code-foundry 1.5.4 → 1.6.1

package/.github/CONTRIBUTING.md

@@ -19,7 +19,7 @@ Agents must follow these rules before changing code:
 3. Preserve user-owned changes. Never discard or overwrite unrelated work.
 4. Branch from `staging` and target pull requests at `staging`; do not work directly on `main`.
 5. Keep the change focused. Do not expand scope without documenting why.
-6. Run the applicable format, lint, type-check, build, unit, integration, E2E, smoke, and security checks.
+6. Run the applicable format, lint, type-check, build, unit, performance, integration, E2E, smoke, and security checks.
 7. Report exact validation results, skipped checks, known limitations, and remaining risks.
 8. Never commit secrets, credentials, local environment files, generated artifacts, or machine-specific paths.
 
@@ -163,7 +163,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |
 | Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |
 
-The single validation caller keys concurrency by event and pull-request head. A newer update to the same pull request cancels its superseded validation run; scheduled and manual audits remain independent. The mode-aware orchestrator fans out only the jobs required by that event and always concludes with the stable aggregate gate.
+Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Both callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 

package/.github/actions/setup/action.yml

@@ -129,6 +129,7 @@ runs:
           integration: ['test:integration'],
           e2e: ['test:e2e', 'e2e'],
           smoke: ['test:smoke', 'smoke'],
+          performance: ['performance:check', 'perf:check'],
         }[task] || [];
         const selected = candidates.find((name) => scripts[name]);
         const usesTurbo = Boolean(selected && /\bturbo(?:\s|$)/.test(scripts[selected]));
@@ -441,7 +442,7 @@ runs:
     - name: Install native test libraries
       if: >-
         inputs.install == 'true' &&
-        inputs.task == 'unit' &&
+        (inputs.task == 'unit' || inputs.task == 'performance') &&
         hashFiles('**/package.json') != '' &&
         steps.profile.outputs.javascript == 'true'
       shell: bash

package/.github/code-foundry.yml

@@ -20,6 +20,7 @@ merge_strategy: rebase
 release_merge_strategy: rebase
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
+performance_runner: ubuntu-latest
 cache_packages: auto
 cache_build: auto
 coverage_minimum: 80
@@ -38,4 +39,6 @@ opencode_security: false
 sync_mode: overlay
 custom_workflows: preserve
 staging_validation_mode: fast
+performance: auto
+performance_command:
 opencode_security_model:

package/.github/workflows/test.yml

@@ -23,6 +23,11 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+      performance-runner:
+        description: Runner used by deterministic performance regression checks.
+        required: false
+        type: string
+        default: ubuntu-latest
       unit-only:
         description: Run only the unit-test subset; skip integration, E2E, and smoke jobs.
         required: false
@@ -117,6 +122,71 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+  performance:
+    name: Performance
+    if: vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ${{ inputs.performance-runner }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+      - name: Runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            .github/actions
+            src/lib
+            src/runtime.mjs
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions
+          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Detect
+        id: applicability
+        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile performance >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
+          install-python: ${{ steps.applicability.outputs.python == 'true' }}
+          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-build: false
+          cache-environment: false
+          cache-save: false
+          cache-packages: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+          task: performance
+          task-javascript: ${{ steps.applicability.outputs.javascript }}
+          task-python: ${{ steps.applicability.outputs.python }}
+          task-rust: ${{ steps.applicability.outputs.rust }}
+      - name: Performance
+        if: steps.applicability.outputs.applicable == 'true'
+        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci performance
+      - name: Upload performance results
+        if: >-
+          always() &&
+          steps.applicability.outputs.applicable == 'true' &&
+          hashFiles('artifacts/performance/**', 'performance-results.json', 'performance-results/**') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: performance-${{ github.run_id }}
+          path: |
+            artifacts/performance/**
+            performance-results.json
+            performance-results/**
+          compression-level: 1
+          if-no-files-found: ignore
+          retention-days: 14
+
   integration:
     name: Integration
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true

package/.github/workflows/validation.yml

@@ -32,6 +32,11 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+      performance-runner:
+        description: Runner used by deterministic performance regression checks.
+        required: false
+        type: string
+        default: ubuntu-latest
       security-runner:
         description: Runner used by Security jobs.
         required: false
@@ -94,6 +99,7 @@ jobs:
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.test-runner }}
       unit-runner: ${{ inputs.unit-runner }}
+      performance-runner: ${{ inputs.performance-runner }}
       unit-only: ${{ inputs.mode == 'fast' }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}

package/.github/workflows/validation_audit_self-ci.yml

@@ -0,0 +1,43 @@
+name: Code Foundry Audit
+
+on:
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: code-foundry-audit-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  # Default-branch-capable events must not call the local reusable workflow:
+  # a pull request could otherwise change that workflow and feed an untrusted
+  # runtime ref into steps that can populate the protected branch cache. Use
+  # the protected default branch for both workflow code and runtime code.
+  validation:
+    name: Validation
+    if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: 0xPlayerOne/code-foundry/.github/workflows/validation.yml@main
+    with:
+      mode: audit
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: main
+      ci-runner: ubuntu-latest
+      test-runner: ubuntu-latest
+      unit-runner: ubuntu-slim
+      performance-runner: ubuntu-latest
+      security-runner: ubuntu-slim
+      codeql-runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}

package/.github/workflows/validation_self-ci.yml

@@ -8,16 +8,12 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  schedule:
-    - cron: '31 6 * * 1'
-  workflow_dispatch:
 
