code-foundry 1.48.8 → 1.50.0

package/.github/CONTRIBUTING.md

@@ -220,14 +220,14 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 ## Workflow and check behavior
 
-| Event                                              | Expected automation                                                                   |
-| -------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |
-| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |
-| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |
-| Scheduled or manual validation                     | Full audit tier                                                                       |
-| Push to a working branch                           | Draft PR workflow                                                                     |
-| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |
+| Event                                    | Expected automation                                                                                  |
+| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| Draft pull request targeting `main`      | No runner-heavy validation; run local checks before requesting review                                |
+| Ready pull request targeting `main`      | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                |
+| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |
+| Scheduled or manual validation           | Full audit tier                                                                                      |
+| Push to a working branch                 | Draft PR workflow                                                                                    |
+| Push to `main`                           | Release workflow; CodeQL skips release-only merges (audit covers drift)                              |
 
 Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 

package/.github/code-foundry.schema.json

@@ -7,6 +7,16 @@
       "description": "Explicit JavaScript formatter. Omit to preserve repository scripts and the Oxfmt fallback.",
       "type": "string",
       "enum": ["oxfmt", "prettier", "bun"]
+    },
+    "release_qualification_receipts": {
+      "description": "Opt in to seven-day exact-tree qualification receipts for Release Please validation.",
+      "type": "string",
+      "enum": ["true", "false"]
+    },
+    "npm_publish_auth": {
+      "description": "npm publisher authentication: auto preserves token users and uses OIDC when no publish token is present; oidc forces trusted publishing; token requires NPM_TOKEN.",
+      "type": "string",
+      "enum": ["auto", "oidc", "token"]
     }
   },
   "additionalProperties": true

package/.github/code-foundry.yml

@@ -5,6 +5,7 @@ languages: typescript
 features: all
 draft_protection: true
 codeql: auto
+release_qualification_receipts: false
 codeql_rust_shards: '["all"]'
 codeql_rust_threads: 1
 codeql_rust_max_parallel: 1
@@ -15,6 +16,7 @@ runtime_repository: 0xPlayerOne/code-foundry
 runtime_ref: v1.30.0
 release_type: node
 npm_publish: true
+npm_publish_auth: oidc
 license: agpl-3.0-or-later
 git_workflow: direct
 merge_strategy: squash

package/.github/workflows/ci.yml

@@ -23,6 +23,16 @@ on:
         required: false
         type: string
         default: task-result
+      release-build-only:
+        description: Run only the build lane after an exact successful source qualification receipt.
+        required: false
+        type: boolean
+        default: false
+      release-package-check:
+        description: Inspect the versioned npm package contents on release pull requests.
+        required: false
+        type: boolean
+        default: false
     secrets:
       TURBO_TOKEN:
         required: false
@@ -55,7 +65,7 @@ concurrency:
 jobs:
   format:
     name: Format
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.release-build-only != true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -124,7 +134,7 @@ jobs:
 
   lint:
     name: Lint
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.release-build-only != true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -188,7 +198,7 @@ jobs:
 
   type-check:
     name: Type-Check
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.release-build-only != true
     permissions:
       contents: read
       issues: read
@@ -279,6 +289,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
+            src/commands/qualification-receipt.mjs
             src/lib
             src/runtime-core.mjs
             src/runtime.mjs
@@ -287,6 +298,11 @@ jobs:
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Set up Node.js 24.18.0 for package inspection
+        if: inputs.release-package-check == true
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
       - name: Detect
         id: applicability
         env:
@@ -296,8 +312,13 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run build >> "$GITHUB_OUTPUT"
+      - name: Verify versioned package build contract
+        if: inputs.release-package-check == true
+        env:
+          FOUNDRY_BUILD_TASK_APPLICABLE: ${{ steps.applicability.outputs.applicable }}
+        run: node "$RUNNER_TEMP/code-foundry/src/commands/qualification-receipt.mjs" package-contract
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        if: steps.applicability.outputs.applicable == 'true' && (inputs.release-build-only == true || steps.applicability.outputs.affected != 'false')
         uses: ./.github/actions/setup
         with:
           install: 'true'
@@ -305,8 +326,23 @@ jobs:
           task: build
       - name: Build
         id: execute
-        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        if: steps.applicability.outputs.applicable == 'true' && (inputs.release-build-only == true || steps.applicability.outputs.affected != 'false')
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build
+      - name: Inspect versioned npm package contents
+        if: inputs.release-package-check == true && hashFiles('package.json') != ''
+        run: |
+          npm pack --dry-run --ignore-scripts --json > "$RUNNER_TEMP/foundry-package-inspection.json"
+          node --input-type=module -e '
+            import { readFileSync } from "node:fs";
+            import { join } from "node:path";
+            import { pathToFileURL } from "node:url";
+
+            const runtime = join(process.env.RUNNER_TEMP, "code-foundry", "src/lib/node-package-performance.mjs");
+            const { verifyNpmPackPackage } = await import(pathToFileURL(runtime).href);
+            const manifest = JSON.parse(readFileSync("package.json", "utf8"));
+            const report = JSON.parse(readFileSync(process.argv[1], "utf8"));
+            verifyNpmPackPackage(report, manifest);
+          ' "$RUNNER_TEMP/foundry-package-inspection.json"
       - name: Retain task receipt
         if: >-
           always() &&

