code-foundry 1.48.8 → 1.50.1

package/src/commands/sync.mjs

@@ -164,6 +164,16 @@ function synchronize(options) {
   if (!['true', 'false'].includes(draftProtection)) {
     throw new Error(`Unsupported draft_protection: ${draftProtection}; use true or false.`)
   }
+  const qualificationReceipts = configured(config.release_qualification_receipts, 'false')
+  if (!['true', 'false'].includes(qualificationReceipts)) {
+    throw new Error(
+      `Unsupported release_qualification_receipts: ${qualificationReceipts}; use true or false.`
+    )
+  }
+  const npmPublishAuth = configured(config.npm_publish_auth, 'auto')
+  if (!['auto', 'oidc', 'token'].includes(npmPublishAuth)) {
+    throw new Error(`Unsupported npm_publish_auth: ${npmPublishAuth}; use auto, oidc, or token.`)
+  }
   // Validate the dependency-update bot policy before any sync writes so a
   // typo fails fast instead of leaving a half-switched updater behind.
   const dependencyUpdater = configured(config.dependency_updater, 'dependabot')
@@ -1084,6 +1094,26 @@ export function renderDevChannel(config) {
   )
 }
 
+/**
+ * Pin consumer runtime refs without retaining the self-CI expression used by
+ * the Code Foundry repository. Self callers keep their event-relative refs.
+ *
+ * @param {string} content
+ * @param {string} ref
+ * @param {boolean} selfRepository
+ */
+export function pinRuntimeRefs(content, ref, selfRepository) {
+  if (selfRepository) return content
+  const foldedRuntimeRef =
+    /^([ \t]*runtime-ref:)[ \t]*>-[ \t]*\r?\n(?:[ \t]+\$\{\{[^\r\n]*\}\}[ \t]*(?:\r?\n|$))+/gm
+  return content
+    .replace(
+      foldedRuntimeRef,
+      (match, key) => `${key} ${ref}${match.endsWith('\r\n') ? '\r\n' : '\n'}`
+    )
+    .replace(/^([ \t]*runtime-ref:)[ \t]+.*$/gm, (_, key) => `${key} ${ref}`)
+}
+
 /**
  * @param {string} content
  * @param {Record<string,string>} config
@@ -1094,6 +1124,7 @@ export function renderDevChannel(config) {
  * @param {boolean} selfRepository
  */
 function renderWorkflow(content, config, repository, ref, rustCodeql, file, selfRepository) {
+  const npmPublishAuth = configured(config.npm_publish_auth, 'auto')
   const localPrefix = 'uses: ./.github/workflows/'
   const remotePrefix = `uses: ${repository}/.github/workflows/`
   let rendered = content.replaceAll(localPrefix, remotePrefix)
@@ -1138,11 +1169,12 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
     new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'),
     `$&@${ref}`
   )
-  // Pin every runtime reference in the rendered caller: the orchestrator input
-  // in the `with:` block and the mode job's runtime checkout. Self templates
-  // use ${{ github.sha }} and are only rewritten when rendered for consumers.
-  rendered = rendered.replace(/^(\s+runtime-ref:)\s+.*$/gm, `$1 ${ref}`)
-  rendered = rendered.replace(/^(\s+ref:)\s+\$\{\{\s*github\.sha\s*\}\}\s*$/gm, `$1 ${ref}`)
+  // Replace complete folded self-CI runtime expressions when rendering a
+  // consumer. The source repository keeps its event-relative runtime refs.
+  rendered = pinRuntimeRefs(rendered, ref, selfRepository)
+  if (!selfRepository) {
+    rendered = rendered.replace(/^(\s+ref:)\s+\$\{\{\s*github\.sha\s*\}\}\s*$/gm, `$1 ${ref}`)
+  }
   rendered = rendered.replace(/^(\s+runtime-repository:)\s+.*$/gm, `$1 ${repository}`)
   rendered = rendered.replace(
     new RegExp(`^(\\s+repository:)\\s+0xPlayerOne\\/code-foundry\\s*$`, 'gm'),
@@ -1162,7 +1194,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
   if (workflow === 'release' && !selfRepository) {
     rendered = rendered.replace(
       /^(\s+runtime-ref:)\s+.*$/m,
-      `$1 ${ref}\n      git-workflow: ${isStagingRelease(config.git_workflow) ? 'staging-release' : 'direct'}`
+      `$1 ${ref}\n      git-workflow: ${isStagingRelease(config.git_workflow) ? 'staging-release' : 'direct'}\n      npm-publish-auth: ${npmPublishAuth}`
     )
   }
   // Generated PR callers protect drafts by default. Consumers that intentionally
@@ -1170,6 +1202,22 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
   if (configured(config.draft_protection, 'true') === 'false') {
     rendered = rendered.replaceAll(' && github.event.pull_request.draft == false', '')
   }
+  const integrationShards =
+    config.integration_shards === undefined || config.integration_shards === ''
+      ? 1
+      : Number(config.integration_shards)
+  if (!Number.isInteger(integrationShards) || integrationShards < 1 || integrationShards > 2) {
+    throw new Error(`Unsupported integration_shards: ${config.integration_shards}; use 1 or 2.`)
+  }
+  if (integrationShards > 1 && configured(config.billing_lanes, 'false') === 'true') {
+    throw new Error('integration_shards cannot be combined with billing_lanes.')
+  }
+  if (integrationShards > 1 && file === '.github/workflows/validation.yml') {
+    rendered = rendered.replace(
+      /^(\s+integration-total-shards:)\s+.*$/gm,
