code-foundry 1.51.0 → 1.52.0

package/.github/CONTRIBUTING.md

@@ -227,7 +227,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |
 | Scheduled or manual validation           | Full audit tier                                                                                      |
 | Push to a working branch                 | Draft PR workflow                                                                                    |
-| Push to `main`                           | Release workflow; CodeQL skips release-only merges (audit covers drift)                              |
+| Push to `main`                           | Release workflow; CodeQL scans every push to main, all commits included                              |
 
 Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 

package/.github/workflows/cloudflare-deploy.yml

@@ -35,6 +35,11 @@ on:
         required: false
         type: string
         default: ''
+      build-env:
+        description: 'Optional JSON object of non-secret environment variables for the build command only.'
+        required: false
+        type: string
+        default: '{}'
       bun-version:
         required: false
         type: string
@@ -267,10 +272,44 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
+          BUILD_ENV_JSON: ${{ inputs.build-env }}
           TURBO_API: ${{ vars.TURBO_API }}
           TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
           TURBO_TEAM: ${{ vars.TURBO_TEAM }}
-        run: bun run "$BUILD_SCRIPT"
+        run: |
+          node --input-type=module <<'NODE'
+          import { spawnSync } from 'node:child_process'
+          const input = process.env.BUILD_ENV_JSON
+          let buildEnv
+          try {
+            buildEnv = JSON.parse(input)
+          } catch {
+            throw new Error('build-env must be a JSON object of string values')
+          }
+          if (!buildEnv || typeof buildEnv !== 'object' || Array.isArray(buildEnv)) {
+            throw new Error('build-env must be a JSON object of string values')
+          }
+          const allowedNames = new Set([
+            'ADEA_PREVIEW_HYPERDRIVE_ID',
+            'ADEA_PREVIEW_SECRETS_STORE_ID',
+            'ADEA_PREVIEW_DATABASE_URL_SECRET',
+            'ADEA_PREVIEW_AUTH_BASE_URL_SECRET',
+            'ADEA_PREVIEW_AUTH_COOKIE_SECRET_NAME',
+            'ADEA_PREVIEW_AUTH_TRUSTED_ORIGINS_SECRET',
+          ])
+          for (const [name, value] of Object.entries(buildEnv)) {
+            if (!allowedNames.has(name)) {
+              throw new Error(`Invalid build-env variable name: ${name}`)
+            }
+            if (typeof value !== 'string') throw new Error(`build-env value for ${name} must be a string`)
+          }
+          const result = spawnSync('bun', ['run', process.env.BUILD_SCRIPT], {
+            stdio: 'inherit',
+            env: { ...process.env, ...buildEnv },
+          })
+          if (result.error) throw result.error
+          process.exit(result.status ?? 1)
+          NODE
       - name: Deploy to Cloudflare
         id: deploy
         if: steps.check.outputs.should_deploy != 'false'

package/.github/workflows/draft-control_self-ci.yml

@@ -21,13 +21,20 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - name: Cancel queued and running checks for this branch
+      - name: Cancel queued and running checks for this pull request
         env:
           GH_TOKEN: ${{ github.token }}
           HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
           CURRENT_RUN_ID: ${{ github.run_id }}
         run: |
           set -euo pipefail
+          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+            echo '::error title=Draft control cannot verify pull request::The event did not include a valid pull request number.'
+            exit 1
+          fi
+          # Only runs associated with this PR may be cancelled. Branch names can
+          # be shared by multiple PRs, including heads from different forks.
           for status in queued in_progress; do
             gh api "repos/$GITHUB_REPOSITORY/actions/runs" \
               --method GET \
@@ -35,7 +42,7 @@ jobs:
               -f event=pull_request \
               -f status="$status" \
               --paginate \
-              --jq '.workflow_runs[].id' |
+              --jq ".workflow_runs[]? | select(any(.pull_requests[]?; .number == $PR_NUMBER)) | .id" |
               while read -r run_id; do
                 if [ -n "$run_id" ] && [ "$run_id" -lt "$CURRENT_RUN_ID" ]; then
                   gh api \
@@ -45,4 +52,4 @@ jobs:
                 fi
               done
           done
-          echo "CI is halted while pull request #${{ github.event.pull_request.number }} remains draft."
+          echo "CI is halted while pull request #$PR_NUMBER remains draft."

package/.github/workflows/validation_self-ci.yml

@@ -112,15 +112,12 @@ jobs:
 
   # CodeQL requires a push analysis to populate default-branch code-scanning
   # alerts. Keep the full validation gate pull-request-only so main pushes do
-  # not duplicate CI, test, or security work. Release Please version merges
-  # change manifests only, so the code tree is identical to the content merge
-  # whose default-branch scan is still current; re-scanning it on every release
-  # wastes the Rust-heavy analysis budget, and the scheduled audit covers drift.
+  # not duplicate CI, test, or security work. Run CodeQL for every main push:
+  # commit subjects do not prove that a push contains only release metadata.
   default-branch-codeql:
     name: CodeQL (default branch)
     if: >-
-      vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push' &&
-      !startsWith(github.event.head_commit.message, 'chore(main): release ')
+      vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push'
     permissions:
       actions: read
       contents: read

