code-foundry 1.9.10 → 1.9.12

package/.github/workflows/validation-no-codeql.yml

@@ -80,7 +80,7 @@ permissions:
 jobs:
   ci:
     name: CI
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -92,7 +92,7 @@ jobs:
 
   test:
     name: Test
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -106,7 +106,7 @@ jobs:
 
   security:
     name: Security
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -115,8 +115,8 @@ jobs:
 
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
-  # The release tier runs no suite jobs: its policy (generated release diff
-  # validation) executes as a conditional step below, so no separate
+  # The release tier runs the available CI/test/security suite. Its generated
+  # release diff policy executes as a conditional step below, so no separate
   # release-policy job renders skipped checks on ordinary pull requests.
   gate:
     name: Gate

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.9.12](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.11...v1.9.12) (2026-09-08)
+
+
+### Bug Fixes
+
+* **validation:** run available suites for no-CodeQL releases ([805c470](https://github.com/0xPlayerOne/code-foundry/commit/805c470f188ccfe7410bc9b2f02022d50c68f321))
+
+## [1.9.11](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.10...v1.9.11) (2026-09-08)
+
+
+### Bug Fixes
+
+* **doctor:** support nested Rust crates ([#525](https://github.com/0xPlayerOne/code-foundry/issues/525)) ([0ffc87d](https://github.com/0xPlayerOne/code-foundry/commit/0ffc87d71c5e8069a26814dea2250e93a3e87416))
+
 ## [1.9.10](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.9...v1.9.10) (2026-09-08)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.10",
+  "version": "1.9.12",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
@@ -80,11 +80,16 @@ export function doctor(root, options = {}) {
   if (profile.languages.split(',').includes('rust') && !commandExists('cargo'))
     error('Cargo is required for this repository')
   if (profile.languages.split(',').includes('rust')) {
-    const metadata = spawnSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], {
-      cwd: target,
-      stdio: 'ignore',
-    })
-    if (metadata.status !== 0) error('cargo metadata failed')
+    const manifests = rustManifestPaths(target)
+    if (!manifests.length) error('no Cargo.toml was found for the configured Rust language')
+    for (const manifest of manifests) {
+      const metadata = spawnSync(
+        'cargo',
+        ['metadata', '--manifest-path', manifest, '--no-deps', '--format-version', '1'],
+        { cwd: target, stdio: 'ignore' }
+      )
+      if (metadata.status !== 0) error(`cargo metadata failed for ${manifest}`)
+    }
   }
   if (
     profile.languages.split(',').includes('python') &&
@@ -229,6 +234,45 @@ export function doctor(root, options = {}) {
   console.log('Repository doctor passed.')
 }
 
+const ignoredRustDirectories = new Set([
+  '.git',
+  '.code-foundry',
+  '.mise',
+  '.next',
+  '.nuxt',
+  '.venv',
+  'node_modules',
+  'target',
+  'vendor',
+])
+
+/**
+ * Return repository-relative Cargo manifests that represent owned Rust code.
+ * A root workspace is authoritative; otherwise validate each nested crate while
+ * excluding dependency/build trees that CodeQL shards should not treat as owned.
+ * @param {string} root
+ * @returns {string[]}
+ */
+export function rustManifestPaths(root) {
+  if (existsSync(join(root, 'Cargo.toml'))) return ['Cargo.toml']
+  /** @type {string[]} */
+  const manifests = []
+  /** @param {string} directory @param {string} relative */
+  function visit(directory, relative) {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isDirectory() && ignoredRustDirectories.has(entry.name)) continue
+      const childRelative = relative ? join(relative, entry.name) : entry.name
+      const child = join(directory, entry.name)
+      if (entry.isDirectory()) visit(child, childRelative)
+      else if (entry.name === 'Cargo.toml') manifests.push(childRelative)
+    }
+  }
+  visit(root, '')
+  // Sorting a fresh local collection is deterministic and cannot mutate caller-owned state.
+  // oxlint-disable-next-line unicorn/no-array-sort
+  return manifests.sort()
+}
+
 /** @param {string} root @param {string[]} args */
 function git(root, args) {
   return spawnSync('git', args, { cwd: root, encoding: 'utf8' }).stdout?.trim() ?? ''