code-foundry 1.9.0 → 1.9.2

package/.github/CONTRIBUTING.md

@@ -1,5 +1,7 @@
 # Contributing
 
+<!-- code-foundry-managed: config-aware-policy -->
+
 This guide is the operating contract for humans and automation contributing to this repository.
 
 It applies to TypeScript, Rust, Python, and mixed-language projects using this template.

package/.github/SECURITY.md

@@ -1,5 +1,7 @@
 # Security Policy
 
+<!-- code-foundry-managed: config-aware-policy -->
+
 ## Supported Versions
 
 The latest commit on `staging` receives security patches. Patches are promoted to `main` through the next release cycle.

package/.github/workflows/validation_self-ci.yml

@@ -73,7 +73,7 @@ jobs:
       mode: ${{ needs.mode.outputs.mode }}
       runtime-repository: 0xPlayerOne/code-foundry
       # Pull requests validate the proposed runtime commit. Scheduled and
-      # manually dispatched audits are isolated in validation_audit_self-ci.yml
+      # manually dispatched audits use a separate default-branch-pinned caller,
       # so this caller-selected ref never runs with default-branch cache access.
       runtime-ref: ${{ github.sha }}
       ci-runner: ubuntu-latest

package/AGENTS.md

@@ -1,5 +1,7 @@
 # Agent Instructions
 
+<!-- code-foundry-managed: config-aware-policy -->
+
 These instructions are the repository-level operating contract for coding agents, including Hermes, OpenCode, and other automation.
 
 They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.md` files and project documentation take precedence for their directory.

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.9.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.1...v1.9.2) (2026-09-08)
+
+
+### Bug Fixes
+
+* **sync:** refresh config-aware policies ([#505](https://github.com/0xPlayerOne/code-foundry/issues/505)) ([466150d](https://github.com/0xPlayerOne/code-foundry/commit/466150dcf263187e9cb08be2a2c2fe7ff67ef060))
+
+## [1.9.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.0...v1.9.1) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** restore protected consumer audits ([#503](https://github.com/0xPlayerOne/code-foundry/issues/503)) ([d045cc4](https://github.com/0xPlayerOne/code-foundry/commit/d045cc4a5543d2096e4d6f33c5e74aa40604c887))
+
 ## [1.9.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.8.0...v1.9.0) (2026-09-08)
 
 

package/README.md

@@ -35,8 +35,8 @@ contract. For normal updates, edit that file and run `npx code-foundry sync`.
 
 ## What it installs
 
-- Short workflow callers for CI, Test, Security, CodeQL, Draft PR, Release PR,
-  and Release.
+- Short workflow callers for pull-request validation, protected scheduled/manual
+  audits, Draft PR, Release PR, and Release.
 - A deterministic performance lane with ordered command support, stable result
   artifacts, and an optional shared Node package budget profile.
 - A small `.githooks/pre-commit` launcher with language-aware formatting and

