code-foundry 1.50.0 → 1.50.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.50.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.50.0...v1.50.1) (2026-10-29)
+
+
+### Bug Fixes
+
+* **sync:** replace complete consumer runtime ref ([#793](https://github.com/0xPlayerOne/code-foundry/issues/793)) ([6a0b5ef](https://github.com/0xPlayerOne/code-foundry/commit/6a0b5ef4f9a02c781745fa64f2f9748ea679f2d5))
+
 ## [1.50.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.3...v1.50.0) (2026-10-29)
 
 
@@ -133,16 +140,9 @@
 
 * **qualification:** exclude pending parallel syntax by content, not filename ([#755](https://github.com/0xPlayerOne/code-foundry/issues/755)) ([1f7cae8](https://github.com/0xPlayerOne/code-foundry/commit/1f7cae8167002061850e56e3dc0fa800a69d7be9))
 
-## [1.47.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.0...v1.47.1) (2026-10-08)
-
-
-### Tests
-
-* **doctor:** pin the machine-hook shadow warning ([#753](https://github.com/0xPlayerOne/code-foundry/issues/753)) ([f634269](https://github.com/0xPlayerOne/code-foundry/commit/f634269424580d8d34323319288747587b6d6ae3))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 262 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 263 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.50.0",
+  "version": "1.50.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1094,6 +1094,26 @@ export function renderDevChannel(config) {
   )
 }
 
+/**
+ * Pin consumer runtime refs without retaining the self-CI expression used by
+ * the Code Foundry repository. Self callers keep their event-relative refs.
+ *
+ * @param {string} content
+ * @param {string} ref
+ * @param {boolean} selfRepository
+ */
+export function pinRuntimeRefs(content, ref, selfRepository) {
+  if (selfRepository) return content
+  const foldedRuntimeRef =
+    /^([ \t]*runtime-ref:)[ \t]*>-[ \t]*\r?\n(?:[ \t]+\$\{\{[^\r\n]*\}\}[ \t]*(?:\r?\n|$))+/gm
+  return content
+    .replace(
+      foldedRuntimeRef,
+      (match, key) => `${key} ${ref}${match.endsWith('\r\n') ? '\r\n' : '\n'}`
+    )
+    .replace(/^([ \t]*runtime-ref:)[ \t]+.*$/gm, (_, key) => `${key} ${ref}`)
+}
+
 /**
  * @param {string} content
  * @param {Record<string,string>} config
@@ -1149,11 +1169,12 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
     new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'),
     `$&@${ref}`
   )
-  // Pin every runtime reference in the rendered caller: the orchestrator input
-  // in the `with:` block and the mode job's runtime checkout. Self templates
-  // use ${{ github.sha }} and are only rewritten when rendered for consumers.
-  rendered = rendered.replace(/^(\s+runtime-ref:)\s+.*$/gm, `$1 ${ref}`)
-  rendered = rendered.replace(/^(\s+ref:)\s+\$\{\{\s*github\.sha\s*\}\}\s*$/gm, `$1 ${ref}`)
+  // Replace complete folded self-CI runtime expressions when rendering a
+  // consumer. The source repository keeps its event-relative runtime refs.
+  rendered = pinRuntimeRefs(rendered, ref, selfRepository)
+  if (!selfRepository) {
+    rendered = rendered.replace(/^(\s+ref:)\s+\$\{\{\s*github\.sha\s*\}\}\s*$/gm, `$1 ${ref}`)
+  }
   rendered = rendered.replace(/^(\s+runtime-repository:)\s+.*$/gm, `$1 ${repository}`)
   rendered = rendered.replace(
     new RegExp(`^(\\s+repository:)\\s+0xPlayerOne\\/code-foundry\\s*$`, 'gm'),