code-foundry 1.53.6 → 1.53.8

package/.github/workflows/codeql.yml

@@ -35,6 +35,15 @@ on:
         default: 1
         # Retained for caller compatibility. Rust shards share the single
         # analysis matrix, so no separate throttle applies.
+      plan:
+        description: >-
+          JSON object of the Detect job's outputs, computed by the caller's
+          planning job (`validation plan`). When set, Detect is skipped and
+          analysis reads the plan instead, saving one runner hop. Empty runs
+          Detect here as before.
+        required: false
+        type: string
+        default: ''
 permissions:
   actions: read
   contents: read
@@ -60,7 +69,7 @@ concurrency:
 jobs:
   detect:
     name: Detect
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.plan == ''
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     outputs:
@@ -238,11 +247,16 @@ jobs:
   analyze:
     name: Analyze (${{ matrix.entry.display }})
     needs: detect
-    if: vars.CI_BILLING_PAUSED != 'true' && needs.detect.outputs.enabled == 'true'
+    # A planned run skips Detect and reads the same outputs from the plan;
+    # an unplanned run still requires Detect to have succeeded.
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      ((inputs.plan == '' && needs.detect.result == 'success' && needs.detect.outputs.enabled == 'true') ||
+      (inputs.plan != '' && needs.detect.result == 'skipped' && fromJSON(inputs.plan || '{}').enabled == 'true'))
     strategy:
       fail-fast: false
       matrix:
-        entry: ${{ fromJson(needs.detect.outputs.matrix || '[]') }}
+        entry: ${{ fromJson((inputs.plan != '' && fromJSON(inputs.plan || '{}').matrix) || needs.detect.outputs.matrix || '[]') }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -336,7 +350,7 @@ jobs:
         uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           languages: rust
-          build-mode: ${{ needs.detect.outputs.rust_build_mode }}
+          build-mode: ${{ (inputs.plan != '' && fromJSON(inputs.plan || '{}').rust_build_mode) || needs.detect.outputs.rust_build_mode }}
           config-file: ${{ steps.scope.outputs.config_file }}
           threads: ${{ inputs.rust-threads }}
       - name: Analyze Rust

package/.github/workflows/release.yml

@@ -554,56 +554,77 @@ jobs:
                   # A ready head already receives synchronize validation. Preserve
                   # its live/completed owner instead of cancelling and reallocating
                   # CI every time another queued main release run prepares it.
-                  runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
-                    "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
-                    -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
-                  validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
-                    --arg repo "$GITHUB_REPOSITORY" '
-                    def active: .status == "queued" or .status == "in_progress" or
-                      .status == "waiting" or .status == "pending" or .status == "requested";
-                    def valid_run:
-                      type == "object" and
-                      (.id | type == "number" and . > 0 and floor == .) and
-                      (.run_attempt | type == "number" and . >= 1 and floor == .) and
-                      (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
-                      (.head_branch | type == "string" and length > 0) and
-                      (.event | type == "string" and length > 0) and
-                      (.repository | type == "object") and
-                      (.repository.full_name | type == "string" and length > 0) and
-                      (.path | type == "string" and length > 0) and
-                      ((active and has("conclusion") and .conclusion == null) or
-                       (.status == "completed" and
-                        (.conclusion == "success" or .conclusion == "failure" or
-                         .conclusion == "timed_out" or .conclusion == "action_required" or
-                         .conclusion == "cancelled" or .conclusion == "skipped" or
-                         .conclusion == "neutral")));
-                    if (.workflow_runs | type) != "array" or
-                       (.total_count | type) != "number" then
-                      error("Invalid validation owner response")
-                    elif .total_count != (.workflow_runs | length) then
-                      error("Incomplete validation owner response")
-                    elif any(.workflow_runs[]; valid_run | not) then
-                      error("Invalid validation run identity or state")
-                    else
-                      [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
-                        .head_sha == $head and .head_branch == $branch and
-                        .event == "pull_request" and .repository.full_name == $repo and
-                        ($workflow == ".github/workflows/validation.yml" or
-                         $workflow == ".github/workflows/validation_self-ci.yml")
-                      )] | sort_by(.id) | last |
-                      if . == null then "missing"
-                      elif active or (.status == "completed" and .conclusion == "success") then "owned"
-                      elif .status == "completed" and
-                           (.conclusion == "failure" or .conclusion == "timed_out" or
-                            .conclusion == "action_required") then "failed"
-                      elif .status == "completed" and
-                           (.conclusion == "cancelled" or .conclusion == "skipped" or
-                            .conclusion == "neutral") then "missing"
-                      else error("Unconfirmed validation owner state") end
-                    end' <<< "$runs")
-                  fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-                    --json isDraft,headRefOid,headRefName \
-                    --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                  #
+                  # GitHub registers the synchronize run for a head this job (or
+                  # Release Please) just pushed a few seconds after the push. An
+                  # absent owner is therefore polled for a bounded window before the
+                  # canonical transition, so the transition does not cancel that
+                  # run. A cancelled, skipped or neutral owner is already terminal
+                  # and transitions at once; after the window an absent owner
+                  # still gets the explicit transition, and a failed one still fails.
+                  owner_poll=1
+                  while :; do
+                    runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
+                      "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
+                      -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
+                    validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
+                      --arg repo "$GITHUB_REPOSITORY" '
+                      def active: .status == "queued" or .status == "in_progress" or
+                        .status == "waiting" or .status == "pending" or .status == "requested";
+                      def valid_run:
+                        type == "object" and
+                        (.id | type == "number" and . > 0 and floor == .) and
+                        (.run_attempt | type == "number" and . >= 1 and floor == .) and
+                        (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
+                        (.head_branch | type == "string" and length > 0) and
+                        (.event | type == "string" and length > 0) and
+                        (.repository | type == "object") and
+                        (.repository.full_name | type == "string" and length > 0) and
+                        (.path | type == "string" and length > 0) and
+                        ((active and has("conclusion") and .conclusion == null) or
+                         (.status == "completed" and
+                          (.conclusion == "success" or .conclusion == "failure" or
+                           .conclusion == "timed_out" or .conclusion == "action_required" or
+                           .conclusion == "cancelled" or .conclusion == "skipped" or
+                           .conclusion == "neutral")));
+                      if (.workflow_runs | type) != "array" or
+                         (.total_count | type) != "number" then
+                        error("Invalid validation owner response")
+                      elif .total_count != (.workflow_runs | length) then
+                        error("Incomplete validation owner response")
+                      elif any(.workflow_runs[]; valid_run | not) then
+                        error("Invalid validation run identity or state")
+                      else
+                        [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
+                          .head_sha == $head and .head_branch == $branch and
+                          .event == "pull_request" and .repository.full_name == $repo and
+                          ($workflow == ".github/workflows/validation.yml" or
+                           $workflow == ".github/workflows/validation_self-ci.yml")
+                        )] | sort_by(.id) | last |
+                        if . == null then "absent"
+                        elif active or (.status == "completed" and .conclusion == "success") then "owned"
+                        elif .status == "completed" and
+                             (.conclusion == "failure" or .conclusion == "timed_out" or
+                              .conclusion == "action_required") then "failed"
+                        elif .status == "completed" and
+                             (.conclusion == "cancelled" or .conclusion == "skipped" or
+                              .conclusion == "neutral") then "missing"
+                        else error("Unconfirmed validation owner state") end
+                      end' <<< "$runs")
+                    fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                      --json isDraft,headRefOid,headRefName \
+                      --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                    if [ "$fresh_state" != "$pr_state" ] || [ "$validation" != absent ] ||
+                      [ "$owner_poll" -ge 7 ]; then
+                      break
+                    fi
+                    echo "Release PR #$pr has no current-head validation yet (lookup $owner_poll of 7); waiting for its synchronize run to register."
+                    owner_poll=$((owner_poll + 1))
+                    sleep 5
+                  done
+                  if [ "$validation" = absent ]; then
+                    validation=missing
+                  fi
                   if [ "$fresh_state" != "$pr_state" ]; then
                     if [ "$state_attempt" -eq 3 ]; then
                       echo 'Release PR state did not stabilize during validation lookup; refusing readiness mutation.' >&2

package/.github/workflows/security.yml

@@ -18,6 +18,16 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+      plan:
+        description: >-
+          JSON object of the Profile job's outputs, computed by the caller's
+          planning job (`validation plan`). When set, Profile is skipped,
+          audits read the plan instead, and Dependency Review runs as its own
+          job beside them, saving one runner hop. Empty runs Profile here as
+          before.
+        required: false
+        type: string
+        default: ''
 permissions:
   contents: read
 
@@ -39,7 +49,7 @@ concurrency:
 jobs:
   profile:
     name: Profile
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.plan == ''
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     outputs:
@@ -142,12 +152,16 @@ jobs:
     needs: profile
     # Avoid expanding an empty matrix; skip only the explicitly empty result.
     # Missing or malformed output still fails closed during matrix expansion.
-    if: vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success' && needs.profile.outputs.audit_matrix != '[]'
+    # A planned run skips Profile and reads the same matrix from the plan.
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      ((inputs.plan == '' && needs.profile.result == 'success' && needs.profile.outputs.audit_matrix != '[]') ||
+      (inputs.plan != '' && needs.profile.result == 'skipped' && fromJSON(inputs.plan || '{}').audit_matrix != '[]'))
     strategy:
       fail-fast: false
       max-parallel: 8
       matrix:
-        entry: ${{ fromJson(needs.profile.outputs.audit_matrix || '[]') }}
+        entry: ${{ fromJson((inputs.plan != '' && fromJSON(inputs.plan || '{}').audit_matrix) || needs.profile.outputs.audit_matrix || '[]') }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
     env:
@@ -386,3 +400,15 @@ jobs:
       - name: Audit Python dependencies
         if: matrix.entry.language == 'python'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit python
+      # Planned runs only: with no Profile job, the first audit job runs
+      # Dependency Review, whatever the audit's own outcome, so the review
+      # costs no runner hop. The planner leaves a run with a review but no
+      # audit unplanned, so Profile still runs it there.
+      - name: Dependency Review
+        if: >-
+          !cancelled() && inputs.plan != '' && strategy.job-index == 0 &&
+          github.event_name == 'pull_request' && fromJSON(inputs.plan || '{}').dependency_review == 'true'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
+        with:
+          fail-on-severity: high
+          license-check: true

package/.github/workflows/validation-billing.yml

@@ -124,6 +124,22 @@ on:
         required: false
         type: string
         default: ''
+      security-plan:
+        description: >-
+          Accepted so every orchestrator takes the same caller inputs. The
+          merged audit job profiles in place, so the plan is unused.
+        required: false
+        type: string
+        default: ''
+      codeql-plan:
+        description: >-
+          JSON CodeQL Detect outputs from the caller's planning job. When set,
+          the CodeQL workflow skips its Detect job and reads the plan, and a
+          plan marked idle (CodeQL unavailable) skips the workflow. Empty
+          detects inside the workflow as before.
+        required: false
+        type: string
+        default: ''
     secrets:
       TURBO_TOKEN:
         required: false
@@ -1216,7 +1232,9 @@ jobs:
     name: CodeQL
     # Release-please pull requests also analyze with CodeQL so repository
     # rulesets requiring code scanning results never deadlock the release.
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.codeql == true && (inputs.mode == 'audit' || inputs.mode == 'release')
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.codeql == true && (inputs.mode == 'audit' || inputs.mode == 'release') &&
+      fromJSON(inputs.codeql-plan || '{}').idle != 'true'
     permissions:
       actions: read
       contents: read
@@ -1230,6 +1248,7 @@ jobs:
       rust-shards: ${{ inputs.rust-shards }}
       rust-threads: ${{ inputs.rust-threads }}
       rust-max-parallel: ${{ inputs.rust-max-parallel }}
+      plan: ${{ inputs.codeql-plan }}
 
