code-foundry 1.6.0 → 1.6.1

package/.github/CONTRIBUTING.md

@@ -163,7 +163,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |
 | Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |
 
-The single validation caller keys concurrency by event and pull-request head. A newer update to the same pull request cancels its superseded validation run; scheduled and manual audits remain independent. The mode-aware orchestrator fans out only the jobs required by that event and always concludes with the stable aggregate gate.
+Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Both callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 

package/.github/workflows/validation_audit_self-ci.yml

@@ -0,0 +1,43 @@
+name: Code Foundry Audit
+
+on:
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: code-foundry-audit-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  # Default-branch-capable events must not call the local reusable workflow:
+  # a pull request could otherwise change that workflow and feed an untrusted
+  # runtime ref into steps that can populate the protected branch cache. Use
+  # the protected default branch for both workflow code and runtime code.
+  validation:
+    name: Validation
+    if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: 0xPlayerOne/code-foundry/.github/workflows/validation.yml@main
+    with:
+      mode: audit
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: main
+      ci-runner: ubuntu-latest
+      test-runner: ubuntu-latest
+      unit-runner: ubuntu-slim
+      performance-runner: ubuntu-latest
+      security-runner: ubuntu-slim
+      codeql-runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}

package/.github/workflows/validation_self-ci.yml

@@ -8,16 +8,12 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  schedule:
-    - cron: '31 6 * * 1'
-  workflow_dispatch:
 
 # Default every caller job to no repository permissions. Individual jobs grant
 # only the scopes their own validation path consumes.
 permissions: {}
 
-# Superseded PR updates cancel the previous run; schedule and dispatch runs
-# are keyed by event so periodic audits and manual runs stay independent.
+# Superseded PR updates cancel the previous run.
 concurrency:
   group: code-foundry-validation-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
@@ -77,9 +73,9 @@ jobs:
       mode: ${{ needs.mode.outputs.mode }}
       runtime-repository: 0xPlayerOne/code-foundry
       # Pull requests validate the proposed runtime commit. Scheduled and
-      # manually dispatched audits stay on the protected default branch so a
-      # selected branch cannot supply privileged runtime code.
-      runtime-ref: ${{ github.event_name == 'pull_request' && github.sha || 'main' }}
+      # manually dispatched audits are isolated in validation_audit_self-ci.yml
+      # so this caller-selected ref never runs with default-branch cache access.
+      runtime-ref: ${{ github.sha }}
       ci-runner: ubuntu-latest
       test-runner: ubuntu-latest
       unit-runner: ubuntu-slim

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.6.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.6.0...v1.6.1) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** isolate default-branch security audits ([5ea0914](https://github.com/0xPlayerOne/code-foundry/commit/5ea09146af9995f16d1ab4e9a73f14a13582da36))
+
 ## [1.6.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.5.4...v1.6.0) (2026-09-08)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {