code-foundry 1.51.0 → 1.51.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/.github/CONTRIBUTING.md +1 -1
  2. package/.github/workflows/validation_self-ci.yml +3 -6
  3. package/CHANGELOG.md +8 -8
  4. package/package.json +1 -1
  5. package/src/commands/sync.mjs +2 -2
package/.github/CONTRIBUTING.md CHANGED
@@ -227,7 +227,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
227
227
  | Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |
228
228
  | Scheduled or manual validation | Full audit tier |
229
229
  | Push to a working branch | Draft PR workflow |
230
- | Push to `main` | Release workflow; CodeQL skips release-only merges (audit covers drift) |
230
+ | Push to `main` | Release workflow; CodeQL scans every push to main, all commits included |
231
231
 
232
232
  Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
233
233
 
package/.github/workflows/validation_self-ci.yml CHANGED
@@ -112,15 +112,12 @@ jobs:
112
112
 
113
113
  # CodeQL requires a push analysis to populate default-branch code-scanning
114
114
  # alerts. Keep the full validation gate pull-request-only so main pushes do
115
- # not duplicate CI, test, or security work. Release Please version merges
116
- # change manifests only, so the code tree is identical to the content merge
117
- # whose default-branch scan is still current; re-scanning it on every release
118
- # wastes the Rust-heavy analysis budget, and the scheduled audit covers drift.
115
+ # not duplicate CI, test, or security work. Run CodeQL for every main push:
116
+ # commit subjects do not prove that a push contains only release metadata.
119
117
  default-branch-codeql:
120
118
  name: CodeQL (default branch)
121
119
  if: >-
122
- vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push' &&
123
- !startsWith(github.event.head_commit.message, 'chore(main): release ')
120
+ vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push'
124
121
  permissions:
125
122
  actions: read
126
123
  contents: read
package/CHANGELOG.md CHANGED
@@ -1,5 +1,12 @@
1
1
  # Changelog
2
2
 
3
+ ## [1.51.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.51.0...v1.51.1) (2026-10-29)
4
+
5
+
6
+ ### Bug Fixes
7
+
8
+ * **ci:** run CodeQL on every main push ([#797](https://github.com/0xPlayerOne/code-foundry/issues/797)) ([d6d299d](https://github.com/0xPlayerOne/code-foundry/commit/d6d299dd5b073d6a5e13ffc2aa016d856208d2e4))
9
+
3
10
  ## [1.51.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.50.1...v1.51.0) (2026-10-29)
4
11
 
5
12
 
@@ -133,16 +140,9 @@
133
140
 
134
141
  * fix generated agent contribution and validation references ([#760](https://github.com/0xPlayerOne/code-foundry/issues/760)) ([c3564c9](https://github.com/0xPlayerOne/code-foundry/commit/c3564c92cb168449317afe2e40359144bf7a0c71))
135
142
 
136
- ## [1.47.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.2...v1.47.3) (2026-10-09)
137
-
138
-
139
- ### Maintenance
140
-
141
- * **fleet:** point the manifest at the rollout worktrees and filter adea's actionlint ([#757](https://github.com/0xPlayerOne/code-foundry/issues/757)) ([55bae8b](https://github.com/0xPlayerOne/code-foundry/commit/55bae8bf99a022bfa03294972d89a3cca20a6203))
142
-
143
143
  <!-- code-foundry: packaged changelog -->
144
144
 
145
145
  ---
146
146
 
147
- This packaged changelog lists the 20 most recent releases; 264 older releases are omitted to keep the package small.
147
+ This packaged changelog lists the 20 most recent releases; 265 older releases are omitted to keep the package small.
148
148
  See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "code-foundry",
3
- "version": "1.51.0",
3
+ "version": "1.51.1",
4
4
  "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
5
5
  "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
6
6
  "bugs": {
package/src/commands/sync.mjs CHANGED
@@ -1602,8 +1602,8 @@ const DIRECT_DOC_REPLACEMENTS = {
1602
1602
  '7. Push to the fork and open a pull request targeting `main`.',
1603
1603
  ],
1604
1604
  [
1605
- '| Event | Expected automation |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `staging` | Fast validation: CI plus unit tests, ending in `Validation / Gate` |\n| Draft ordinary pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready ordinary pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `staging` | Promotion PR workflow; canonical validation waits for the PR event |\n| Push to `main` | Release workflow; CodeQL skips release-only merges (audit covers drift) |\n',
1606
- '| Event | Expected automation |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `main` | Release workflow; CodeQL skips release-only merges (audit covers drift) |\n',
1605
+ '| Event | Expected automation |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `staging` | Fast validation: CI plus unit tests, ending in `Validation / Gate` |\n| Draft ordinary pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready ordinary pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `staging` | Promotion PR workflow; canonical validation waits for the PR event |\n| Push to `main` | Release workflow; CodeQL scans every push to main, all commits included |\n',
1606
+ '| Event | Expected automation |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `main` | Release workflow; CodeQL scans every push to main, all commits included |\n',
1607
1607
  ],
1608
1608
  [
1609
1609
  '| Change | Target | Merge method | Merge gate |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch | `staging` | Squash | All applicable required checks pass |\n| `staging` → `main` promotion | `main` | Rebase (`merge_strategy`) | Current staging checks, release review, and rollout notes |\n| Release Please version PR | `main` | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass |\n',