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
@@ -1256,8 +1275,10 @@ jobs:
       FOUNDRY_SECURITY: ${{ needs.audit.result }}
       # This orchestrator runs CodeQL only when the consumer's canonical
       # configuration enables it; otherwise the unavailability decision is
-      # treated as satisfied without registering a skipped PR check.
-      FOUNDRY_CODEQL: ${{ inputs.codeql == true && needs.codeql.result || 'success' }}
+      # treated as satisfied without registering a skipped PR check. A CodeQL
+      # workflow the caller planned as idle (unavailable) reports skipped;
+      # only that planned skip counts as success.
+      FOUNDRY_CODEQL: ${{ inputs.codeql == true && ((needs.codeql.result == 'skipped' && fromJSON(inputs.codeql-plan || '{}').idle == 'true' && 'success') || needs.codeql.result) || 'success' }}
       # Eval runs inside the merged fast-lanes job on the audit tier; a
       # fast-lanes failure on that tier marks the eval category failed even if
       # another merged lane caused it, which fails closed.
@@ -1306,7 +1327,8 @@ jobs:
       needs.fast-lanes.result == 'success' && needs.lint.result == 'success' &&
       needs.type-check.result == 'success' && needs.unit.result == 'success' &&
       needs.e2e.result == 'success' && needs.audit.result == 'success' &&
-      (inputs.codeql != true || needs.codeql.result == 'success') &&
+      (inputs.codeql != true || needs.codeql.result == 'success' ||
+      (needs.codeql.result == 'skipped' && fromJSON(inputs.codeql-plan || '{}').idle == 'true')) &&
       needs.gate.result == 'success'
     permissions:
       actions: read
@@ -1321,5 +1343,5 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       job-results-json: >-
-        {"ci":"${{ needs.lint.result == 'success' && needs.type-check.result == 'success' && needs.fast-lanes.result == 'success' && 'success' || 'failure' }}","test":"${{ needs.unit.result == 'success' && needs.fast-lanes.result == 'success' && needs.e2e.result == 'success' && 'success' || 'failure' }}","security":"${{ needs.audit.result }}","codeql":"${{ inputs.codeql == true && needs.codeql.result || 'not-configured' }}","eval":"${{ needs.fast-lanes.result }}","gate":"${{ needs.gate.result }}"}
+        {"ci":"${{ needs.lint.result == 'success' && needs.type-check.result == 'success' && needs.fast-lanes.result == 'success' && 'success' || 'failure' }}","test":"${{ needs.unit.result == 'success' && needs.fast-lanes.result == 'success' && needs.e2e.result == 'success' && 'success' || 'failure' }}","security":"${{ needs.audit.result }}","codeql":"${{ inputs.codeql == true && ((needs.codeql.result == 'skipped' && fromJSON(inputs.codeql-plan || '{}').idle == 'true' && 'success') || needs.codeql.result) || 'not-configured' }}","eval":"${{ needs.fast-lanes.result }}","gate":"${{ needs.gate.result }}"}
       required-job-names-json: '["Validation / Gate"]'

package/.github/workflows/validation-no-codeql.yml

@@ -84,6 +84,23 @@ on:
         required: false
         type: string
         default: ''
+      security-plan:
+        description: >-
+          JSON Security Profile outputs from the caller's planning job. When
+          set, the Security workflow skips its Profile job and reads the plan,
+          and a plan marked idle (no dependency audit and no dependency
+          review to run) skips the workflow. Empty profiles inside the
+          workflow as before.
+        required: false
+        type: string
+        default: ''
+      codeql-plan:
+        description: >-
+          Accepted so every orchestrator takes the same caller inputs. This
+          variant runs no CodeQL, so the plan is unused.
+        required: false
+        type: string
+        default: ''
       artifact-prefix:
         description: Prefix for task receipts; use a unique value when calling this workflow more than once.
         required: false
@@ -196,7 +213,11 @@ jobs:
 
   security:
     name: Security
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    # A plan marked idle has no audit or review to run; the gate counts that
+    # planned skip as the success the empty workflow used to report.
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      fromJSON(inputs.security-plan || '{}').idle != 'true'
     permissions:
       contents: read
     uses: ./.github/workflows/security.yml
@@ -204,6 +225,7 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.security-runner }}
+      plan: ${{ inputs.security-plan }}
 
   eval:
     name: Eval
@@ -239,7 +261,10 @@ jobs:
       FOUNDRY_MODE: ${{ inputs.mode }}
       FOUNDRY_CI: ${{ needs.ci.result }}
       FOUNDRY_TEST: ${{ needs.test.result }}
-      FOUNDRY_SECURITY: ${{ needs.security.result }}
+      # A Security or CodeQL workflow the caller planned as idle never
+      # starts and reports skipped. Count only that planned skip as the
+      # success its empty run reported before.
+      FOUNDRY_SECURITY: ${{ (needs.security.result == 'skipped' && fromJSON(inputs.security-plan || '{}').idle == 'true' && 'success') || needs.security.result }}
       # An eval lane the caller planned as idle (no eval script, no
       # eval_command, or eval: false) never starts, so the whole Eval
       # workflow reports skipped. Count that exactly like the no-op success
@@ -291,7 +316,8 @@ jobs:
       inputs.release-qualification-receipts == true &&
       github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
       needs.ci.result == 'success' && needs.test.result == 'success' &&
-      needs.security.result == 'success' &&
+      (needs.security.result == 'success' ||
+      (needs.security.result == 'skipped' && fromJSON(inputs.security-plan || '{}').idle == 'true')) &&
       (needs.eval.result == 'success' ||
       (needs.eval.result == 'skipped' && contains(format(',{0},', inputs.idle-lanes), ',eval,'))) &&
       needs.gate.result == 'success'
@@ -308,5 +334,5 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       job-results-json: >-
-        {"ci":"${{ needs.ci.result }}","test":"${{ needs.test.result }}","security":"${{ needs.security.result }}","codeql":"not-configured","eval":"${{ (needs.eval.result == 'skipped' && contains(format(',{0},', inputs.idle-lanes), ',eval,') && 'success') || needs.eval.result }}","gate":"${{ needs.gate.result }}"}
+        {"ci":"${{ needs.ci.result }}","test":"${{ needs.test.result }}","security":"${{ (needs.security.result == 'skipped' && fromJSON(inputs.security-plan || '{}').idle == 'true' && 'success') || needs.security.result }}","codeql":"not-configured","eval":"${{ (needs.eval.result == 'skipped' && contains(format(',{0},', inputs.idle-lanes), ',eval,') && 'success') || needs.eval.result }}","gate":"${{ needs.gate.result }}"}
       required-job-names-json: '["Validation / Gate"]'

package/.github/workflows/validation.yml

@@ -99,6 +99,25 @@ on:
         required: false
         type: string
         default: ''
+      security-plan:
+        description: >-
+          JSON Security Profile outputs from the caller's planning job. When
+          set, the Security workflow skips its Profile job and reads the plan,
+          and a plan marked idle (no dependency audit and no dependency
+          review to run) skips the workflow. Empty profiles inside the
+          workflow as before.
+        required: false
+        type: string
+        default: ''
+      codeql-plan:
+        description: >-
+          JSON CodeQL Detect outputs from the caller's planning job. When set,
+          the CodeQL workflow skips its Detect job and reads the plan, and a
+          plan marked idle (CodeQL unavailable) skips the workflow. Empty
+          detects inside the workflow as before.
+        required: false
+        type: string
+        default: ''
       artifact-prefix:
         description: Prefix for task receipts; use a unique value when calling this workflow more than once.
         required: false
@@ -196,7 +215,11 @@ jobs:
 
   security:
     name: Security
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    # A plan marked idle has no audit or review to run; the gate counts that
+    # planned skip as the success the empty workflow used to report.
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      fromJSON(inputs.security-plan || '{}').idle != 'true'
     permissions:
       contents: read
     uses: ./.github/workflows/security.yml
@@ -204,12 +227,15 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.security-runner }}
+      plan: ${{ inputs.security-plan }}
 
   codeql:
     name: CodeQL
     # Release-please pull requests also analyze with CodeQL so repository
     # rulesets requiring code scanning results never deadlock the release.
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release') &&
+      fromJSON(inputs.codeql-plan || '{}').idle != 'true'
     permissions:
       actions: read
       contents: read
@@ -223,6 +249,7 @@ jobs:
       rust-shards: ${{ inputs.rust-shards }}
       rust-threads: ${{ inputs.rust-threads }}
       rust-max-parallel: ${{ inputs.rust-max-parallel }}
+      plan: ${{ inputs.codeql-plan }}
 
   eval:
     name: Eval
@@ -258,8 +285,11 @@ jobs:
       FOUNDRY_MODE: ${{ inputs.mode }}
       FOUNDRY_CI: ${{ needs.ci.result }}
       FOUNDRY_TEST: ${{ needs.test.result }}
-      FOUNDRY_SECURITY: ${{ needs.security.result }}
-      FOUNDRY_CODEQL: ${{ needs.codeql.result }}
+      # A Security or CodeQL workflow the caller planned as idle never
+      # starts and reports skipped. Count only that planned skip as the
+      # success its empty run reported before.
+      FOUNDRY_SECURITY: ${{ (needs.security.result == 'skipped' && fromJSON(inputs.security-plan || '{}').idle == 'true' && 'success') || needs.security.result }}
+      FOUNDRY_CODEQL: ${{ (needs.codeql.result == 'skipped' && fromJSON(inputs.codeql-plan || '{}').idle == 'true' && 'success') || needs.codeql.result }}
       # An eval lane the caller planned as idle (no eval script, no
       # eval_command, or eval: false) never starts, so the whole Eval
       # workflow reports skipped. Count that exactly like the no-op success
@@ -307,7 +337,10 @@ jobs:
       inputs.release-qualification-receipts == true &&
       github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
       needs.ci.result == 'success' && needs.test.result == 'success' &&
-      needs.security.result == 'success' && needs.codeql.result == 'success' &&
+      (needs.security.result == 'success' ||
+      (needs.security.result == 'skipped' && fromJSON(inputs.security-plan || '{}').idle == 'true')) &&
+      (needs.codeql.result == 'success' ||
+      (needs.codeql.result == 'skipped' && fromJSON(inputs.codeql-plan || '{}').idle == 'true')) &&
       (needs.eval.result == 'success' ||
       (needs.eval.result == 'skipped' && contains(format(',{0},', inputs.idle-lanes), ',eval,'))) &&
       needs.gate.result == 'success'
@@ -324,5 +357,5 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       job-results-json: >-
-        {"ci":"${{ needs.ci.result }}","test":"${{ needs.test.result }}","security":"${{ needs.security.result }}","codeql":"${{ needs.codeql.result }}","eval":"${{ (needs.eval.result == 'skipped' && contains(format(',{0},', inputs.idle-lanes), ',eval,') && 'success') || needs.eval.result }}","gate":"${{ needs.gate.result }}"}
+        {"ci":"${{ needs.ci.result }}","test":"${{ needs.test.result }}","security":"${{ (needs.security.result == 'skipped' && fromJSON(inputs.security-plan || '{}').idle == 'true' && 'success') || needs.security.result }}","codeql":"${{ (needs.codeql.result == 'skipped' && fromJSON(inputs.codeql-plan || '{}').idle == 'true' && 'success') || needs.codeql.result }}","eval":"${{ (needs.eval.result == 'skipped' && contains(format(',{0},', inputs.idle-lanes), ',eval,') && 'success') || needs.eval.result }}","gate":"${{ needs.gate.result }}"}
       required-job-names-json: '["Validation / Gate"]'