 # Default every caller job to no repository permissions. Individual jobs grant
 # only the scopes their own validation path consumes.
 permissions: {}
 
-# Superseded PR updates cancel the previous run; schedule and dispatch runs
-# are keyed by event so periodic audits and manual runs stay independent.
+# Superseded PR updates cancel the previous run.
 concurrency:
   group: code-foundry-validation-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
@@ -77,12 +73,13 @@ jobs:
       mode: ${{ needs.mode.outputs.mode }}
       runtime-repository: 0xPlayerOne/code-foundry
       # Pull requests validate the proposed runtime commit. Scheduled and
-      # manually dispatched audits stay on the protected default branch so a
-      # selected branch cannot supply privileged runtime code.
-      runtime-ref: ${{ github.event_name == 'pull_request' && github.sha || 'main' }}
+      # manually dispatched audits are isolated in validation_audit_self-ci.yml
+      # so this caller-selected ref never runs with default-branch cache access.
+      runtime-ref: ${{ github.sha }}
       ci-runner: ubuntu-latest
       test-runner: ubuntu-latest
       unit-runner: ubuntu-slim
+      performance-runner: ubuntu-latest
       security-runner: ubuntu-slim
       codeql-runner: ubuntu-latest
       rust-shards: '["all"]'

package/AGENTS.md

@@ -120,6 +120,7 @@ node src/runtime.mjs ci unit
 node src/runtime.mjs ci integration
 node src/runtime.mjs ci e2e
 node src/runtime.mjs ci smoke
+node src/runtime.mjs ci performance
 Security and dependency audits run through the GitHub Security workflow.
 ```
 
@@ -138,7 +139,7 @@ If a check cannot run, state the exact reason. A skipped check is not a passing
 ## Tests and coverage
 
 - Add or update tests for behavior changes and regressions.
-- Keep unit, integration, E2E, and smoke coverage in the suite where each applies.
+- Keep unit, performance, integration, E2E, and smoke coverage in the suite where each applies.
 - Preserve project-specific coverage thresholds; do not lower them to make CI green.
 - Keep test data deterministic and remove secrets from logs and fixtures.
 - Use the narrowest test command while iterating, then run the affected package or workspace suite.

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.6.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.6.0...v1.6.1) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** isolate default-branch security audits ([5ea0914](https://github.com/0xPlayerOne/code-foundry/commit/5ea09146af9995f16d1ab4e9a73f14a13582da36))
+
+## [1.6.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.5.4...v1.6.0) (2026-09-08)
+
+
+### Features
+
+* **ci:** add shared performance validation ([#492](https://github.com/0xPlayerOne/code-foundry/issues/492)) ([ef12990](https://github.com/0xPlayerOne/code-foundry/commit/ef1299045b6d67e447def93e2096862cde64bbc7))
+
 ## [1.5.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.5.3...v1.5.4) (2026-09-08)
 
 

package/docs/CONFIGURATION.md

@@ -36,6 +36,8 @@ repository manifests and source
 | `package_manager`          | `bun`, `pnpm`, `yarn`, `npm`, `none`                                             | JavaScript setup                                                                                                    |
 | `toolchain`                | `auto`, `native`, `mise`                                                         | Environment setup policy; defaults to `auto`                                                                        |
 | `staging_validation_mode`  | `fast`, `audit`                                                                  | Validation tier for pull requests targeting `staging`; defaults to `fast`                                           |
+| `performance`              | `auto`, `true`, `false`                                                          | Run a deterministic performance task when a supported entrypoint exists; defaults to `auto`                         |
+| `performance_command`      | JSON string array                                                                | Command argv for non-package performance harnesses; package scripts take precedence                                 |
 | `features`                 | `all` or a list                                                                  | Standard workflow callers                                                                                           |
 | `codeql`                   | `auto`, `true`, `false`                                                          | CodeQL policy; public repositories default to enabled, non-public repositories default to disabled                  |
 | `codeql_rust_shards`       | JSON array of paths                                                              | Rust scan scopes; `["all"]` keeps the safe single full scan                                                         |
@@ -51,11 +53,30 @@ repository manifests and source
 | `git_workflow`             | `direct` (default), `staging-release`                                            | Branch/release model; `direct` opens feature branches into `main`, `staging-release` promotes `staging` into `main` |
 | `merge_strategy`           | `rebase`                                                                         | Promotion merge method for `staging` → `main`; only enforced by the `staging-release` topology                      |
 | `release_merge_strategy`   | `rebase`, `squash` (direct topology only)                                        | Merge method for Release Please version PRs into `main`; release automation fails closed on anything else           |