package/.github/workflows/draft-enforcement_self-ci.yml

@@ -36,11 +36,11 @@ jobs:
             exit 1
           fi
 
-          read -r draft head_ref head_sha updated_at < <(
+          read -r draft head_ref head_sha updated_at node_id < <(
             gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \
-              --jq '[.draft, .head.ref, .head.sha, .updated_at] | @tsv'
+              --jq '[.draft, .head.ref, .head.sha, .updated_at, .node_id] | @tsv'
           )
-          if [ -z "$draft" ] || [ -z "$head_ref" ] || [ -z "$head_sha" ] || [ -z "$updated_at" ]; then
+          if [ -z "$draft" ] || [ -z "$head_ref" ] || [ -z "$head_sha" ] || [ -z "$updated_at" ] || [ -z "$node_id" ]; then
             echo '::error title=Draft guard cannot verify current state::The GitHub API response did not include the required pull-request metadata.'
             exit 1
           fi
@@ -70,9 +70,13 @@ jobs:
             exit 1
           fi
 
-          gh api \
-            --method PATCH \
-            "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \
-            -F draft=true \
-            --silent >/dev/null
+          result=$(gh api graphql \
+            -f query='mutation($pullRequestId: ID!) { convertPullRequestToDraft(input: {pullRequestId: $pullRequestId}) { pullRequest { id isDraft } } }' \
+            -f pullRequestId="$node_id" \
+            --jq '.data.convertPullRequestToDraft.pullRequest | [.id, .isDraft] | @tsv')
+          read -r returned_id is_draft <<< "$result"
+          if [ "$returned_id" != "$node_id" ] || [ "$is_draft" != true ]; then
+            echo '::error title=Draft guard conversion failed::GraphQL did not confirm the expected pull request is a draft.'
+            exit 1
+          fi
           echo "Converted ordinary pull request #$PR_NUMBER to draft; validation waits for ready_for_review."