+      `$1 ${integrationShards}`
+    )
+  }
   // E2E sharding fans the managed E2E job into one runner per shard; shards
   // stay isolated because each job owns a runner-local test database. Fail
   // closed on a malformed count rather than silently rendering a single shard.
@@ -1225,9 +1273,13 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
         )
       }
     }
+    const npmSecrets =
+      configured(config.npm_publish, 'false') !== 'true'
+        ? ''
+        : `${npmPublishAuth === 'oidc' ? '' : '      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}\n'}      NPM_READ_TOKEN: \${{ secrets.NPM_READ_TOKEN }}\n`
     rendered = rendered.replace(
       /(\n    secrets:\n      CODE_FOUNDRY_TOKEN: \$\{\{ secrets\.CODE_FOUNDRY_TOKEN \}\}\n)/,
-      '$1      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}\n'
+      `$1${npmSecrets}`
     )
   }
   // The staging-release topology validates and scans pull requests against
@@ -1286,6 +1338,19 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       if (!value) continue
       rendered = rendered.replace(new RegExp(`^(\\s+${input}:)\\s+.*$`, 'm'), `$1 ${value}`)
     }
+    if (
+      workflow === 'validation' &&
+      configured(config.release_qualification_receipts, 'false') === 'true'
+    ) {
+      const qualified = rendered.replace(
+        /^(\s+mode:)\s+(\$\{\{\s*needs\.mode\.outputs\.mode\s*\}\})\s*$/m,
+        '$1 $2\n      release-qualification-receipts: true'
+      )
+      if (qualified === rendered) {
+        throw new Error('Validation caller cannot render release-qualification-receipts opt-in.')
+      }
+      rendered = qualified
+    }
     // Every Rust CodeQL lane in the caller must carry the configured shard
     // list. A SARIF category is derived from the shard string, so a caller that
     // renders the configuration into the pull-request lane while a second lane
@@ -1525,8 +1590,8 @@ const DIRECT_DOC_REPLACEMENTS = {
       '7. Push to the fork and open a pull request targeting `main`.',
     ],
     [
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |\n',
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |\n',
+      '| Event                                              | Expected automation                                                                                                                       |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                                                                        |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                                                     |\n| Exact Release Please PR targeting `main`           | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests                                      |\n| Scheduled or manual validation                     | Full audit tier                                                                                                                           |\n| Push to a working branch                           | Draft PR workflow                                                                                                                         |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                                                                        |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)                                                                    |\n',
+      '| Event                                    | Expected automation                                                                                  |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`      | No runner-heavy validation; run local checks before requesting review                                |\n| Ready pull request targeting `main`      | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation           | Full audit tier                                                                                      |\n| Push to a working branch                 | Draft PR workflow                                                                                    |\n| Push to `main`                           | Release workflow; CodeQL skips release-only merges (audit covers drift)                              |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
@@ -2149,6 +2214,7 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     languages,
     features: 'all',
     codeql: 'auto',
+    release_qualification_receipts: 'false',
     dependency_review: 'auto',
     package_manager: packageManager,
     codeql_rust_shards: '["all"]',
@@ -2176,6 +2242,7 @@ function createDefaultConfig(root, source, configuredWorkflow) {
     monorepo_tool: 'auto',
     release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node',
     npm_publish: 'false',
+    npm_publish_auth: 'auto',
     post_release: 'false',
     post_release_workflow: '',
     post_release_mode: 'auto',

package/src/lib/github-doctor.mjs

@@ -144,6 +144,7 @@ export function doctorGithub(root) {
     : undefined
   const credentialChecks = {
     npmTokenPresent: secretNames.includes('NPM_TOKEN'),
+    npmReadTokenPresent: secretNames.includes('NPM_READ_TOKEN'),
     turboTokenPresent: secretNames.includes('TURBO_TOKEN'),
     turboTeamPresent: Boolean(
       repositoryVariables.some(
@@ -153,10 +154,30 @@ export function doctorGithub(root) {
     opencodeApiKeyPresent: secretNames.includes('OPENCODE_API_KEY'),
   }
   details.credentials = credentialChecks
-  if (config.npm_publish === 'true' && !credentialChecks.npmTokenPresent)
+  const npmPublishAuth = config.npm_publish_auth ?? 'auto'
+  details.credentials.npmPublishAuth = npmPublishAuth
+  if (!['auto', 'oidc', 'token'].includes(npmPublishAuth)) {
+    errors.push('npm_publish_auth must be auto, oidc, or token.')
+  } else if (config.npm_publish === 'true' && npmPublishAuth === 'token') {
+    if (!credentialChecks.npmTokenPresent)
+      errors.push('npm_publish_auth is token but NPM_TOKEN is not configured.')
+  } else if (
+    config.npm_publish === 'true' &&
+    npmPublishAuth === 'auto' &&
+    !credentialChecks.npmTokenPresent
+  ) {
     warnings.push(
-      'npm_publish is enabled but NPM_TOKEN is not configured; npm trusted publishing must be configured for tokenless publication.'
+      'npm_publish_auth is auto and NPM_TOKEN is absent; publication uses OIDC, so npm trust must match this repository and the generated release.yml caller.'
     )
+  } else if (
+    config.npm_publish === 'true' &&
+    npmPublishAuth === 'oidc' &&
+    credentialChecks.npmTokenPresent
+  ) {
+    warnings.push(
+      'npm_publish_auth is oidc; NPM_TOKEN is not used for publishing or install. Use NPM_READ_TOKEN only when private dependencies require read access.'
+    )
+  }
   if (
     ['true', 'auto'].includes(config.turbo_remote ?? 'false') &&
     (!credentialChecks.turboTokenPresent || !credentialChecks.turboTeamPresent)

package/src/lib/node-package-performance.mjs

@@ -21,7 +21,7 @@ const METRICS = new Set([
  * npm 12 keys pack reports by package name; older npm versions return an array.
  * Count reports before validating their shape so an extra malformed entry cannot be ignored.
  * @param {unknown} value
- * @returns {{filename: string, size: number, unpackedSize: number, files: Array<{path: string}>}}
+ * @returns {{filename: string, size: number, unpackedSize: number, files: Array<{path: string}>, name?: string, version?: string}}
  */
 export function singleNpmPackReport(value) {
   let reports
@@ -53,6 +53,26 @@ export function singleNpmPackReport(value) {
   return packed
 }
 