package/.github/workflows/validation_self-ci.yml

@@ -22,19 +22,34 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  # One planning job decides everything the orchestrator needs before any
+  # lane starts: the validation tier (with the docs-only downgrade), the idle
+  # lanes, the Security Profile, and the CodeQL language detection. Each used
+  # to queue its own runner in sequence ahead of the real work; on a saturated
+  # runner pool every extra hop costs minutes of queueing for seconds of work.
   mode:
-    name: Mode
-    # The mode classifier is only needed for ready pull requests. Main pushes
-    # use the dedicated default-branch CodeQL lane below; draft updates do not
+    name: Plan
+    # The planner is only needed for ready pull requests. Main pushes use the
+    # dedicated default-branch CodeQL lane below; draft updates do not
     # allocate a validation runner.
     if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request' && github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     timeout-minutes: 10
+    # The scopes of the Mode, Security Profile, and CodeQL Detect jobs this
+    # job replaces: the CodeQL plan reads Code Security status, the pull
+    # request's changed files, and the repository rulesets.
     permissions:
+      actions: read
       contents: read
+      packages: read
+      security-events: write
     outputs:
       mode: ${{ steps.classify.outputs.mode }}
       idle-lanes: ${{ steps.lanes.outputs.idle_lanes }}
+      # Empty unless the tier runs Security or CodeQL and planning succeeded;
+      # an empty plan makes each workflow profile and detect for itself.
+      security-plan: ${{ steps.plan.outputs.security_plan }}
+      codeql-plan: ${{ steps.plan.outputs.codeql_plan }}
     steps:
       # The runtime classifies policy from the consumer repository's config.
       # Keep this checkout before the isolated runtime checkout below.
@@ -68,6 +83,83 @@ jobs:
       - name: Plan lanes
         id: lanes
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation lanes >> "$GITHUB_OUTPUT"
+      # The steps below replace the Security Profile and CodeQL Detect jobs
+      # on the tiers that run those workflows. They mirror those jobs' steps
+      # and fail open: if any of them fails, the plans stay empty and each
+      # workflow runs its own Profile or Detect job, which reports the error.
+      - name: Detect Code Security
+        id: security
+        if: steps.classify.outputs.mode == 'audit' || steps.classify.outputs.mode == 'release'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY_VISIBILITY: ${{ github.event.repository.visibility }}
+        run: |
+          status="disabled"
+          if [ "$REPOSITORY_VISIBILITY" = "public" ]; then
+            status="enabled"
+          else
+            status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
+          fi
+          printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
+      - name: List pull request files
+        id: changed
+        if: steps.classify.outputs.mode == 'audit' || steps.classify.outputs.mode == 'release'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          # Newline-separated changed paths for the runtime's change
+          # detection. A failed listing leaves the file absent and the
+          # runtime fails open toward analyzing every language and shard.
+          gh api "repos/$GITHUB_REPOSITORY/pulls/$PULL_REQUEST_NUMBER/files?per_page=100" \
+            --paginate --jq '.[].filename' > "$RUNNER_TEMP/changed-files.txt" || true
+          echo "file=$RUNNER_TEMP/changed-files.txt" >> "$GITHUB_OUTPUT"
+      - name: Detect code scanning merge gate
+        id: gate
+        if: steps.classify.outputs.mode == 'audit' || steps.classify.outputs.mode == 'release'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # The code-scanning merge gate waits for results in every tracked
+          # category, so change detection must never skip an upload while it
+          # is active. Any ruleset API failure also disables change
+          # detection: full analysis is the safe default.
+          gated=false
+          for id in $(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
+            -q '.[] | select(.enforcement == "active") | .id' 2>/dev/null); do
+            if gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
+              -q 'any(.rules[]?; .type == "code_scanning")' 2>/dev/null | grep -q true; then
+              gated=true
+              break
+            fi
+          done
+          echo "gated=$gated" >> "$GITHUB_OUTPUT"
+      - name: Plan security and CodeQL
+        id: plan
+        if: >-
+          (steps.classify.outputs.mode == 'audit' || steps.classify.outputs.mode == 'release') &&
+          steps.security.outcome == 'success' && steps.changed.outcome == 'success' &&
+          steps.gate.outcome == 'success'
+        continue-on-error: true
+        env:
+          REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+          REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+          REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+          REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
+          REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
+          REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
+          FOUNDRY_EVENT_NAME: ${{ github.event_name }}
+          FOUNDRY_CODEQL_CHANGED_FILES_FILE: ${{ steps.changed.outputs.file }}
+          FOUNDRY_CODEQL_MERGE_GATE: ${{ steps.gate.outputs.gated }}
+        # The runtime computes both plans before writing either, so a failure
+        # never hands the orchestrator half a plan.
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation plan >> "$GITHUB_OUTPUT"
 