package/.github/workflows/qualification-receipt.yml

@@ -0,0 +1,201 @@
+name: Code Foundry Qualification Receipt
+
+on:
+  workflow_call:
+    inputs:
+      phase:
+        description: Produce evidence after a full audit or verify it for a release PR.
+        required: true
+        type: string
+      mode:
+        description: Validation tier associated with this receipt operation.
+        required: true
+        type: string
+      enabled:
+        description: Consumer opt-in for qualification receipt reuse.
+        required: false
+        type: boolean
+        default: false
+      codeql-enabled:
+        description: Whether the consumer requires CodeQL in its audit and release lanes.
+        required: false
+        type: boolean
+        default: true
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: true
+        type: string
+      runtime-ref:
+        description: Runtime commit, tag, or ref used by source validation.
+        required: true
+        type: string
+      job-results-json:
+        description: Normalized component results for the successful full audit.
+        required: false
+        type: string
+        default: '{}'
+      required-job-names-json:
+        description: Exact aggregate gate job names to verify from the source run's complete attempt-job listing.
+        required: false
+        type: string
+        default: '[]'
+    outputs:
+      reuse:
+        description: True only when a matching recent source receipt was verified.
+        value: ${{ jobs.verify.outputs.reuse }}
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+
+jobs:
+  verify:
+    name: Verify source receipt
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.enabled == true &&
+      inputs.phase == 'verify' && inputs.mode == 'release'
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    outputs:
+      reuse: ${{ steps.verify.outputs.reuse }}
+    steps:
+      - name: Checkout release PR source
+        id: source
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Checkout runtime
+        id: runtime
+        if: steps.source.outcome == 'success'
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            src/commands/qualification-receipt.mjs
+            src/lib
+            src/runtime-core.mjs
+            src/runtime.mjs
+      - name: Install runtime
+        id: install
+        if: steps.runtime.outcome == 'success'
+        continue-on-error: true
+        run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+      - name: Set up Node.js 24.18.0
+        id: node
+        if: steps.install.outcome == 'success'
+        continue-on-error: true
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
+      - name: Check version-only release diff
+        id: release-policy
+        if: steps.node.outcome == 'success'
+        continue-on-error: true
+        env:
+          FOUNDRY_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          FOUNDRY_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          FOUNDRY_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          FOUNDRY_REPOSITORY: ${{ github.repository }}
+          RUNTIME_PATH: ${{ runner.temp }}/code-foundry
+        run: node "$RUNTIME_PATH/src/runtime.mjs" validation release_diff
+      - name: Verify source qualification receipt
+        id: verify
+        if: always()
+        continue-on-error: true
+        env:
+          SOURCE_READY: ${{ steps.source.outcome }}
+          RUNTIME_READY: ${{ steps.install.outcome }}
+          NODE_READY: ${{ steps.node.outcome }}
+          POLICY_READY: ${{ steps.release-policy.outcome }}
+          GITHUB_TOKEN: ${{ github.token }}
+          RUNTIME_PATH: ${{ runner.temp }}/code-foundry
+          RUNTIME_REPOSITORY: ${{ inputs.runtime-repository }}
+          FOUNDRY_MODE: ${{ inputs.mode }}
+          FOUNDRY_CODEQL_ENABLED: ${{ inputs.codeql-enabled }}
+          FOUNDRY_REQUIRED_JOB_NAMES_JSON: ${{ inputs.required-job-names-json }}
+        run: |
+          if [ "$SOURCE_READY" = success ] && [ "$RUNTIME_READY" = success ] && [ "$NODE_READY" = success ] && [ "$POLICY_READY" = success ] && [ -f "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" ]; then
+            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" verify >> "$GITHUB_OUTPUT"
+          else
+            echo 'reuse=false' >> "$GITHUB_OUTPUT"
+            echo 'reason=qualification or version-only release policy unavailable; using full validation' >> "$GITHUB_OUTPUT"
+          fi
+
+  produce:
+    name: Produce source receipt
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.enabled == true &&
+      inputs.phase == 'produce' && inputs.mode == 'audit'
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    steps:
+      - name: Checkout tested source tree
+        id: source
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+          fetch-depth: 2
+      - name: Checkout runtime
+        id: runtime
+        if: steps.source.outcome == 'success'
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            src/commands/qualification-receipt.mjs
+            src/lib
+      - name: Install runtime
+        id: install
+        if: steps.runtime.outcome == 'success'
+        continue-on-error: true
+        run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+      - name: Set up Node.js 24.18.0
+        id: node
+        if: steps.install.outcome == 'success'
+        continue-on-error: true
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
+      - name: Create qualification receipt
+        id: produce
+        if: always()
+        continue-on-error: true
+        env:
+          SOURCE_READY: ${{ steps.source.outcome }}
+          RUNTIME_READY: ${{ steps.install.outcome }}
+          NODE_READY: ${{ steps.node.outcome }}
+          GITHUB_TOKEN: ${{ github.token }}
+          RUNTIME_PATH: ${{ runner.temp }}/code-foundry
+          RUNTIME_REPOSITORY: ${{ inputs.runtime-repository }}
+          FOUNDRY_MODE: ${{ inputs.mode }}
+          FOUNDRY_JOB_RESULTS_JSON: ${{ inputs.job-results-json }}
+          FOUNDRY_REQUIRED_JOB_NAMES_JSON: ${{ inputs.required-job-names-json }}
+        run: |
+          if [ "$SOURCE_READY" = success ] && [ "$RUNTIME_READY" = success ] && [ "$NODE_READY" = success ] && [ -f "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" ]; then
+            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" produce >> "$GITHUB_OUTPUT"
+          else
+            echo 'reuse=false' >> "$GITHUB_OUTPUT"
+            echo 'reason=receipt setup unavailable' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Upload qualification receipt
+        if: steps.produce.outputs.reuse == 'true'
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: code-foundry-qualification-v2-${{ github.run_id }}-${{ github.run_attempt }}
+          path: qualification-receipt.json
+          if-no-files-found: error
+          retention-days: 7

