code-foundry 1.53.7 → 1.53.9

package/.github/workflows/codeql.yml

@@ -39,8 +39,10 @@ on:
         description: >-
           JSON object of the Detect job's outputs, computed by the caller's
           planning job (`validation plan`). When set, Detect is skipped and
-          analysis reads the plan instead, saving one runner hop. Empty runs
-          Detect here as before.
+          analysis reads the plan instead, saving one runner hop. Without a
+          code-scanning merge gate the planned matrix omits unchanged
+          languages and Rust shards. Empty runs Detect here as before, with
+          the full matrix.
         required: false
         type: string
         default: ''
@@ -160,17 +162,29 @@ jobs:
           set -euo pipefail
           # The code-scanning merge gate waits for results in every tracked
           # category, so change detection must never skip an upload while it
-          # is active. Any ruleset API failure also disables change
-          # detection: full analysis is the safe default.
+          # is active. Any ruleset API failure counts as an active gate: full
+          # analysis is the safe default, and the planner drops unchanged
+          # analyzers only on a positive "no gate" answer.
           gated=false
-          for id in $(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
-            -q '.[] | select(.enforcement == "active") | .id' 2>/dev/null); do
-            if gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
-              -q 'any(.rules[]?; .type == "code_scanning")' 2>/dev/null | grep -q true; then
-              gated=true
-              break
-            fi
-          done
+          if ! ids="$(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
+            -q '.[] | select(.enforcement == "active") | .id')"; then
+            echo "Ruleset listing failed; treating the code-scanning merge gate as active."
+            gated=true
+          else
+            for id in $ids; do
+              if ! rule="$(gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
+                -q 'any(.rules[]?; .type == "code_scanning")')"; then
+                echo "Ruleset $id lookup failed; treating the code-scanning merge gate as active."
+                gated=true
+                break
+              fi
+              if [ "$rule" = "true" ]; then
+                gated=true
+                break
+              fi
+            done
+          fi
+          echo "Code-scanning merge gate active: $gated"
           echo "gated=$gated" >> "$GITHUB_OUTPUT"
       - id: languages
         name: Detect languages

package/.github/workflows/release.yml

@@ -554,56 +554,77 @@ jobs:
                   # A ready head already receives synchronize validation. Preserve
                   # its live/completed owner instead of cancelling and reallocating
                   # CI every time another queued main release run prepares it.
-                  runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
-                    "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
-                    -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
-                  validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
-                    --arg repo "$GITHUB_REPOSITORY" '
-                    def active: .status == "queued" or .status == "in_progress" or
-                      .status == "waiting" or .status == "pending" or .status == "requested";
-                    def valid_run:
-                      type == "object" and
-                      (.id | type == "number" and . > 0 and floor == .) and
-                      (.run_attempt | type == "number" and . >= 1 and floor == .) and
-                      (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
-                      (.head_branch | type == "string" and length > 0) and
-                      (.event | type == "string" and length > 0) and
-                      (.repository | type == "object") and
-                      (.repository.full_name | type == "string" and length > 0) and
-                      (.path | type == "string" and length > 0) and
-                      ((active and has("conclusion") and .conclusion == null) or
-                       (.status == "completed" and
-                        (.conclusion == "success" or .conclusion == "failure" or
-                         .conclusion == "timed_out" or .conclusion == "action_required" or
-                         .conclusion == "cancelled" or .conclusion == "skipped" or
-                         .conclusion == "neutral")));
-                    if (.workflow_runs | type) != "array" or
-                       (.total_count | type) != "number" then
-                      error("Invalid validation owner response")
-                    elif .total_count != (.workflow_runs | length) then
-                      error("Incomplete validation owner response")
-                    elif any(.workflow_runs[]; valid_run | not) then
-                      error("Invalid validation run identity or state")
-                    else
-                      [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
-                        .head_sha == $head and .head_branch == $branch and
-                        .event == "pull_request" and .repository.full_name == $repo and
-                        ($workflow == ".github/workflows/validation.yml" or
-                         $workflow == ".github/workflows/validation_self-ci.yml")
-                      )] | sort_by(.id) | last |
-                      if . == null then "missing"
-                      elif active or (.status == "completed" and .conclusion == "success") then "owned"
-                      elif .status == "completed" and
-                           (.conclusion == "failure" or .conclusion == "timed_out" or
-                            .conclusion == "action_required") then "failed"
-                      elif .status == "completed" and
-                           (.conclusion == "cancelled" or .conclusion == "skipped" or
-                            .conclusion == "neutral") then "missing"
-                      else error("Unconfirmed validation owner state") end
-                    end' <<< "$runs")
-                  fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
-                    --json isDraft,headRefOid,headRefName \
-                    --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                  #
+                  # GitHub registers the synchronize run for a head this job (or
+                  # Release Please) just pushed a few seconds after the push. An
+                  # absent owner is therefore polled for a bounded window before the
+                  # canonical transition, so the transition does not cancel that
+                  # run. A cancelled, skipped or neutral owner is already terminal
+                  # and transitions at once; after the window an absent owner
+                  # still gets the explicit transition, and a failed one still fails.
+                  owner_poll=1
+                  while :; do
+                    runs=$(GH_TOKEN="$VALIDATION_TOKEN" gh api \
+                      "repos/$GITHUB_REPOSITORY/actions/runs" --method GET \
+                      -f event=pull_request -f head_sha="$PR_HEAD" -f per_page=100)
+                    validation=$(jq -er --arg head "$PR_HEAD" --arg branch "$PR_BRANCH" \
+                      --arg repo "$GITHUB_REPOSITORY" '
+                      def active: .status == "queued" or .status == "in_progress" or
+                        .status == "waiting" or .status == "pending" or .status == "requested";
+                      def valid_run:
+                        type == "object" and
+                        (.id | type == "number" and . > 0 and floor == .) and
+                        (.run_attempt | type == "number" and . >= 1 and floor == .) and
+                        (.head_sha | type == "string" and test("^[a-f0-9]{40}$")) and
+                        (.head_branch | type == "string" and length > 0) and
+                        (.event | type == "string" and length > 0) and
+                        (.repository | type == "object") and
+                        (.repository.full_name | type == "string" and length > 0) and
+                        (.path | type == "string" and length > 0) and
+                        ((active and has("conclusion") and .conclusion == null) or
+                         (.status == "completed" and
+                          (.conclusion == "success" or .conclusion == "failure" or
+                           .conclusion == "timed_out" or .conclusion == "action_required" or
+                           .conclusion == "cancelled" or .conclusion == "skipped" or
+                           .conclusion == "neutral")));
+                      if (.workflow_runs | type) != "array" or
+                         (.total_count | type) != "number" then
+                        error("Invalid validation owner response")
+                      elif .total_count != (.workflow_runs | length) then
+                        error("Incomplete validation owner response")
+                      elif any(.workflow_runs[]; valid_run | not) then
+                        error("Invalid validation run identity or state")
+                      else
+                        [.workflow_runs[] | (.path | split("@")[0]) as $workflow | select(
+                          .head_sha == $head and .head_branch == $branch and
+                          .event == "pull_request" and .repository.full_name == $repo and
+                          ($workflow == ".github/workflows/validation.yml" or
+                           $workflow == ".github/workflows/validation_self-ci.yml")
+                        )] | sort_by(.id) | last |
+                        if . == null then "absent"
+                        elif active or (.status == "completed" and .conclusion == "success") then "owned"
+                        elif .status == "completed" and
+                             (.conclusion == "failure" or .conclusion == "timed_out" or
+                              .conclusion == "action_required") then "failed"
+                        elif .status == "completed" and
+                             (.conclusion == "cancelled" or .conclusion == "skipped" or
+                              .conclusion == "neutral") then "missing"
+                        else error("Unconfirmed validation owner state") end
+                      end' <<< "$runs")
+                    fresh_state=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" \
+                      --json isDraft,headRefOid,headRefName \
+                      --jq '[.isDraft, .headRefOid, .headRefName] | @tsv')
+                    if [ "$fresh_state" != "$pr_state" ] || [ "$validation" != absent ] ||
+                      [ "$owner_poll" -ge 7 ]; then
+                      break
+                    fi
+                    echo "Release PR #$pr has no current-head validation yet (lookup $owner_poll of 7); waiting for its synchronize run to register."
+                    owner_poll=$((owner_poll + 1))
+                    sleep 5
+                  done
+                  if [ "$validation" = absent ]; then
+                    validation=missing
+                  fi
                   if [ "$fresh_state" != "$pr_state" ]; then
                     if [ "$state_attempt" -eq 3 ]; then
                       echo 'Release PR state did not stabilize during validation lookup; refusing readiness mutation.' >&2