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.52.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.51.1...v1.52.0) (2026-10-30)
+
+
+### Features
+
+* scope Cloudflare build variables to build ([#802](https://github.com/0xPlayerOne/code-foundry/issues/802)) ([1f9a89f](https://github.com/0xPlayerOne/code-foundry/commit/1f9a89fa19a868732805a065fe90cc7609928a1e))
+
+
+### Bug Fixes
+
+* scope draft cancellation to its pull request ([#799](https://github.com/0xPlayerOne/code-foundry/issues/799)) ([ba42e81](https://github.com/0xPlayerOne/code-foundry/commit/ba42e811729e6ab8a82e2941abfdaab4f8544eed))
+
+## [1.51.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.51.0...v1.51.1) (2026-10-29)
+
+
+### Bug Fixes
+
+* **ci:** run CodeQL on every main push ([#797](https://github.com/0xPlayerOne/code-foundry/issues/797)) ([d6d299d](https://github.com/0xPlayerOne/code-foundry/commit/d6d299dd5b073d6a5e13ffc2aa016d856208d2e4))
+
 ## [1.51.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.50.1...v1.51.0) (2026-10-29)
 
 
@@ -126,23 +145,9 @@
 
 * validation-issue-read-v1471 ([#759](https://github.com/0xPlayerOne/code-foundry/issues/759)) ([7119b3e](https://github.com/0xPlayerOne/code-foundry/commit/7119b3e2baebfbfdd47d32428cbf5df2f2079afa))
 
-## [1.47.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.3...v1.47.4) (2026-10-15)
-
-
-### Documentation
-
-* fix generated agent contribution and validation references ([#760](https://github.com/0xPlayerOne/code-foundry/issues/760)) ([c3564c9](https://github.com/0xPlayerOne/code-foundry/commit/c3564c92cb168449317afe2e40359144bf7a0c71))
-
-## [1.47.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.2...v1.47.3) (2026-10-09)
-
-
-### Maintenance
-
-* **fleet:** point the manifest at the rollout worktrees and filter adea's actionlint ([#757](https://github.com/0xPlayerOne/code-foundry/issues/757)) ([55bae8b](https://github.com/0xPlayerOne/code-foundry/commit/55bae8bf99a022bfa03294972d89a3cca20a6203))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 264 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 266 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/PERFORMANCE.md

@@ -34,8 +34,10 @@ and 118 files.
 On v1.50.1 base `f671dd8`, the measured artifact was 315,853 packed bytes,
 1,200,759 unpacked bytes, and 120 files. Release caller publication overrides
 measure 316,295 packed bytes, 1,222,905 unpacked bytes, and 120 files: an
-increase of 442 packed bytes and 22,146 unpacked bytes. The packed limit is
-316,500 bytes, leaving 205 bytes of measured headroom; the unpacked and file-count
+increase of 442 packed bytes and 22,146 unpacked bytes. The packed limit was
+raised to 317,000 bytes for the optional build environment input in the
+Cloudflare reusable workflow, which ships in the npm package. This leaves 235
+bytes above the measured 316,765-byte artifact. The unpacked and file-count
 limits remain 1,225,000 bytes and 120 files.
 
 The published package ships a changelog trimmed to the 20 most recent releases

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.51.0",
+  "version": "1.52.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1602,8 +1602,8 @@ const DIRECT_DOC_REPLACEMENTS = {
       '7. Push to the fork and open a pull request targeting `main`.',
     ],
     [
-      '| Event                                              | Expected automation                                                                                                                       |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                                                                        |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                                                     |\n| Exact Release Please PR targeting `main`           | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests                                      |\n| Scheduled or manual validation                     | Full audit tier                                                                                                                           |\n| Push to a working branch                           | Draft PR workflow                                                                                                                         |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                                                                        |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)                                                                    |\n',
-      '| Event                                    | Expected automation                                                                                  |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`      | No runner-heavy validation; run local checks before requesting review                                |\n| Ready pull request targeting `main`      | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation           | Full audit tier                                                                                      |\n| Push to a working branch                 | Draft PR workflow                                                                                    |\n| Push to `main`                           | Release workflow; CodeQL skips release-only merges (audit covers drift)                              |\n',
+      '| Event                                              | Expected automation                                                                                                                       |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                                                                        |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                                                                     |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                                                     |\n| Exact Release Please PR targeting `main`           | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests                                      |\n| Scheduled or manual validation                     | Full audit tier                                                                                                                           |\n| Push to a working branch                           | Draft PR workflow                                                                                                                         |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                                                                        |\n| Push to `main`                                     | Release workflow; CodeQL scans every push to main, all commits included                                                                    |\n',
+      '| Event                                    | Expected automation                                                                                  |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`      | No runner-heavy validation; run local checks before requesting review                                |\n| Ready pull request targeting `main`      | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation           | Full audit tier                                                                                      |\n| Push to a working branch                 | Draft PR workflow                                                                                    |\n| Push to `main`                           | Release workflow; CodeQL scans every push to main, all commits included                              |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',