   # The stable aggregate check name is the caller job name plus the
   # orchestrator gate job name: "Validation / Gate". Keep both names fixed.
@@ -115,6 +207,8 @@ jobs:
       e2e-shard-list: '1'
       e2e-total-shards: '1'
       idle-lanes: ${{ needs.mode.outputs.idle-lanes }}
+      security-plan: ${{ needs.mode.outputs.security-plan }}
+      codeql-plan: ${{ needs.mode.outputs.codeql-plan }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.53.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.7...v1.53.8) (2026-10-31)
+
+
+### Bug Fixes
+
+* **release:** wait for the synchronize validation run before re-readying ([#829](https://github.com/0xPlayerOne/code-foundry/issues/829)) ([d0abbe2](https://github.com/0xPlayerOne/code-foundry/commit/d0abbe27349635bcc5bb63aafac3ff2e989f960f))
+
+## [1.53.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.6...v1.53.7) (2026-10-31)
+
+
+### Performance
+
+* **validation:** fold Security Profile and CodeQL Detect into the plan job ([#827](https://github.com/0xPlayerOne/code-foundry/issues/827)) ([75ca83c](https://github.com/0xPlayerOne/code-foundry/commit/75ca83c042f01e23a1f3c62b26f92e1bc6641a80))
+
 ## [1.53.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.5...v1.53.6) (2026-10-31)
 
 
@@ -136,23 +150,9 @@
 
 * safely categorize npm publication failures ([#787](https://github.com/0xPlayerOne/code-foundry/issues/787)) ([a4268af](https://github.com/0xPlayerOne/code-foundry/commit/a4268af5ce7cd0a32407420424419c0cad01dce8))
 
-## [1.49.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.0...v1.49.1) (2026-10-28)
-
-
-### Bug Fixes
-
-* handle empty security audit matrices ([#785](https://github.com/0xPlayerOne/code-foundry/issues/785)) ([02f0565](https://github.com/0xPlayerOne/code-foundry/commit/02f05652e68267a2aa2df5d5af8f13df9ba1e3aa))
-
-## [1.49.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.9...v1.49.0) (2026-10-27)
-
-
-### Features
-
-* support isolated integration test shards ([#783](https://github.com/0xPlayerOne/code-foundry/issues/783)) ([ad1123f](https://github.com/0xPlayerOne/code-foundry/commit/ad1123ff3bb9654bfbdaef4219490cca3e7e3d20))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 277 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 279 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -409,7 +409,7 @@ duplicates, empty scopes, and more than eight shards are rejected. Use
 
 Every lane rendered from this configuration (pull-request validation, the
 default-branch scan, the scheduled audit, and merge queues) receives the same
-shard list, and the CodeQL Detect job fails closed when caller workflows drift
+shard list, and CodeQL detection (the caller's Plan job or the CodeQL Detect job) fails closed when caller workflows drift
 apart. Keep them aligned: each shard uploads a SARIF category keyed by a hash
 of the shard scope, GitHub code scanning baselines every category it has seen
 on the default branch, and the code-scanning merge gate waits for results in

package/docs/WORKFLOWS.md

@@ -310,7 +310,8 @@ repositories by failing closed unless every generated check succeeds. An
 empty analysis matrix while analysis is enabled fails the build instead of
 silently skipping every analyzer.
 
-The caller's `Mode` job also plans lanes: it runs the same applicability check
+The caller's `Plan` job (job id `mode`, formerly named `Mode`) classifies the
+validation tier, including the docs-only downgrade, and also plans lanes: it runs the same applicability check
 each lane's Detect step runs and passes the integration, E2E, smoke,
 performance, and eval lanes that have no package script, configured command,
 or test files to the orchestrator as `idle-lanes`. Those jobs are skipped
@@ -320,6 +321,18 @@ The gate counts a planned idle Eval workflow (which reports `skipped`) as the
 no-op success it reported before; any other skip, and every lane with work,
 is still required. Callers that pass no `idle-lanes` run every lane as before.
 
+On the tiers that run Security or CodeQL, the same `Plan` job also runs the
+Security Profile and CodeQL language detection (Code Security status, changed
+files, code-scanning merge gate) and passes their outputs to the orchestrator
+as `security-plan` and `codeql-plan`. The Security workflow then skips its
+`Profile` job and the CodeQL workflow skips its `Detect` job, so audits and
+analyzers start one runner hop earlier. A plan marked idle (no audit or review
+to run, or CodeQL unavailable) skips that workflow, and the gate counts only
+that planned skip as success. Planning fails open: if any planning step fails,
+the plans stay empty and each workflow profiles and detects for itself, as it
+does for callers that pass no plans (the scheduled audit and default-branch
+CodeQL lanes).
+
 ## Security behavior
 