+/**
+ * Verify the single npm pack report used to inspect a versioned root package.
+ * Supports both npm's legacy array and npm 12's package-name keyed object.
+ * @param {unknown} value
+ * @param {{name?:unknown,version?:unknown}} manifest
+ */
+export function verifyNpmPackPackage(value, manifest) {
+  const packed = singleNpmPackReport(value)
+  if (
+    typeof manifest?.name !== 'string' ||
+    typeof manifest.version !== 'string' ||
+    packed.name !== manifest.name ||
+    packed.version !== manifest.version ||
+    !packed.files.some((file) => file.path === 'package.json')
+  ) {
+    throw new Error('npm pack result does not match the root package manifest.')
+  }
+  return packed
+}
+
 /** @param {number[]} values @param {number} percent */
 export function percentile(values, percent) {
   if (values.length === 0) throw new Error('percentile requires at least one value')

package/src/lib/validation-policy.mjs

@@ -82,13 +82,9 @@ export function classifyValidationMode(input) {
 const REQUIRED_JOBS_BY_MODE = {
   fast: ['ci', 'test'],
   audit: ['ci', 'test', 'security', 'codeql', 'eval'],
-  // Release Please pull requests change version metadata only, and the gate
-  // validates that diff against the release policy before anything publishes.
-  // The content tree was already fully audited by the pull requests that
-  // merged into main, and the scheduled audit lane re-covers drift. The
-  // release tier therefore requires the fast suite plus CodeQL, whose
-  // per-pull-request code scanning results some repository rulesets require
-  // to keep the release from deadlocking.
+  // Release Please uses the full CI and unit-test fallback unless the
+  // orchestrator has verified an exact short-lived source receipt. CodeQL
+  // remains required because some rulesets require a PR analysis to merge.
   release: ['ci', 'test', 'codeql'],
 }
 
@@ -96,9 +92,13 @@ const REQUIRED_JOBS_BY_MODE = {
  * Job ids that the aggregate gate requires for a mode. Expected skips never
  * appear here: anything outside the returned list is not part of the gate.
  * @param {string} mode
+ * @param {{sourceQualification?:boolean}} [options]
  * @returns {string[]}
  */
-export function requiredValidationJobs(mode) {
+export function requiredValidationJobs(mode, options = {}) {
+  if (mode === 'release' && options.sourceQualification === true) {
+    return ['ci', 'codeql', 'qualification']
+  }
   const jobs = REQUIRED_JOBS_BY_MODE[/** @type {'fast'|'audit'|'release'} */ (mode)]
   if (!jobs) {
     throw new Error(
@@ -114,14 +114,14 @@ export function requiredValidationJobs(mode) {
  * non-required jobs never fail the gate. Every required job must report
  * exactly `success`; failure, cancellation, an unexpected skip, a missing
  * result, or an unknown result fails the gate (fail closed).
- * @param {{ mode: string, results?: Record<string, string | null | undefined> }} input
+ * @param {{ mode: string, results?: Record<string, string | null | undefined>, sourceQualification?:boolean }} input
  * @returns {{ valid: boolean, required: string[], failures: Array<{ job: string, result: string }> }}
  */
 export function evaluateValidationGate(input) {
-  const { mode, results = {} } = input
+  const { mode, results = {}, sourceQualification = false } = input
   let required
   try {
-    required = requiredValidationJobs(mode)
+    required = requiredValidationJobs(mode, { sourceQualification })
   } catch (error) {
     return {
       valid: false,

package/src/runtime-core.mjs

@@ -380,7 +380,9 @@ function validation(task) {
         security: process.env.FOUNDRY_SECURITY,
         codeql: process.env.FOUNDRY_CODEQL,
         eval: process.env.FOUNDRY_EVAL,
+        qualification: process.env.FOUNDRY_QUALIFICATION,
       },
+      sourceQualification: process.env.FOUNDRY_SOURCE_QUALIFICATION === 'true',
     })
     if (gate.valid) {
       console.log(`Validation gate passed for ${mode} mode.`)