package/.github/workflows/validation-billing.yml

@@ -135,8 +135,9 @@ on:
         description: >-
           JSON CodeQL Detect outputs from the caller's planning job. When set,
           the CodeQL workflow skips its Detect job and reads the plan, and a
-          plan marked idle (CodeQL unavailable) skips the workflow. Empty
-          detects inside the workflow as before.
+          plan marked idle (CodeQL unavailable, or no analyzed language or
+          Rust shard changed) skips the workflow. Empty detects inside the
+          workflow as before.
         required: false
         type: string
         default: ''

package/.github/workflows/validation.yml

@@ -113,8 +113,9 @@ on:
         description: >-
           JSON CodeQL Detect outputs from the caller's planning job. When set,
           the CodeQL workflow skips its Detect job and reads the plan, and a
-          plan marked idle (CodeQL unavailable) skips the workflow. Empty
-          detects inside the workflow as before.
+          plan marked idle (CodeQL unavailable, or no analyzed language or
+          Rust shard changed) skips the workflow. Empty detects inside the
+          workflow as before.
         required: false
         type: string
         default: ''

package/.github/workflows/validation_self-ci.yml

@@ -127,17 +127,29 @@ jobs:
           set -euo pipefail
           # The code-scanning merge gate waits for results in every tracked
           # category, so change detection must never skip an upload while it
-          # is active. Any ruleset API failure also disables change
-          # detection: full analysis is the safe default.
+          # is active. Any ruleset API failure counts as an active gate: full
+          # analysis is the safe default, and the planner drops unchanged
+          # analyzers only on a positive "no gate" answer.
           gated=false
-          for id in $(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
-            -q '.[] | select(.enforcement == "active") | .id' 2>/dev/null); do
-            if gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
-              -q 'any(.rules[]?; .type == "code_scanning")' 2>/dev/null | grep -q true; then
-              gated=true
-              break
-            fi
-          done
+          if ! ids="$(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
+            -q '.[] | select(.enforcement == "active") | .id')"; then
+            echo "Ruleset listing failed; treating the code-scanning merge gate as active."
+            gated=true
+          else
+            for id in $ids; do
+              if ! rule="$(gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
+                -q 'any(.rules[]?; .type == "code_scanning")')"; then
+                echo "Ruleset $id lookup failed; treating the code-scanning merge gate as active."
+                gated=true
+                break
+              fi
+              if [ "$rule" = "true" ]; then
+                gated=true
+                break
+              fi
+            done
+          fi
+          echo "Code-scanning merge gate active: $gated"
           echo "gated=$gated" >> "$GITHUB_OUTPUT"
       - name: Plan security and CodeQL
         id: plan

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.53.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.8...v1.53.9) (2026-10-31)
+
+
+### Performance
+
+* **codeql:** drop unchanged analyzers from the planned matrix ([#831](https://github.com/0xPlayerOne/code-foundry/issues/831)) ([35b891e](https://github.com/0xPlayerOne/code-foundry/commit/35b891e721ea2e5d2bd09ec44509b541120a3a64))
+
+## [1.53.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.7...v1.53.8) (2026-10-31)
+
+
+### Bug Fixes
+
+* **release:** wait for the synchronize validation run before re-readying ([#829](https://github.com/0xPlayerOne/code-foundry/issues/829)) ([d0abbe2](https://github.com/0xPlayerOne/code-foundry/commit/d0abbe27349635bcc5bb63aafac3ff2e989f960f))
+
 ## [1.53.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.6...v1.53.7) (2026-10-31)
 
 
@@ -136,23 +150,9 @@
 
 * **validation:** require release checks until evidence exists ([#789](https://github.com/0xPlayerOne/code-foundry/issues/789)) ([a5f8be6](https://github.com/0xPlayerOne/code-foundry/commit/a5f8be64b7b28d2248aa71b80e321aa0fe82f30a))
 
-## [1.49.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.1...v1.49.2) (2026-10-29)
-
-
-### Bug Fixes
-
-* safely categorize npm publication failures ([#787](https://github.com/0xPlayerOne/code-foundry/issues/787)) ([a4268af](https://github.com/0xPlayerOne/code-foundry/commit/a4268af5ce7cd0a32407420424419c0cad01dce8))
-
-## [1.49.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.0...v1.49.1) (2026-10-28)
-
-
-### Bug Fixes
-
-* handle empty security audit matrices ([#785](https://github.com/0xPlayerOne/code-foundry/issues/785)) ([02f0565](https://github.com/0xPlayerOne/code-foundry/commit/02f05652e68267a2aa2df5d5af8f13df9ba1e3aa))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 278 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 280 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -427,8 +427,14 @@ every tracked category. Two practical consequences:
 
