code-foundry 1.52.1 → 1.52.3

package/.github/workflows/release.yml

@@ -275,23 +275,26 @@ jobs:
 
           const sleep = (seconds) =>
             execFileSync('sleep', [String(seconds)]);
-          // Writes intermittently hit GitHub's secondary rate limiting from
-          // busy automation accounts (403 with the generic not-accessible
-          // message); back off and retry before giving up.
+          // gh reports a process exit code, not an HTTP status, in error.status.
+          // Retry only recognized transient read failures; a failed write may
+          // already have taken effect and must not be repeated blindly.
           const gh = (args, options = {}) => {
-            for (const wait of [0, 10, 30]) {
+            const isRead = args.includes('GET');
+            for (let attempt = 0; attempt < 3; attempt += 1) {
               try {
-                if (wait) sleep(wait);
                 return execFileSync('gh', args, {
                   ...options,
                   encoding: 'utf8',
                   maxBuffer: 32 * 1024 * 1024,
                 });
               } catch (error) {
-                const status = error.status;
-                const retriable = status === null || status === 403 || status === 429 || status >= 500;
-                if (!retriable || wait === 30) throw error;
-                console.log(`gh call failed (status ${status ?? 'unknown'}); retrying in ${wait === 0 ? 10 : 30}s`);
+                const detail = String(error.stderr ?? error.message ?? '');
+                const secondary = /secondary rate limit|HTTP 429/i.test(detail);
+                const unavailable = /HTTP 50[0234]\b/i.test(detail);
+                if (!isRead || attempt === 2 || (!secondary && !unavailable)) throw error;
+                const wait = secondary ? [60, 120][attempt] : [10, 30][attempt];
+                console.log(`Transient GitHub read failure; retrying in ${wait}s`);
+                sleep(wait);
               }
             }
             throw new Error('unreachable');

package/.github/workflows/validation_self-ci.yml

@@ -85,6 +85,7 @@ jobs:
     uses: ./.github/workflows/validation.yml
     with:
       mode: ${{ needs.mode.outputs.mode }}
+      release-qualification-receipts: ${{ github.repository == '0xPlayerOne/code-foundry' }}
       runtime-repository: 0xPlayerOne/code-foundry
       # Source PRs validate their proposed runtime commit. A Release Please PR
       # uses its main base, keeping version-only metadata out of the runtime

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.52.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.52.2...v1.52.3) (2026-10-30)
+
+
+### Bug Fixes
+
+* opt Code Foundry into source qualification receipts ([#805](https://github.com/0xPlayerOne/code-foundry/issues/805)) ([c7f7011](https://github.com/0xPlayerOne/code-foundry/commit/c7f70117b7d9d687d1116766114ba39028a4dc40))
+
+## [1.52.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.52.1...v1.52.2) (2026-10-30)
+
+
+### Bug Fixes
+
+* retry transient release fallback reads safely ([#800](https://github.com/0xPlayerOne/code-foundry/issues/800)) ([c91e23b](https://github.com/0xPlayerOne/code-foundry/commit/c91e23bfaea9f107c8af9fa9bdf391308fa5ebf2))
+
 ## [1.52.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.52.0...v1.52.1) (2026-10-30)
 
 
@@ -131,23 +145,9 @@
 
 * **bun:** align Bun runtime pins to 1.4.3 ([#767](https://github.com/0xPlayerOne/code-foundry/issues/767)) ([402343f](https://github.com/0xPlayerOne/code-foundry/commit/402343fed2b41be3b2a55ddbc56d2256cc511b1a))
 
-## [1.48.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.0...v1.48.1) (2026-10-16)
-
-
-### Bug Fixes
-
-* vite-plus-cache-post-job-save ([#765](https://github.com/0xPlayerOne/code-foundry/issues/765)) ([3f82e85](https://github.com/0xPlayerOne/code-foundry/commit/3f82e850f5c09af6cea4de6f1a791d098bbd2f6e))
-
-## [1.48.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.5...v1.48.0) (2026-10-16)
-
-
-### Features
-
-* add opt-in Vite+ task runner support ([#763](https://github.com/0xPlayerOne/code-foundry/issues/763)) ([f7970cd](https://github.com/0xPlayerOne/code-foundry/commit/f7970cdf1c1880aaee159d2de79ba043f93711a7))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 267 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 269 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/PERFORMANCE.md

@@ -31,14 +31,7 @@ changelog size and its packaged (trimmed) size as informational metrics. At
 v1.44.0 the measured artifact was 280,902 packed bytes, 1,070,333 unpacked bytes,
 and 118 files.
 
-On v1.50.1 base `f671dd8`, the measured artifact was 315,853 packed bytes,
-1,200,759 unpacked bytes, and 120 files. Release caller publication overrides
-measure 316,295 packed bytes, 1,222,905 unpacked bytes, and 120 files: an
-increase of 442 packed bytes and 22,146 unpacked bytes. The packed limit was
-raised to 317,000 bytes for the optional build environment input in the
-Cloudflare reusable workflow, which ships in the npm package. This leaves 235
-bytes above the measured 316,765-byte artifact. The unpacked and file-count
-limits remain 1,225,000 bytes and 120 files.
+v1.52.1 main no-changelog: 316,788 packed, 1,224,968 unpacked, 120 files. Branch checker: 316,744 packed, 1,224,894 unpacked, 120 files. v1.52.0 published (trimmed changelog): 316,867 packed, 1,225,194 unpacked. Limits: 317,000 packed, 1,225,000 unpacked, 120 files.
 
 The published package ships a changelog trimmed to the 20 most recent releases
 with a link to the full history on GitHub. `scripts/package-changelog.mjs`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.52.1",
+  "version": "1.52.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -1354,12 +1354,9 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       workflow === 'validation' &&
       configured(config.release_qualification_receipts, 'false') === 'true'
     ) {
-      const qualified = rendered.replace(
-        /^(\s+mode:)\s+(\$\{\{\s*needs\.mode\.outputs\.mode\s*\}\})\s*$/m,
-        '$1 $2\n      release-qualification-receipts: true'
-      )
+      const qualified = rendered.replace(/^(\s+release-qualification-receipts:).+$/m, '$1 true')
       if (qualified === rendered) {
-        throw new Error('Validation caller cannot render release-qualification-receipts opt-in.')
+        throw new Error('Validation caller is missing receipt input.')
       }
       rendered = qualified
     }