code-foundry 1.51.1 → 1.52.1

package/.github/workflows/cloudflare-deploy.yml

@@ -35,6 +35,11 @@ on:
         required: false
         type: string
         default: ''
+      build-env:
+        description: 'Optional JSON object of non-secret environment variables for the build command only.'
+        required: false
+        type: string
+        default: '{}'
       bun-version:
         required: false
         type: string
@@ -267,10 +272,44 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
         env:
           BUILD_SCRIPT: ${{ inputs.build-script }}
+          BUILD_ENV_JSON: ${{ inputs.build-env }}
           TURBO_API: ${{ vars.TURBO_API }}
           TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
           TURBO_TEAM: ${{ vars.TURBO_TEAM }}
-        run: bun run "$BUILD_SCRIPT"
+        run: |
+          node --input-type=module <<'NODE'
+          import { spawnSync } from 'node:child_process'
+          const input = process.env.BUILD_ENV_JSON
+          let buildEnv
+          try {
+            buildEnv = JSON.parse(input)
+          } catch {
+            throw new Error('build-env must be a JSON object of string values')
+          }
+          if (!buildEnv || typeof buildEnv !== 'object' || Array.isArray(buildEnv)) {
+            throw new Error('build-env must be a JSON object of string values')
+          }
+          const allowedNames = new Set([
+            'ADEA_PREVIEW_HYPERDRIVE_ID',
+            'ADEA_PREVIEW_SECRETS_STORE_ID',
+            'ADEA_PREVIEW_DATABASE_URL_SECRET',
+            'ADEA_PREVIEW_AUTH_BASE_URL_SECRET',
+            'ADEA_PREVIEW_AUTH_COOKIE_SECRET_NAME',
+            'ADEA_PREVIEW_AUTH_TRUSTED_ORIGINS_SECRET',
+          ])
+          for (const [name, value] of Object.entries(buildEnv)) {
+            if (!allowedNames.has(name)) {
+              throw new Error(`Invalid build-env variable name: ${name}`)
+            }
+            if (typeof value !== 'string') throw new Error(`build-env value for ${name} must be a string`)
+          }
+          const result = spawnSync('bun', ['run', process.env.BUILD_SCRIPT], {
+            stdio: 'inherit',
+            env: { ...process.env, ...buildEnv },
+          })
+          if (result.error) throw result.error
+          process.exit(result.status ?? 1)
+          NODE
       - name: Deploy to Cloudflare
         id: deploy
         if: steps.check.outputs.should_deploy != 'false'

package/.github/workflows/draft-control_self-ci.yml

@@ -21,13 +21,20 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - name: Cancel queued and running checks for this branch
+      - name: Cancel queued and running checks for this pull request
         env:
           GH_TOKEN: ${{ github.token }}
           HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
           CURRENT_RUN_ID: ${{ github.run_id }}
         run: |
           set -euo pipefail
+          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+            echo '::error title=Draft control cannot verify pull request::The event did not include a valid pull request number.'
+            exit 1
+          fi
+          # Only runs associated with this PR may be cancelled. Branch names can
+          # be shared by multiple PRs, including heads from different forks.
           for status in queued in_progress; do
             gh api "repos/$GITHUB_REPOSITORY/actions/runs" \
               --method GET \
@@ -35,7 +42,7 @@ jobs:
               -f event=pull_request \
               -f status="$status" \
               --paginate \
-              --jq '.workflow_runs[].id' |
+              --jq ".workflow_runs[]? | select(any(.pull_requests[]?; .number == $PR_NUMBER)) | .id" |
               while read -r run_id; do
                 if [ -n "$run_id" ] && [ "$run_id" -lt "$CURRENT_RUN_ID" ]; then
                   gh api \
@@ -45,4 +52,4 @@ jobs:
                 fi
               done
           done
-          echo "CI is halted while pull request #${{ github.event.pull_request.number }} remains draft."
+          echo "CI is halted while pull request #$PR_NUMBER remains draft."

package/.github/workflows/qualification-receipt.yml

@@ -122,7 +122,7 @@ jobs:
           FOUNDRY_REQUIRED_JOB_NAMES_JSON: ${{ inputs.required-job-names-json }}
         run: |
           if [ "$SOURCE_READY" = success ] && [ "$RUNTIME_READY" = success ] && [ "$NODE_READY" = success ] && [ "$POLICY_READY" = success ] && [ -f "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" ]; then
-            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" verify >> "$GITHUB_OUTPUT"
+            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" verify
           else
             echo 'reuse=false' >> "$GITHUB_OUTPUT"
             echo 'reason=qualification or version-only release policy unavailable; using full validation' >> "$GITHUB_OUTPUT"
@@ -185,7 +185,7 @@ jobs:
           FOUNDRY_REQUIRED_JOB_NAMES_JSON: ${{ inputs.required-job-names-json }}
         run: |
           if [ "$SOURCE_READY" = success ] && [ "$RUNTIME_READY" = success ] && [ "$NODE_READY" = success ] && [ -f "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" ]; then
-            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" produce >> "$GITHUB_OUTPUT"
+            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" produce
           else
             echo 'reuse=false' >> "$GITHUB_OUTPUT"
             echo 'reason=receipt setup unavailable' >> "$GITHUB_OUTPUT"