package/.github/workflows/qualified-foundry-publish.yml

@@ -16,9 +16,6 @@ on:
         required: false
         type: boolean
         default: false
-    secrets:
-      NPM_TOKEN:
-        required: false
 
 permissions:
   attestations: read
@@ -88,7 +85,6 @@ jobs:
       contents: read
       id-token: write
     env:
-      HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }}
       RELEASE_TAG: ${{ inputs.tag }}
       RELEASE_ASSET: ${{ inputs.asset }}
     steps:
@@ -98,16 +94,9 @@ jobs:
           persist-credentials: false
           ref: ${{ github.sha }}
       - name: Setup Node for trusted publishing
-        if: env.HAS_NPM_TOKEN != 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '24'
-      - name: Setup Node for token publishing
-        if: env.HAS_NPM_TOKEN == 'true'
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'
-          registry-url: https://registry.npmjs.org
       - name: Retrieve only this run attempt's evidence
         env:
           GH_TOKEN: ${{ github.token }}
@@ -124,7 +113,6 @@ jobs:
       - name: Reverify and publish the tested tarball without lifecycle hooks
         env:
           GH_TOKEN: ${{ github.token }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           set -euo pipefail
           node src/commands/qualified-publication.mjs publish \

package/.github/workflows/release.yml

@@ -43,6 +43,11 @@ on:
         required: false
         type: boolean
         default: false
+      npm-publish-auth:
+        description: Select automatic token compatibility or force trusted OIDC publication.
+        required: false
+        type: string
+        default: auto
     outputs:
       release_created:
         description: Whether Release Please created a release (possibly a draft).
@@ -63,6 +68,8 @@ on:
         required: false
       NPM_TOKEN:
         required: false
+      NPM_READ_TOKEN:
+        required: false
 
 permissions:
   actions: write
@@ -271,11 +278,12 @@ jobs:
           // Writes intermittently hit GitHub's secondary rate limiting from
           // busy automation accounts (403 with the generic not-accessible
           // message); back off and retry before giving up.
-          const gh = (args) => {
+          const gh = (args, options = {}) => {
             for (const wait of [0, 10, 30]) {
               try {
                 if (wait) sleep(wait);
                 return execFileSync('gh', args, {
+                  ...options,
                   encoding: 'utf8',
                   maxBuffer: 32 * 1024 * 1024,
                 });
@@ -316,6 +324,18 @@ jobs:
           const latestTag = versionedTags[0] ?? '';
           const prefix = latestTag.replace(/v?\d+\.\d+\.\d+.*$/, '') || 'v';
 
+          // Include drafts and every page before deciding an object is absent.
+          const releasePages = JSON.parse(gh([
+            'api', `repos/${repo}/releases`, '-X', 'GET', '-f', 'per_page=100',
+            '--paginate', '--slurp',
+          ]));
+          if (!Array.isArray(releasePages) || releasePages.some((page) =>
+            !Array.isArray(page) || page.some((release) =>
+              !release || typeof release.tag_name !== 'string' || !release.tag_name))) {
+            throw new Error('Invalid existing release listing; refusing release creation');
+          }
+          const existingReleaseTags = new Set(releasePages.flat().map((release) => release.tag_name));
+
           let ensured = 0;
           let failures = 0;
           let lastTag = '';
@@ -324,12 +344,7 @@ jobs:
             const version = /^chore\(main\): release (\S+)/.exec(pull.title)?.[1];
             if (!version) continue;
             const tag = `${prefix}v${version}`;
-            // Draft releases are invisible to get-release-by-tag, so scan
-            // the list endpoint (which returns drafts) for the tag.
-            const releasesForCheck = JSON.parse(gh([
-              'api', `repos/${repo}/releases`, '-X', 'GET', '-f', 'per_page=100',
-            ]));
-            if (releasesForCheck.some((release) => release.tag_name === tag)) {
+            if (existingReleaseTags.has(tag)) {
               console.log(`${tag}: release object already exists`);
             } else {
               // No release object for this tag: create it. The tag may also
@@ -354,6 +369,7 @@ jobs:
                   prerelease: version.includes('-'),
                 });
                 gh(['api', `repos/${repo}/releases`, '-X', 'POST', '--input', '-'], { input: body });
+                existingReleaseTags.add(tag);
                 console.log(`${tag}: release object created`);
               } catch (error) {
                 failures += 1;
@@ -834,24 +850,30 @@ jobs:
       contents: read
       id-token: write
     env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      NPM_PUBLISH_AUTH: ${{ inputs['npm-publish-auth'] }}
+      HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }}
+      HAS_NPM_READ_TOKEN: ${{ secrets.NPM_READ_TOKEN != '' }}
     steps:
       - name: Checkout release
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
           ref: ${{ needs.release.outputs.tag_name }}
-      - name: Setup Node (trusted)
-        if: env.NPM_TOKEN == ''
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-      - name: Setup Node (token)
-        if: env.NPM_TOKEN != ''
+      - name: Validate npm publication authentication
+        run: |
+          set -euo pipefail
+          case "$NPM_PUBLISH_AUTH" in
+            auto|oidc|token) ;;
+            *) echo "Unsupported npm-publish-auth: $NPM_PUBLISH_AUTH" >&2; exit 1 ;;
+          esac
+          if [ "$NPM_PUBLISH_AUTH" = token ] && [ "$HAS_NPM_TOKEN" != true ]; then
+            echo 'npm-publish-auth token requires the NPM_TOKEN secret.' >&2
+            exit 1
+          fi
+      - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org
       - name: Setup Bun (lockfile managers)
         # The install step below dispatches on lockfile: bun, pnpm, yarn, or
         # npm. Stock runners only provide Node, so provision Bun (oven-sh)
@@ -865,8 +887,18 @@ jobs:
       - name: Install dependencies
         # npm publish runs prepublishOnly (usually a build), which needs
         # devDependencies present. Install with the project's own manager.
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_READ_TOKEN || (inputs['npm-publish-auth'] != 'oidc' && secrets.NPM_TOKEN) || '' }}
         run: |
           set -euo pipefail
+          npmrc=''
+          if [ -n "${NODE_AUTH_TOKEN:-}" ]; then
+            npmrc="$(mktemp)"
+            chmod 600 "$npmrc"
+            printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > "$npmrc"
+            export NPM_CONFIG_USERCONFIG="$npmrc"
+          fi
+          trap '[ -z "$npmrc" ] || rm -f "$npmrc"' EXIT
           if [ -f bun.lock ] || [ -f bun.lockb ]; then bun install --frozen-lockfile
           elif [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile
           elif [ -f yarn.lock ]; then yarn install --immutable
@@ -874,10 +906,16 @@ jobs:
           elif [ -f package.json ]; then npm install --no-audit --fund=false --package-lock=false
           fi
       - name: Publish npm with token
-        if: env.NPM_TOKEN != ''
+        if: inputs['npm-publish-auth'] == 'token' || (inputs['npm-publish-auth'] == 'auto' && env.HAS_NPM_TOKEN == 'true')
         env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
-        run: npm publish --provenance --access public
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          npmrc="$(mktemp)"
+          chmod 600 "$npmrc"
+          printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > "$npmrc"
+          trap 'rm -f "$npmrc"' EXIT
+          NPM_CONFIG_USERCONFIG="$npmrc" npm publish --provenance --access public
       - name: Publish npm with trusted publishing
-        if: env.NPM_TOKEN == ''
+        if: inputs['npm-publish-auth'] == 'oidc' || (inputs['npm-publish-auth'] == 'auto' && env.HAS_NPM_TOKEN != 'true')
         run: npm publish --provenance --access public

package/.github/workflows/release_self-ci.yml

@@ -256,5 +256,3 @@ jobs:
       tag: ${{ needs.release.outputs.tag_name || needs.recovery.outputs.tag }}
       asset: ${{ needs.qualification.outputs.filename }}
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/security.yml

@@ -140,7 +140,9 @@ jobs:
   dependency-audit:
     name: Dependency Audit (${{ matrix.entry.display }})
     needs: profile
-    if: vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success'
+    # Avoid expanding an empty matrix; skip only the explicitly empty result.
+    # Missing or malformed output still fails closed during matrix expansion.
+    if: vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success' && needs.profile.outputs.audit_matrix != '[]'
     strategy:
       fail-fast: false
       max-parallel: 8