE_QUALIFICATION === 'true',
     })
     if (gate.valid) {
       console.log(`Validation gate passed for ${mode} mode.`)
@@ -404,6 +406,28 @@ function validation(task) {
           { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
         )
       : undefined
+    if (diff && diff.status !== 0) {
+      // Git can relay arbitrary remote messages, URLs and credentials on stderr. Emit only
+      // bounded, recognised failure facts; never replay remote text as workflow annotations.
+      const stderr = (diff.stderr ?? '').slice(0, 8192)
+      const missingBlob = /could not fetch ([0-9a-f]{40,64}) from promisor remote/i.exec(stderr)
+      const reason = missingBlob
+        ? `historical blob ${missingBlob[1]} unavailable from promisor remote`
+        : /authentication failed|could not read (?:username|password)|terminal prompts disabled/i.test(
+              stderr
+            )
+          ? 'authentication unavailable'
+          : /could not read from remote repository/i.test(stderr)
+            ? 'remote repository unavailable'
+            : /bad object|unknown revision|invalid symmetric difference|ambiguous argument/i.test(
+                  stderr
+                )
+              ? 'revision unavailable'
+              : 'Git error details omitted'
+      console.error(
+        `::error::Git content diff failed (status ${diff.status ?? 'unavailable'}): ${reason}.`
+      )
+    }
     const result = validateGeneratedReleaseDiff({
       headRef: process.env.FOUNDRY_HEAD_REF ?? '',
       headRepo: process.env.FOUNDRY_HEAD_REPO ?? '',