 CodeQL is a separate workflow using GitHub's official actions. The default
@@ -328,9 +341,11 @@ Security availability for private repositories. When CodeQL is unavailable,
 set `codeql: false` and sync: the generated caller selects an orchestrator that
 omits CodeQL entirely, so pull requests do not show a skipped analyzer.
 Dependency Review follows the same capability policy through
-`dependency_review: auto`, but executes as a conditional step inside the
-Security profile job and never registers a separate skipped pull-request
-check. JavaScript, Python, and Rust audits remain available without Advanced
+`dependency_review: auto`, but executes as a conditional step and never
+registers a separate skipped pull-request check: inside the Security profile
+job, or, when the caller planned the profile, as the last step of the first
+dependency audit job. A run with a review but no audit stays unplanned, so the
+profile job still runs the review. JavaScript, Python, and Rust audits remain available without Advanced
 Security. If GitHub default setup is enabled, disable its generated CodeQL
 workflow to avoid duplicate analysis.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.53.6",
+  "version": "1.53.8",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -433,7 +433,10 @@ function synchronize(options) {
         if (!entry.endsWith('.yml') || standard.has(`.github/workflows/${entry}`)) continue
         const destination = join(workflowsDir, entry)
         const original = readFileSync(destination, 'utf8')
-        const updated = original.replace(runtimePin, `$1@${runtimeRef}`)
+        const updated = alignRuntimeRefInputs(
+          original.replace(runtimePin, `$1@${runtimeRef}`),
+          runtimeRepository
+        )
         if (updated !== original) {
           changed.push(`.github/workflows/${entry}`)
           if (dryRun)
@@ -1099,6 +1102,32 @@ export function renderDevChannel(config) {
   )
 }
 
+/**
+ * Keep each preserved job's `runtime-ref:` input on the same plain semver
+ * version as its `uses:` pin of the runtime repository. The reusable
+ * workflows check out the runtime at `runtime-ref`, so a pin refreshed without
+ * its input would run the new workflow against the old runtime. Only plain
+ * semver values move: expressions, branch names, and SHAs are intentional.
+ * @param {string} content @param {string} runtimeRepository
+ */
+export function alignRuntimeRefInputs(content, runtimeRepository) {
+  const pin = new RegExp(
+    `uses:\\s*${escapeRegExp(runtimeRepository)}/\\.github/(?:workflows|actions)/[^\\s@]+@(v\\d+\\.\\d+\\.\\d+)\\s*$`,
+    'm'
+  )
+  return content
+    .split(/(?=^ {2}[A-Za-z0-9_-]+:[ \t]*\r?$)/m)
+    .map((block) => {
+      const version = block.match(pin)?.[1]
+      if (!version) return block
+      return block.replace(
+        /^([ \t]+runtime-ref:[ \t]*)(['"]?)v\d+\.\d+\.\d+\2([ \t]*)$/gm,
+        (_, key, quote, trailing) => `${key}${quote}${version}${quote}${trailing}`
+      )
+    })
+    .join('')
+}
+
 /**
  * Pin consumer runtime refs without retaining the self-CI expression used by
  * the Code Foundry repository. Self callers keep their event-relative refs.

package/src/runtime-core.mjs

@@ -393,6 +393,44 @@ function validation(task) {
     writeOutput('idle_lanes', idle.join(','))
     return
   }
+  if (task === 'plan') {
+    // The caller's planning job already holds the consumer checkout and the
+    // runtime, so it also runs the Security Profile and CodeQL Detect steps
+    // that would otherwise each queue a runner before any audit or analysis
+    // could start. Each plan carries exactly the outputs that job emits, plus
+    // `idle` when the workflow would have nothing to run.
+    const profile = securityProfile()
+    const auditMatrix = JSON.stringify(securityAuditMatrix(profile))
+    const dependencyReview =
+      (process.env.FOUNDRY_EVENT_NAME ?? '') === 'pull_request' &&
+      profile.dependency_review === 'true'
+    const securityPlan = {
+      ...profile,
+      audit_matrix: auditMatrix,
+      idle: auditMatrix === '[]' && !dependencyReview ? 'true' : 'false',
+    }
+    const detection = codeqlDetection()
+    const enabled = detection.enabled === 'true'
+    const codeqlPlan = {
+      ...detection,
+      matrix: enabled
+        ? JSON.stringify(
+            codeqlAnalysisMatrix(JSON.parse(detection.languages), configuredRustShards())
+          )
+        : '[]',
+      code_security: process.env.REPO_FOUNDRY_CODE_SECURITY ?? '',
+      idle: enabled ? 'false' : 'true',
+    }
+    // Dependency Review rides on the first audit job of a planned run. With
+    // no audit to ride on, leave Security unplanned so its Profile job runs
+    // the review as it always has, rather than adding a job of its own.
+    writeOutput(
+      'security_plan',
+      auditMatrix === '[]' && dependencyReview ? '' : JSON.stringify(securityPlan)
+    )
+    writeOutput('codeql_plan', JSON.stringify(codeqlPlan))
+    return
+  }
   if (task === 'gate') {
     const mode = process.env.FOUNDRY_MODE ?? ''
     const gate = evaluateValidationGate({
@@ -940,24 +978,56 @@ function readFileSafe(file) {
   }
 }
 
+/**
+ * The Security workflow's Profile outputs, as the strings the job emits.
+ * @returns {Record<string, string>}
+ */
+function securityProfile() {
+  const python = hasDependencyManifest('python')
+  const requirements = capture('git', ['ls-files', '*requirements*.txt'])
+    .split('\n')
+    .filter(Boolean)
+  return {
+    javascript: hasDependencyManifest('javascript') ? 'true' : 'false',
+    rust: hasDependencyManifest('rust') ? 'true' : 'false',
+    python: python ? 'true' : 'false',
+    python_requirements: JSON.stringify(
+      python ? (requirements.length ? requirements : ['project']) : ['none']
+    ),
+    dependency_review: featureEnabled('dependency_review') ? 'true' : 'false',
+  }
+}
+
+/**
+ * The dependency audit matrix built from a profile: the same entries the
+ * Security workflow's "Build audit matrix" step emits.
+ * @param {Record<string, string>} profile
+ */
+function securityAuditMatrix(profile) {
+  /** @type {Array<Record<string, string>>} */
+  const entries = []
+  if (profile.javascript === 'true') entries.push({ display: 'JavaScript', language: 'javascript' })
+  if (profile.rust === 'true') entries.push({ display: 'Rust', language: 'rust' })
+  if (profile.python === 'true') {
+    /** @type {unknown} */
+    let requirements = []
+    try {
+      requirements = JSON.parse(profile.python_requirements || '[]')
+    } catch {
+      requirements = []
+    }
+    for (const requirement of Array.isArray(requirements) ? requirements : []) {
+      if (!requirement || requirement === 'none') continue
+      entries.push({ display: `Python / ${requirement}`, language: 'python', requirement })
+    }
+  }
+  return entries
+}
+
 /** @param {string} task @param {string} ecosystem */
 function security(task, ecosystem) {
   if (task === 'profile') {
-    writeOutput('javascript', hasDependencyManifest('javascript') ? 'true' : 'false')
-    writeOutput('rust', hasDependencyManifest('rust') ? 'true' : 'false')
-    writeOutput('python', hasDependencyManifest('python') ? 'true' : 'false')
-    const requirements = capture('git', ['ls-files', '*requirements*.txt'])
-      .split('\n')
-      .filter(Boolean)
-    writeOutput(
-      'python_requirements',
-      hasDependencyManifest('python')
-        ? requirements.length
-          ? requirements
-          : ['project']
-        : ['none']
-    )
-    writeOutput('dependency_review', featureEnabled('dependency_review') ? 'true' : 'false')
+    for (const [key, value] of Object.entries(securityProfile())) writeOutput(key, value)
     return
   }
   if (task === 'should_run') {
@@ -1082,18 +1152,28 @@ function assertRustShardsAligned() {
 }
 
 function codeql() {
+  for (const [key, value] of Object.entries(codeqlDetection())) writeOutput(key, value)
+}
+
+/**
+ * The CodeQL workflow's "Detect languages" outputs, as the strings the step
+ * emits, in the order it emits them.
+ * @returns {Record<string, string>}
+ */
+function codeqlDetection() {
   const enabled =
     featureEnabled('codeql') &&
     (isPublicRepository() || process.env.REPO_FOUNDRY_CODE_SECURITY === 'enabled')
-  writeOutput('enabled', enabled ? 'true' : 'false')
+  /** @type {Record<string, string>} */
+  const outputs = { enabled: enabled ? 'true' : 'false' }
   if (!enabled) {
-    writeOutput('languages', [])
+    outputs.languages = '[]'
     for (const language of ['actions', 'javascript', 'python', 'rust']) {
-      writeOutput(`${language}_available`, 'false')
-      writeOutput(`${language}_changed`, 'false')
-      writeOutput(`${language}_build_mode`, 'none')
+      outputs[`${language}_available`] = 'false'
+      outputs[`${language}_changed`] = 'false'
+      outputs[`${language}_build_mode`] = 'none'
     }
-    return
+    return outputs
   }
   // Detect lane drift before any analysis uploads a category the other lanes
   // never produce; a stall surfaces only later as a blocked merge gate.
@@ -1129,14 +1209,55 @@ function codeql() {
     rustEntry.shards = shards
     rustEntry.changed = shards.some((entry) => entry.changed)
   }
-  writeOutput('languages', languagesJson)
+  outputs.languages = JSON.stringify(languagesJson)
   for (const language of ['actions', 'javascript-typescript', 'python', 'rust']) {
     const entry = languagesJson.find((item) => item.language === language)
     const prefix = language === 'javascript-typescript' ? 'javascript' : language
-    writeOutput(`${prefix}_available`, entry ? 'true' : 'false')
-    writeOutput(`${prefix}_changed`, entry?.changed ? 'true' : 'false')
-    writeOutput(`${prefix}_build_mode`, entry?.['build-mode'] ?? 'none')
+    outputs[`${prefix}_available`] = entry ? 'true' : 'false'
+    outputs[`${prefix}_changed`] = entry?.changed ? 'true' : 'false'
+    outputs[`${prefix}_build_mode`] = entry?.['build-mode'] ?? 'none'
+  }
+  return outputs
+}
+
+/**
+ * The CodeQL analysis matrix: the same entries the CodeQL workflow's "Build
+ * analysis matrix" step emits from detection. SARIF categories are the
+ * code-scanning baseline keys and must stay byte-identical to that step's.
+ * @param {CodeqlLanguageEntry[]} detected @param {string[]} shards
+ */
+function codeqlAnalysisMatrix(detected, shards) {
+  /** @type {Record<string, string>} */
+  const display = { actions: 'Actions', 'javascript-typescript': 'TypeScript', python: 'Python' }
+  /** @type {Array<Record<string, string | boolean>>} */
+  const matrix = detected
+    .filter((entry) => entry.language !== 'rust')
+    .map((entry) => ({
+      display: display[entry.language] || entry.language,
+      language: entry.language,
+      category: `/language:${entry.language}`,
+      build_mode: entry['build-mode'] || 'none',
+      changed: entry.changed === true,
+    }))
+  const rust = detected.find((entry) => entry.language === 'rust')
+  const rustShards =
+    rust && Array.isArray(rust.shards) && rust.shards.length
+      ? rust.shards
+      : rust
+        ? shards.map((shard) => ({ shard: String(shard), changed: rust.changed === true }))
+        : []
+  for (const entry of rustShards) {
+    matrix.push({
+      display: entry.shard === 'all' ? 'Rust' : `Rust (${entry.shard})`,
+      language: 'rust',
+      category: '/language:rust',
+      build_mode: 'none',
+      changed: entry.changed === true,
+      shard: String(entry.shard),
+    })
   }
+  if (!matrix.length) throw new Error('CodeQL analysis matrix is empty while analysis is enabled.')
+  return matrix
 }
 
 /**