code-foundry 1.9.0 → 1.9.1

package/.github/workflows/validation_self-ci.yml

@@ -73,7 +73,7 @@ jobs:
       mode: ${{ needs.mode.outputs.mode }}
       runtime-repository: 0xPlayerOne/code-foundry
       # Pull requests validate the proposed runtime commit. Scheduled and
-      # manually dispatched audits are isolated in validation_audit_self-ci.yml
+      # manually dispatched audits use a separate default-branch-pinned caller,
       # so this caller-selected ref never runs with default-branch cache access.
       runtime-ref: ${{ github.sha }}
       ci-runner: ubuntu-latest

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.9.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.0...v1.9.1) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** restore protected consumer audits ([#503](https://github.com/0xPlayerOne/code-foundry/issues/503)) ([d045cc4](https://github.com/0xPlayerOne/code-foundry/commit/d045cc4a5543d2096e4d6f33c5e74aa40604c887))
+
 ## [1.9.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.8.0...v1.9.0) (2026-09-08)
 
 

package/README.md

@@ -35,8 +35,8 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
 
 ## What it installs
 
-- Short workflow callers for CI, Test, Security, CodeQL, Draft PR, Release PR,
-  and Release.
+- Short workflow callers for pull-request validation, protected scheduled/manual
+  audits, Draft PR, Release PR, and Release.
 - A deterministic performance lane with ordered command support, stable result
   artifacts, and an optional shared Node package budget profile.
 - A small `.githooks/pre-commit` launcher with language-aware formatting and

package/docs/WORKFLOWS.md

@@ -2,13 +2,20 @@
 
 ## Standard triggers
 
-The canonical validation caller uses pull requests plus bounded audit entry
-points; it does not run the same suites again on branch pushes:
+Validation uses two callers so pull-request code and default-branch-capable
+audit events never share a caller-selected runtime ref. The canonical
+`validation.yml` caller handles pull requests only:
 
 ```yaml
 pull_request:
   branches: [main, staging] # staging-release topology
   # direct topology: branches: [main]
+```
+
+The separate `validation-audit.yml` caller is pinned to the configured released
+runtime and handles scheduled and manual audits:
+
+```yaml
 schedule:
   - cron: '31 6 * * 1'
 workflow_dispatch:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -42,6 +42,7 @@ const standardFiles = [
   '.github/ISSUE_TEMPLATE/config.yml',
   '.github/ISSUE_TEMPLATE/feature_request.yml',
   '.github/workflows/validation.yml',
+  '.github/workflows/validation-audit.yml',
   '.github/workflows/draft-pr.yml',
   '.github/workflows/release-pr.yml',
   '.github/workflows/release.yml',
@@ -473,6 +474,9 @@ function sourcePath(source, file) {
     return existsSync(rootTemplate) ? rootTemplate : join(source, 'src/templates/gitignore')
   }
   if (file.startsWith('.github/workflows/')) {
+    if (file === '.github/workflows/validation-audit.yml') {
+      return join(source, 'src/templates/workflows/validation-audit.yml')
+    }
     const name = file.slice('.github/workflows/'.length, -4)
     return join(source, '.github/workflows', `${name}_self-ci.yml`)
   }
@@ -535,7 +539,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   if (workflow === 'test' && config.unit_runner) {
     rendered = rendered.replace(/^(\s+unit-runner:)\s+.*$/m, `$1 ${config.unit_runner}`)
   }
-  if (workflow === 'validation') {
+  if (workflow === 'validation' || workflow === 'validation-audit') {
     // The mode classifier is a normal runner job in the caller rather than a
     // reusable-workflow input. Keep it on the configured default runner so
     // consumers that cannot use ubuntu-slim do not fail before validation.

package/src/templates/workflows/validation-audit.yml

@@ -0,0 +1,43 @@
+name: Code Foundry Audit
+
+on:
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: code-foundry-audit-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  # Default-branch-capable events use an immutable released runtime for both
+  # reusable workflow code and runtime code. They never accept a caller-
+  # controlled runtime ref and cannot execute pull-request code with access to
+  # the protected default-branch cache.
+  validation:
+    name: Validation
+    if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: ./.github/workflows/validation.yml
+    with:
+      mode: audit
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: main
+      ci-runner: ubuntu-latest
+      test-runner: ubuntu-latest
+      unit-runner: ubuntu-slim
+      performance-runner: ubuntu-latest
+      security-runner: ubuntu-slim
+      codeql-runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}