code-foundry 1.53.8 → 1.53.9

package/.github/workflows/codeql.yml

@@ -39,8 +39,10 @@ on:
         description: >-
           JSON object of the Detect job's outputs, computed by the caller's
           planning job (`validation plan`). When set, Detect is skipped and
-          analysis reads the plan instead, saving one runner hop. Empty runs
-          Detect here as before.
+          analysis reads the plan instead, saving one runner hop. Without a
+          code-scanning merge gate the planned matrix omits unchanged
+          languages and Rust shards. Empty runs Detect here as before, with
+          the full matrix.
         required: false
         type: string
         default: ''
@@ -160,17 +162,29 @@ jobs:
           set -euo pipefail
           # The code-scanning merge gate waits for results in every tracked
           # category, so change detection must never skip an upload while it
-          # is active. Any ruleset API failure also disables change
-          # detection: full analysis is the safe default.
+          # is active. Any ruleset API failure counts as an active gate: full
+          # analysis is the safe default, and the planner drops unchanged
+          # analyzers only on a positive "no gate" answer.
           gated=false
-          for id in $(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
-            -q '.[] | select(.enforcement == "active") | .id' 2>/dev/null); do
-            if gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
-              -q 'any(.rules[]?; .type == "code_scanning")' 2>/dev/null | grep -q true; then
-              gated=true
-              break
-            fi
-          done
+          if ! ids="$(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
+            -q '.[] | select(.enforcement == "active") | .id')"; then
+            echo "Ruleset listing failed; treating the code-scanning merge gate as active."
+            gated=true
+          else
+            for id in $ids; do
+              if ! rule="$(gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
+                -q 'any(.rules[]?; .type == "code_scanning")')"; then
+                echo "Ruleset $id lookup failed; treating the code-scanning merge gate as active."
+                gated=true
+                break
+              fi
+              if [ "$rule" = "true" ]; then
+                gated=true
+                break
+              fi
+            done
+          fi
+          echo "Code-scanning merge gate active: $gated"
           echo "gated=$gated" >> "$GITHUB_OUTPUT"
       - id: languages
         name: Detect languages

package/.github/workflows/validation-billing.yml

@@ -135,8 +135,9 @@ on:
         description: >-
           JSON CodeQL Detect outputs from the caller's planning job. When set,
           the CodeQL workflow skips its Detect job and reads the plan, and a
-          plan marked idle (CodeQL unavailable) skips the workflow. Empty
-          detects inside the workflow as before.
+          plan marked idle (CodeQL unavailable, or no analyzed language or
+          Rust shard changed) skips the workflow. Empty detects inside the
+          workflow as before.
         required: false
         type: string
         default: ''

package/.github/workflows/validation.yml

@@ -113,8 +113,9 @@ on:
         description: >-
           JSON CodeQL Detect outputs from the caller's planning job. When set,
           the CodeQL workflow skips its Detect job and reads the plan, and a
-          plan marked idle (CodeQL unavailable) skips the workflow. Empty
-          detects inside the workflow as before.
+          plan marked idle (CodeQL unavailable, or no analyzed language or
+          Rust shard changed) skips the workflow. Empty detects inside the
+          workflow as before.
         required: false
         type: string
         default: ''

package/.github/workflows/validation_self-ci.yml

@@ -127,17 +127,29 @@ jobs:
           set -euo pipefail
           # The code-scanning merge gate waits for results in every tracked
           # category, so change detection must never skip an upload while it
-          # is active. Any ruleset API failure also disables change
-          # detection: full analysis is the safe default.
+          # is active. Any ruleset API failure counts as an active gate: full
+          # analysis is the safe default, and the planner drops unchanged
+          # analyzers only on a positive "no gate" answer.
           gated=false
-          for id in $(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
-            -q '.[] | select(.enforcement == "active") | .id' 2>/dev/null); do
-            if gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
-              -q 'any(.rules[]?; .type == "code_scanning")' 2>/dev/null | grep -q true; then
-              gated=true
-              break
-            fi
-          done
+          if ! ids="$(gh api "repos/$GITHUB_REPOSITORY/rulesets" --paginate \
+            -q '.[] | select(.enforcement == "active") | .id')"; then
+            echo "Ruleset listing failed; treating the code-scanning merge gate as active."
+            gated=true
+          else
+            for id in $ids; do
+              if ! rule="$(gh api "repos/$GITHUB_REPOSITORY/rulesets/$id" \
+                -q 'any(.rules[]?; .type == "code_scanning")')"; then
+                echo "Ruleset $id lookup failed; treating the code-scanning merge gate as active."
+                gated=true
+                break
+              fi
+              if [ "$rule" = "true" ]; then
+                gated=true
+                break
+              fi
+            done
+          fi
+          echo "Code-scanning merge gate active: $gated"
           echo "gated=$gated" >> "$GITHUB_OUTPUT"
       - name: Plan security and CodeQL
         id: plan

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.53.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.8...v1.53.9) (2026-10-31)
+
+
+### Performance
+
+* **codeql:** drop unchanged analyzers from the planned matrix ([#831](https://github.com/0xPlayerOne/code-foundry/issues/831)) ([35b891e](https://github.com/0xPlayerOne/code-foundry/commit/35b891e721ea2e5d2bd09ec44509b541120a3a64))
+
 ## [1.53.8](https://github.com/0xPlayerOne/code-foundry/compare/v1.53.7...v1.53.8) (2026-10-31)
 
 
@@ -143,16 +150,9 @@
 
 * **validation:** require release checks until evidence exists ([#789](https://github.com/0xPlayerOne/code-foundry/issues/789)) ([a5f8be6](https://github.com/0xPlayerOne/code-foundry/commit/a5f8be64b7b28d2248aa71b80e321aa0fe82f30a))
 
-## [1.49.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.1...v1.49.2) (2026-10-29)
-
-
-### Bug Fixes
-
-* safely categorize npm publication failures ([#787](https://github.com/0xPlayerOne/code-foundry/issues/787)) ([a4268af](https://github.com/0xPlayerOne/code-foundry/commit/a4268af5ce7cd0a32407420424419c0cad01dce8))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 279 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 280 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -427,8 +427,14 @@ every tracked category. Two practical consequences:
 
 On pull requests without a code-scanning merge gate, analyzers run only for
 languages with changed files, and Rust shards run only when their scope (or a
-workspace-wide `Cargo` manifest or toolchain file) changed; unchanged matrix
-entries report `Not applicable` instead of analyzing. Repositories whose
+workspace-wide `Cargo` manifest or toolchain file) changed. The caller's
+`Plan` job drops unchanged languages and shards from the analysis matrix, so
+they take no runner and register no `Analyze` check; when nothing changed, the
+whole CodeQL workflow is a planned idle skip that the gate counts as success.
+Entries are dropped only when the planner positively found no merge gate; a
+failed ruleset lookup counts as an active gate, and any other planning failure
+leaves the workflow to detect for itself, where unchanged entries still report
+`Not applicable` on their own runner. Repositories whose
 rulesets enforce a code-scanning requirement are detected automatically and
 analyze everything, because that merge gate waits for results in every tracked
 category. Push, schedule, and merge-queue events always analyze the complete

package/docs/WORKFLOWS.md

@@ -326,9 +326,13 @@ Security Profile and CodeQL language detection (Code Security status, changed
 files, code-scanning merge gate) and passes their outputs to the orchestrator
 as `security-plan` and `codeql-plan`. The Security workflow then skips its
 `Profile` job and the CodeQL workflow skips its `Detect` job, so audits and
-analyzers start one runner hop earlier. A plan marked idle (no audit or review
-to run, or CodeQL unavailable) skips that workflow, and the gate counts only
-that planned skip as success. Planning fails open: if any planning step fails,
+analyzers start one runner hop earlier. Without a code-scanning merge gate,
+the CodeQL plan also drops the languages and Rust shards that change detection
+marked unchanged, so they no longer take a runner only to print `Not
+applicable`; `Analyze` checks are not required checks, so no required check
+name changes. A plan marked idle (no audit or review to run, CodeQL
+unavailable, or no analyzed language or shard changed) skips that workflow,
+and the gate counts only that planned skip as success. Planning fails open: if any planning step fails,
 the plans stay empty and each workflow profiles and detects for itself, as it
 does for callers that pass no plans (the scheduled audit and default-branch
 CodeQL lanes).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.53.8",
+  "version": "1.53.9",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/runtime-core.mjs

@@ -411,15 +411,18 @@ function validation(task) {
     }
     const detection = codeqlDetection()
     const enabled = detection.enabled === 'true'
+    const matrix = enabled
+      ? plannedCodeqlMatrix(
+          codeqlAnalysisMatrix(JSON.parse(detection.languages), configuredRustShards())
+        )
+      : []
     const codeqlPlan = {
       ...detection,
-      matrix: enabled
-        ? JSON.stringify(
-            codeqlAnalysisMatrix(JSON.parse(detection.languages), configuredRustShards())
-          )
-        : '[]',
+      matrix: JSON.stringify(matrix),
       code_security: process.env.REPO_FOUNDRY_CODE_SECURITY ?? '',
-      idle: enabled ? 'false' : 'true',
+      // Idle when CodeQL is unavailable, or when change detection left no
+      // entry to analyze: the gate counts that planned skip as success.
+      idle: matrix.length ? 'false' : 'true',
     }
     // Dependency Review rides on the first audit job of a planned run. With
     // no audit to ride on, leave Security unplanned so its Profile job runs
@@ -1260,6 +1263,24 @@ function codeqlAnalysisMatrix(detected, shards) {
   return matrix
 }
 
+/**
+ * The planned CodeQL analysis matrix: the full matrix minus entries (whole
+ * languages or single Rust shards) that change detection marked unchanged.
+ * Such an entry would only take a runner to print "Not applicable": it
+ * uploads nothing either way. Entries are dropped only when the planner
+ * positively found no code-scanning merge gate (`FOUNDRY_CODEQL_MERGE_GATE`
+ * is exactly `false`); an active gate waits on every tracked category, and
+ * an unknown gate state keeps the full matrix. Analyze check names are not
+ * required checks ("Validation / Gate" is), so dropping entries never changes
+ * a required check. An empty result means nothing changed and the caller
+ * marks the plan idle.
+ * @param {Array<Record<string, string | boolean>>} matrix
+ */
+function plannedCodeqlMatrix(matrix) {
+  if ((process.env.FOUNDRY_CODEQL_MERGE_GATE ?? '') !== 'false') return matrix
+  return matrix.filter((entry) => entry.changed === true)
+}
+
 /**
  * Changed file paths for the current pull request, read from the list the
  * caller materializes with the pull request files API. Returns null when