package/docs/WORKFLOWS.md

@@ -2,13 +2,20 @@
 
 ## Standard triggers
 
-The canonical validation caller uses pull requests plus bounded audit entry
-points; it does not run the same suites again on branch pushes:
+Validation uses two callers so pull-request code and default-branch-capable
+audit events never share a caller-selected runtime ref. The canonical
+`validation.yml` caller handles pull requests only:
 
 ```yaml
 pull_request:
   branches: [main, staging] # staging-release topology
   # direct topology: branches: [main]
+```
+
+The separate `validation-audit.yml` caller is pinned to the configured released
+runtime and handles scheduled and manual audits:
+
+```yaml
 schedule:
   - cron: '31 6 * * 1'
 workflow_dispatch:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -42,6 +42,7 @@ const standardFiles = [
   '.github/ISSUE_TEMPLATE/config.yml',
   '.github/ISSUE_TEMPLATE/feature_request.yml',
   '.github/workflows/validation.yml',
+  '.github/workflows/validation-audit.yml',
   '.github/workflows/draft-pr.yml',
   '.github/workflows/release-pr.yml',
   '.github/workflows/release.yml',
@@ -64,6 +65,12 @@ const protectedFiles = new Set([
   'NOTICE',
 ])
 
+const configAwarePolicyFiles = new Set([
+  'AGENTS.md',
+  '.github/CONTRIBUTING.md',
+  '.github/SECURITY.md',
+])
+
 /** @type {Record<string, string>} */
 const licenseFiles = {
   'gpl-3.0-or-later': 'GPL-3.0-or-later.txt',
@@ -205,7 +212,7 @@ export function syncRepository(options) {
     const destination = join(target, file)
     if (!force && protectedFiles.has(file) && existsSync(destination)) {
       const existing = readFileSync(destination, 'utf8')
-      if (!isLegacyManagedDoc(file, existing)) continue
+      if (!isLegacyManagedDoc(file, existing) && !isManagedConfigPolicy(file, existing)) continue
     }
     if (
       (file === 'LICENSE' || file === 'NOTICE') &&
@@ -457,7 +464,7 @@ function shouldInclude(file, languages, features, config) {
   if (workflow === 'release-pr' && !isStagingRelease(config.git_workflow)) return false
   // The tiered validation caller supersedes the legacy ci/test/security/codeql
   // event callers, so legacy feature names keep selecting it.
-  if (workflow === 'validation') {
+  if (workflow === 'validation' || workflow === 'validation-audit') {
     return (
       includesValue(features, 'validation') ||
       LEGACY_GENERATED_CALLERS.some((legacy) => includesValue(features, legacy))
@@ -473,6 +480,9 @@ function sourcePath(source, file) {
     return existsSync(rootTemplate) ? rootTemplate : join(source, 'src/templates/gitignore')
   }
   if (file.startsWith('.github/workflows/')) {
+    if (file === '.github/workflows/validation-audit.yml') {
+      return join(source, 'src/templates/workflows/validation-audit.yml')
+    }
     const name = file.slice('.github/workflows/'.length, -4)
     return join(source, '.github/workflows', `${name}_self-ci.yml`)
   }
@@ -535,7 +545,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   if (workflow === 'test' && config.unit_runner) {
     rendered = rendered.replace(/^(\s+unit-runner:)\s+.*$/m, `$1 ${config.unit_runner}`)
   }
-  if (workflow === 'validation') {
+  if (workflow === 'validation' || workflow === 'validation-audit') {
     // The mode classifier is a normal runner job in the caller rather than a
     // reusable-workflow input. Keep it on the configured default runner so
     // consumers that cannot use ubuntu-slim do not fail before validation.
@@ -782,7 +792,10 @@ export function isGeneratedEventCaller(content, stem, runtimeRepository) {
   const text = Buffer.isBuffer(content) ? content.toString('utf8') : String(content)
   if (!/^name:\s*Code Foundry\s*$/m.test(text)) return false
   if (/^\s*(runs-on|steps):/m.test(text)) return false
-  if (!text.includes('runtime-repository:')) return false
+  // Older generated staging-promotion callers predate the explicit runtime
+  // repository input. They are still safe to identify structurally by their
+  // single reusable-workflow job so direct-topology syncs can remove them.
+  if (stem !== 'release-pr' && !text.includes('runtime-repository:')) return false
   if (!new RegExp(`^  ${stem}:`, 'm').test(text)) return false
   return new RegExp(
     `uses:\\s*${escapeRegExp(runtimeRepository)}/\\.github/workflows/${stem}\\.yml@`
@@ -1048,6 +1061,44 @@ function isLegacyManagedDoc(file, content) {
   return false
 }
 
+/**
+ * Config-aware policy documents are generated contracts: a normal sync must
+ * refresh them after branch-topology or validation-policy edits. The marker
+ * owns future copies. Exact scaffold signatures migrate older generated
+ * copies without treating arbitrary repository documentation as managed.
+ * @param {string} file
+ * @param {string} content
+ */
+function isManagedConfigPolicy(file, content) {
+  if (!configAwarePolicyFiles.has(file)) return false
+  if (content.includes('<!-- code-foundry-managed: config-aware-policy -->')) return true
+  if (file === 'AGENTS.md') {
+    return (
+      content.startsWith('# Agent Instructions\n') &&
+      content.includes(
+        'These instructions are the repository-level operating contract for coding agents'
+      ) &&
+      content.includes('They complement `CONTRIBUTING.md`.')
+    )
+  }
+  if (file === '.github/CONTRIBUTING.md') {
+    return (
+      content.startsWith('# Contributing\n') &&
+      content.includes(
+        'This guide is the operating contract for humans and automation contributing to this repository.'
+      ) &&
+      content.includes('[Agent contract](#agent-operating-contract)')
+    )
+  }
+  return (
+    content.startsWith('# Security Policy\n') &&
+    content.includes('## Reporting a Vulnerability') &&
+    content.includes(
+      'This policy covers the code, configuration, dependencies, workflows, and generated artifacts maintained in this repository.'
+    )
+  )
+}
+
 /** @param {string} target @param {string[]} args */
 function git(target, args) {
   spawnSync('git', args, { cwd: target, stdio: 'ignore' })

package/src/templates/workflows/validation-audit.yml

@@ -0,0 +1,43 @@
+name: Code Foundry Audit
+
+on:
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: code-foundry-audit-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  # Default-branch-capable events use an immutable released runtime for both
+  # reusable workflow code and runtime code. They never accept a caller-
+  # controlled runtime ref and cannot execute pull-request code with access to
+  # the protected default-branch cache.
+  validation:
+    name: Validation
+    if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: ./.github/workflows/validation.yml
+    with:
+      mode: audit
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: main
+      ci-runner: ubuntu-latest
+      test-runner: ubuntu-latest
+      unit-runner: ubuntu-slim
+      performance-runner: ubuntu-latest
+      security-runner: ubuntu-slim
+      codeql-runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}