 On pull requests without a code-scanning merge gate, analyzers run only for
 languages with changed files, and Rust shards run only when their scope (or a
-workspace-wide `Cargo` manifest or toolchain file) changed; unchanged matrix
-entries report `Not applicable` instead of analyzing. Repositories whose
+workspace-wide `Cargo` manifest or toolchain file) changed. The caller's
+`Plan` job drops unchanged languages and shards from the analysis matrix, so
+they take no runner and register no `Analyze` check; when nothing changed, the
+whole CodeQL workflow is a planned idle skip that the gate counts as success.
+Entries are dropped only when the planner positively found no merge gate; a
+failed ruleset lookup counts as an active gate, and any other planning failure
+leaves the workflow to detect for itself, where unchanged entries still report
+`Not applicable` on their own runner. Repositories whose
 rulesets enforce a code-scanning requirement are detected automatically and
 analyze everything, because that merge gate waits for results in every tracked
 category. Push, schedule, and merge-queue events always analyze the complete

package/docs/WORKFLOWS.md

@@ -326,9 +326,13 @@ Security Profile and CodeQL language detection (Code Security status, changed
 files, code-scanning merge gate) and passes their outputs to the orchestrator
 as `security-plan` and `codeql-plan`. The Security workflow then skips its
 `Profile` job and the CodeQL workflow skips its `Detect` job, so audits and
-analyzers start one runner hop earlier. A plan marked idle (no audit or review
-to run, or CodeQL unavailable) skips that workflow, and the gate counts only
-that planned skip as success. Planning fails open: if any planning step fails,
+analyzers start one runner hop earlier. Without a code-scanning merge gate,
+the CodeQL plan also drops the languages and Rust shards that change detection
+marked unchanged, so they no longer take a runner only to print `Not
+applicable`; `Analyze` checks are not required checks, so no required check
+name changes. A plan marked idle (no audit or review to run, CodeQL
+unavailable, or no analyzed language or shard changed) skips that workflow,
+and the gate counts only that planned skip as success. Planning fails open: if any planning step fails,
 the plans stay empty and each workflow profiles and detects for itself, as it
 does for callers that pass no plans (the scheduled audit and default-branch
 CodeQL lanes).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.53.7",
+  "version": "1.53.9",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/runtime-core.mjs

@@ -411,15 +411,18 @@ function validation(task) {
     }
     const detection = codeqlDetection()
     const enabled = detection.enabled === 'true'
+    const matrix = enabled
+      ? plannedCodeqlMatrix(
+          codeqlAnalysisMatrix(JSON.parse(detection.languages), configuredRustShards())
+        )
+      : []
     const codeqlPlan = {
       ...detection,
-      matrix: enabled
-        ? JSON.stringify(
-            codeqlAnalysisMatrix(JSON.parse(detection.languages), configuredRustShards())
-          )
-        : '[]',
+      matrix: JSON.stringify(matrix),
       code_security: process.env.REPO_FOUNDRY_CODE_SECURITY ?? '',
-      idle: enabled ? 'false' : 'true',
+      // Idle when CodeQL is unavailable, or when change detection left no
+      // entry to analyze: the gate counts that planned skip as success.
+      idle: matrix.length ? 'false' : 'true',
     }
     // Dependency Review rides on the first audit job of a planned run. With
     // no audit to ride on, leave Security unplanned so its Profile job runs
@@ -1260,6 +1263,24 @@ function codeqlAnalysisMatrix(detected, shards) {
   return matrix
 }
 
+/**
+ * The planned CodeQL analysis matrix: the full matrix minus entries (whole
+ * languages or single Rust shards) that change detection marked unchanged.
+ * Such an entry would only take a runner to print "Not applicable": it
+ * uploads nothing either way. Entries are dropped only when the planner
+ * positively found no code-scanning merge gate (`FOUNDRY_CODEQL_MERGE_GATE`
+ * is exactly `false`); an active gate waits on every tracked category, and
+ * an unknown gate state keeps the full matrix. Analyze check names are not
+ * required checks ("Validation / Gate" is), so dropping entries never changes
+ * a required check. An empty result means nothing changed and the caller
+ * marks the plan idle.
+ * @param {Array<Record<string, string | boolean>>} matrix
+ */
+function plannedCodeqlMatrix(matrix) {
+  if ((process.env.FOUNDRY_CODEQL_MERGE_GATE ?? '') !== 'false') return matrix
+  return matrix.filter((entry) => entry.changed === true)
+}
+
 /**
  * Changed file paths for the current pull request, read from the list the
  * caller materializes with the pull request files API. Returns null when