-| `runner` fields            | GitHub runner names                                                              | Per-workflow runner policy                                                                                          |
+| `runner` fields            | GitHub runner names                                                              | Per-workflow runner policy, including `performance_runner`                                                          |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,
 `release-pr`, `release`, and `dependabot`.
 
+## Performance validation
+
+The shared Test workflow exposes a deterministic `Performance` job. In JavaScript
+repositories it discovers `performance:check` first and `perf:check` second. Other
+repositories can declare an argv array without shell interpolation:
+
+```yaml
+performance: true
+performance_command: '["python3","scripts/performance_audit.py","--check"]'
+performance_runner: ubuntu-latest
+```
+
+`performance: false` disables discovery. Performance budgets, fixtures, mock
+providers, and live endpoint credentials remain repository-owned. The shared job
+owns checkout, pinned setup, billing controls, concurrency, and artifact upload;
+it uploads `artifacts/performance/**`, `performance-results.json`, or
+`performance-results/**` when present. Network-dependent and post-deployment
+checks should remain separate from this deterministic validation task.
+
 ## OpenCode Security opt-in and opt-out
 
 `opencode_security` controls the optional OpenCode scan, and the generated

package/docs/WORKFLOWS.md

@@ -79,7 +79,7 @@ repositories can opt in or out without a code change.
 | Workflow   | Responsibility                                                |
 | ---------- | ------------------------------------------------------------- |
 | CI         | Format, lint, type-check, and build                           |
-| Test       | Unit, integration, E2E, and smoke tests                       |
+| Test       | Unit, performance, integration, E2E, and smoke tests          |
 | Security   | Profile, audits, and public-only Dependency Review            |
 | CodeQL     | GitHub-native code scanning, kept separate from CI            |
 | Draft PR   | Create/update development pull requests                       |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.5.4",
+  "version": "1.6.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -549,6 +549,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
       'security-runner': config.security_runner ?? config.runner,
       'codeql-runner': config.codeql_runner ?? config.runner,
       'unit-runner': config.unit_runner,
+      'performance-runner': config.performance_runner ?? config.test_runner ?? config.runner,
     }
     for (const [input, value] of Object.entries(runnerInputs)) {
       if (!value) continue
@@ -1088,6 +1089,8 @@ function createDefaultConfig(root, source) {
     ...runners,
     toolchain: 'auto',
     staging_validation_mode: 'fast',
+    performance: 'auto',
+    performance_command: '',
     prune_standard: 'false',
     cache_packages: 'auto',
     cache_build: 'auto',

package/src/lib/profile.mjs

@@ -129,6 +129,7 @@ export function recommendRunners(root) {
     ci_runner: heavy ? 'ubuntu-latest' : 'ubuntu-slim',
     test_runner: heavy ? 'ubuntu-latest' : 'ubuntu-slim',
     unit_runner: heavy ? 'ubuntu-latest' : 'ubuntu-slim',
+    performance_runner: 'ubuntu-latest',
     security_runner: 'ubuntu-slim',
     codeql_runner: 'ubuntu-latest',
     pr_runner: 'ubuntu-slim',

package/src/runtime.mjs

@@ -52,6 +52,29 @@ function readPackage() {
   }
 }
 
+function performanceEnabled() {
+  return configured(config.performance, 'auto') !== 'false'
+}
+
+function performanceCommand() {
+  const raw = configured(config.performance_command, '').trim()
+  if (!raw) return null
+  let command
+  try {
+    command = JSON.parse(raw)
+  } catch {
+    throw new Error('performance_command must be a JSON array of command arguments.')
+  }
+  if (
+    !Array.isArray(command) ||
+    command.length === 0 ||
+    command.some((argument) => typeof argument !== 'string' || argument.length === 0)
+  ) {
+    throw new Error('performance_command must be a non-empty JSON array of non-empty strings.')
+  }
+  return command
+}
+
 /** @param {string} task */
 function validation(task) {
   if (task === 'mode') {
@@ -271,7 +294,14 @@ function relevant(task) {
     integration: ['test:integration'],
     e2e: ['test:e2e', 'e2e'],
     smoke: ['test:smoke', 'smoke'],
+    performance: ['performance:check', 'perf:check'],
   }[task]
+  if (task === 'performance') {
+    if (!performanceEnabled()) return false
+    return Boolean(
+      (scripted && scripted.some((candidate) => hasScript(candidate))) || performanceCommand()
+    )
+  }
   if (scripted && scripted.some((candidate) => hasScript(candidate)))
     return packageManager !== 'none'
   if (task === 'format' || task === 'lint' || task === 'type_check' || task === 'build') {
@@ -434,6 +464,13 @@ function ci(task) {
       run('cargo', ['build', '--all-targets'])
     return
   }
+  if (task === 'performance') {
+    if (!performanceEnabled()) return
+    if (runScript(['performance:check', 'perf:check'])) return
+    const command = performanceCommand()
+    if (command) run(command[0], command.slice(1))
+    return
+  }
   /** @type {Record<string, string[]>} */
   const scriptsByTask = {
     unit: ['test:unit', 'test:coverage', 'test'],