package/.github/workflows/validation-billing.yml

@@ -1286,7 +1286,7 @@ jobs:
     name: Qualification receipt
     needs: [fast-lanes, lint, type-check, unit, e2e, audit, codeql, gate]
     if: >-
-      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
       inputs.release-qualification-receipts == true &&
       github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
       needs.fast-lanes.result == 'success' && needs.lint.result == 'success' &&

package/.github/workflows/validation-no-codeql.yml

@@ -272,7 +272,7 @@ jobs:
     name: Qualification receipt
     needs: [ci, test, security, eval, gate]
     if: >-
-      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
       inputs.release-qualification-receipts == true &&
       github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
       needs.ci.result == 'success' && needs.test.result == 'success' &&

package/.github/workflows/validation.yml

@@ -288,7 +288,7 @@ jobs:
     name: Qualification receipt
     needs: [ci, test, security, codeql, eval, gate]
     if: >-
-      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
       inputs.release-qualification-receipts == true &&
       github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
       needs.ci.result == 'success' && needs.test.result == 'success' &&

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.52.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.52.0...v1.52.1) (2026-10-30)
+
+
+### Bug Fixes
+
+* restore source qualification receipt reuse ([#801](https://github.com/0xPlayerOne/code-foundry/issues/801)) ([989bdbf](https://github.com/0xPlayerOne/code-foundry/commit/989bdbfe5af6d2003ca97dde456d8c86fb92078c))
+
+## [1.52.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.51.1...v1.52.0) (2026-10-30)
+
+
+### Features
+
+* scope Cloudflare build variables to build ([#802](https://github.com/0xPlayerOne/code-foundry/issues/802)) ([1f9a89f](https://github.com/0xPlayerOne/code-foundry/commit/1f9a89fa19a868732805a065fe90cc7609928a1e))
+
+
+### Bug Fixes
+
+* scope draft cancellation to its pull request ([#799](https://github.com/0xPlayerOne/code-foundry/issues/799)) ([ba42e81](https://github.com/0xPlayerOne/code-foundry/commit/ba42e811729e6ab8a82e2941abfdaab4f8544eed))
+
 ## [1.51.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.51.0...v1.51.1) (2026-10-29)
 
 
@@ -126,23 +145,9 @@
 
 * add opt-in Vite+ task runner support ([#763](https://github.com/0xPlayerOne/code-foundry/issues/763)) ([f7970cd](https://github.com/0xPlayerOne/code-foundry/commit/f7970cdf1c1880aaee159d2de79ba043f93711a7))
 
-## [1.47.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.4...v1.47.5) (2026-10-15)
-
-
-### Bug Fixes
-
-* validation-issue-read-v1471 ([#759](https://github.com/0xPlayerOne/code-foundry/issues/759)) ([7119b3e](https://github.com/0xPlayerOne/code-foundry/commit/7119b3e2baebfbfdd47d32428cbf5df2f2079afa))
-
-## [1.47.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.3...v1.47.4) (2026-10-15)
-
-
-### Documentation
-
-* fix generated agent contribution and validation references ([#760](https://github.com/0xPlayerOne/code-foundry/issues/760)) ([c3564c9](https://github.com/0xPlayerOne/code-foundry/commit/c3564c92cb168449317afe2e40359144bf7a0c71))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 265 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 267 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/PERFORMANCE.md

@@ -34,8 +34,10 @@ and 118 files.
 On v1.50.1 base `f671dd8`, the measured artifact was 315,853 packed bytes,
 1,200,759 unpacked bytes, and 120 files. Release caller publication overrides
 measure 316,295 packed bytes, 1,222,905 unpacked bytes, and 120 files: an
-increase of 442 packed bytes and 22,146 unpacked bytes. The packed limit is
-316,500 bytes, leaving 205 bytes of measured headroom; the unpacked and file-count
+increase of 442 packed bytes and 22,146 unpacked bytes. The packed limit was
+raised to 317,000 bytes for the optional build environment input in the
+Cloudflare reusable workflow, which ships in the npm package. This leaves 235
+bytes above the measured 316,765-byte artifact. The unpacked and file-count
 limits remain 1,225,000 bytes and 120 files.
 
 The published package ships a changelog trimmed to the 20 most recent releases

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.51.1",
+  "version": "1.52.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {