code-foundry 1.9.2 → 1.9.4

package/.github/workflows/draft-pr.yml

@@ -80,9 +80,8 @@ jobs:
           cat > "$BODY_FILE" <<EOF
           CI PR created automatically by this workflow.
 
-          This PR is ready for review once required validation passes. If the
-          configured automation token is rejected, it is intentionally opened
-          as a draft for manual readiness.
+          This PR is intentionally opened as a draft. Mark it ready for review
+          when the proposed change is ready to start required validation.
 
           **CI Status:** Pending — this workflow triggered on push to $BRANCH.
           EOF
@@ -94,6 +93,7 @@ jobs:
             --field head="$BRANCH"
             --field title="$PR_TITLE"
             --field body="@$BODY_FILE"
+            --field draft=true
           )
 
           CREATED=false
@@ -102,9 +102,7 @@ jobs:
           fi
 
           if [ "$CREATED" != true ]; then
-            DRAFT_ARGS=("${CREATE_ARGS[@]}" --field draft=true)
-            if GH_TOKEN="$GITHUB_TOKEN" gh api "${DRAFT_ARGS[@]}" > /dev/null 2> "$ERROR_FILE"; then
-              echo "::notice title=Manual PR readiness required::The configured automation token was absent or rejected; this PR was opened as a draft with the short-lived workflow token."
+            if GH_TOKEN="$GITHUB_TOKEN" gh api "${CREATE_ARGS[@]}" > /dev/null 2> "$ERROR_FILE"; then
               CREATED=true
             fi
           fi
@@ -113,3 +111,4 @@ jobs:
             echo "::error title=Draft PR creation failed::Both the configured automation token and the workflow token failed to create the pull request."
             exit 1
           fi
+          echo "::notice title=Manual PR readiness required::The automated pull request was opened as a draft. Mark it ready for review to start validation."

package/.github/workflows/opencode-security_self-ci.yml

@@ -3,6 +3,12 @@ name: Code Foundry
 on:
   pull_request:
     branches: [main, staging]
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+      - converted_to_draft
   workflow_dispatch:
 
 permissions:
@@ -14,7 +20,8 @@ jobs:
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
       (github.event_name == 'workflow_dispatch' ||
-      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
+      (github.event.pull_request.draft == false &&
+      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')))
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}

package/.github/workflows/release-pr.yml

@@ -249,9 +249,9 @@ jobs:
           # Creation uses authenticated REST (gh api POST) rather than
           # `gh pr create`, which issues a GraphQL mutation that
           # NiftyLeague's long-lived fine-grained token policy rejects. The
-          # REST payload keeps the exact base/head/title/body fields, adds
-          # draft=true only when no automation token is configured, and stays
-          # fail-closed through the create-race fallback below.
+          # REST payload keeps the exact base/head/title/body fields, always
+          # opens the automated promotion as a draft, and stays fail-closed
+          # through the create-race fallback below.
           CREATE_ARGS=(
             "repos/${GITHUB_REPOSITORY}/pulls"
             --method POST
@@ -259,11 +259,9 @@ jobs:
             --field head="$PROMOTION_BRANCH"
             --field title="chore(main): promote staging to main ($DATE)"
             --field body=@"$BODY_FILE"
+            --field draft=true
           )
-          if [ "$HAS_AUTOMATION_TOKEN" != true ]; then
-            CREATE_ARGS+=(--field draft=true)
-            echo "::notice title=Manual PR readiness required::Created draft promotion PR because no automation token is configured. Configure CODE_FOUNDRY_TOKEN, or mark this PR ready manually to trigger validation."
-          fi
+          echo "::notice title=Manual PR readiness required::Created a draft promotion PR. Mark it ready for review to start validation."
 
           # Prefer the configured automation token for the write, but
           # NiftyLeague rejects long-lived fine-grained tokens with HTTP 403

package/.github/workflows/security.yml

@@ -123,6 +123,12 @@ jobs:
           }
           fs.appendFileSync(env.GITHUB_OUTPUT, "audit_matrix=" + JSON.stringify(entries) + "\n");
           '
+      - name: Dependency Review
+        if: ${{ github.event_name == 'pull_request' && steps.profile.outputs.dependency_review == 'true' }}
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
+        with:
+          fail-on-severity: high
+          license-check: true
 
   # Audits run only for detected languages: the audit matrix is built from the
   # profile, so repositories never see skipped checks for ecosystems they do
@@ -370,16 +376,3 @@ jobs:
       - name: Audit Python dependencies
         if: matrix.entry.language == 'python'
         run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit python
-
-  dependency-review:
-    name: Dependency Review
-    needs: profile
-    if: ${{ vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request' && needs.profile.outputs.dependency_review == 'true' }}
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    steps:
-      - name: Review
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
-        with:
-          fail-on-severity: high
-          license-check: true

package/.github/workflows/validation-no-codeql.yml

@@ -0,0 +1,165 @@
+name: Code Foundry Validation (CodeQL unavailable)
+
+on:
+  workflow_call:
+    inputs:
+      mode:
+        description: Validation tier (fast, audit, or release).
+        required: true
+        type: string
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: false
+        type: string
+        default: 0xPlayerOne/code-foundry
+      runtime-ref:
+        description: Code Foundry runtime tag or ref.
+        required: false
+        type: string
+        default: v1.0.5
+      ci-runner:
+        description: Runner used by CI jobs.
+        required: false
+        type: string
+        default: ubuntu-latest
+      test-runner:
+        description: Runner used by non-unit test jobs.
+        required: false
+        type: string
+        default: ubuntu-latest
+      unit-runner:
+        description: Runner used by unit tests.
+        required: false
+        type: string
+        default: ubuntu-slim
+      performance-runner:
+        description: Runner used by deterministic performance regression checks.
+        required: false
+        type: string
+        default: ubuntu-latest
+      security-runner:
+        description: Runner used by Security jobs.
+        required: false
+        type: string
+        default: ubuntu-slim
+      codeql-runner:
+        description: Runner used by CodeQL jobs.
+        required: false
+        type: string
+        default: ubuntu-latest
+      rust-shards:
+        description: JSON array of Rust scope sharding values. Use ["all"] for single-pass behavior.
+        required: false
+        type: string
+        default: '["all"]'
+      rust-threads:
+        description: Threads used for Rust extraction and analysis. Values above 1 opt into local parallelism.
+        required: false
+        type: string
+        default: '1'
+      rust-max-parallel:
+        description: Maximum Rust shard jobs allowed to run concurrently.
+        required: false
+        type: number
+        default: 1
+    secrets:
+      TURBO_TOKEN:
+        required: false
+      NEXTAUTH_SECRET:
+        required: false
+
+# The orchestrator keeps the union of permissions needed by the chain it calls
+# (CodeQL uploads require security-events: write). Nested reusable workflows
+# can only maintain or reduce permissions, never elevate them.
+permissions:
+  actions: read
+  contents: read
+  packages: read
+  security-events: write
+
+jobs:
+  ci:
+    name: CI
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    uses: ./.github/workflows/ci.yml
+    with:
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      runner: ${{ inputs.ci-runner }}
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
+
+  test:
+    name: Test
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    uses: ./.github/workflows/test.yml
+    with:
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      runner: ${{ inputs.test-runner }}
+      unit-runner: ${{ inputs.unit-runner }}
+      performance-runner: ${{ inputs.performance-runner }}
+      unit-only: ${{ inputs.mode == 'fast' }}
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+
+  security:
+    name: Security
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    uses: ./.github/workflows/security.yml
+    with:
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      runner: ${{ inputs.security-runner }}
+
+  # Aggregate check: "Validation / Gate" (caller job name + this job name).
+  # Always evaluates; only jobs required for the mode must have succeeded.
+  # The release tier runs no suite jobs: its policy (generated release diff
+  # validation) executes as a conditional step below, so no separate
+  # release-policy job renders skipped checks on ordinary pull requests.
+  gate:
+    name: Gate
+    needs: [ci, test, security]
+    if: vars.CI_BILLING_PAUSED != 'true' && always()
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    env:
+      FOUNDRY_MODE: ${{ inputs.mode }}
+      FOUNDRY_CI: ${{ needs.ci.result }}
+      FOUNDRY_TEST: ${{ needs.test.result }}
+      FOUNDRY_SECURITY: ${{ needs.security.result }}
+      # This workflow is selected only for repositories whose canonical
+      # configuration explicitly disables unavailable CodeQL. Treat that
+      # policy decision as satisfied without registering a skipped PR check.
+      FOUNDRY_CODEQL: success
+    steps:
+      - name: Checkout runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            src/lib
+            src/runtime.mjs
+      - name: Install runtime
+        run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+      - name: Checkout consumer repository
+        if: ${{ inputs.mode == 'release' }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          filter: blob:none
+      - name: Validate generated release diff
+        if: ${{ inputs.mode == 'release' }}
+        env:
+          FOUNDRY_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          FOUNDRY_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          FOUNDRY_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          FOUNDRY_REPOSITORY: ${{ github.repository }}
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation release_diff
+      - name: Evaluate aggregate gate
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation gate

package/.github/workflows/validation_self-ci.yml

@@ -8,6 +8,7 @@ on:
       - synchronize
       - reopened
       - ready_for_review
+      - converted_to_draft
 
 # Default every caller job to no repository permissions. Individual jobs grant
 # only the scopes their own validation path consumes.
@@ -21,7 +22,10 @@ concurrency:
 jobs:
   mode:
     name: Mode
-    if: vars.CI_BILLING_PAUSED != 'true'
+    # Draft updates still create a lightweight skipped workflow record so a
+    # converted-to-draft event can cancel in-flight validation, but no runner
+    # or reusable validation workflow starts until the PR is ready for review.
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     timeout-minutes: 10
     permissions:
@@ -60,7 +64,7 @@ jobs:
   validation:
     name: Validation
     needs: mode
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event.pull_request.draft == false
     # Reusable workflows can only maintain or reduce the caller job's scopes.
     # The audit tier needs security-events: write for CodeQL uploads.
     permissions:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.9.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.3...v1.9.4) (2026-09-08)
+
+
+### Bug Fixes
+
+* **doctor:** accept no-CodeQL validation callers ([#509](https://github.com/0xPlayerOne/code-foundry/issues/509)) ([f447de8](https://github.com/0xPlayerOne/code-foundry/commit/f447de81b8f2e7e59ab6fdbd6b1939635286e2a9))
+
+## [1.9.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.2...v1.9.3) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** suppress unavailable and draft checks ([#507](https://github.com/0xPlayerOne/code-foundry/issues/507)) ([e0b313a](https://github.com/0xPlayerOne/code-foundry/commit/e0b313ad1e4601ccd14066fb97a4f547400a6eaa))
+
 ## [1.9.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.1...v1.9.2) (2026-09-08)
 
 

package/README.md

@@ -74,8 +74,13 @@ The standard workflow triggers are:
 - Pull requests targeting `main` (and `staging` in the staging-release topology).
 - Draft PR automation for supported feature/fix branches.
 
-Jobs are language-aware and skip irrelevant setup while remaining visible as
-successful required checks. TypeScript uses Oxlint, Oxfmt, and Bun's native
+Automated feature/fix and staging-promotion pull requests open as drafts.
+Pull-request validation waits until a PR is marked ready for review; later
+commits retrigger it, and converting the PR back to draft cancels in-flight
+validation. Scheduled and manually dispatched audits are unaffected.
+
+Jobs are language-aware and skip irrelevant setup inside the applicable
+aggregate checks. TypeScript uses Oxlint, Oxfmt, and Bun's native
 test runner (repositories using another linter or formatter keep full control
 through their own `lint`/`format` scripts, which the runtime honors).
 Rust uses `rustfmt`, Clippy with warnings as errors, and native
@@ -85,7 +90,10 @@ tests. Solidity projects retain their native toolchain and test runner.
 CodeQL remains separate from CI and Security. With the default `codeql: auto`
 and `dependency_review: auto` policies, public repositories use the free GitHub
 security checks while private repositories skip them unless explicitly opted
-in and supported by GitHub Advanced Security. JavaScript, Python, and Rust
+in and supported by GitHub Advanced Security. Set an unavailable private-repo
+capability to `false` during sync to omit its CodeQL job from pull requests;
+Dependency Review runs as a conditional Security step and does not register a
+separate skipped check. JavaScript, Python, and Rust
 audits remain available without Advanced Security. Code Foundry does not enable
 GitHub Code Quality or other paid GitHub features.
 

package/docs/WORKFLOWS.md

@@ -12,6 +12,11 @@ pull_request:
   # direct topology: branches: [main]
 ```
 
+The generated caller suppresses runner and reusable-workflow jobs while the
+pull request is a draft. It listens for `ready_for_review` to start validation,
+for later `synchronize` events to rerun it, and for `converted_to_draft` to
+cancel in-flight validation through the caller's concurrency group.
+
 The separate `validation-audit.yml` caller is pinned to the configured released
 runtime and handles scheduled and manual audits:
 
@@ -29,8 +34,9 @@ results satisfiable for the release commit). In the
 `direct` topology (the default) every pull request targets `main` and runs the
 full audit tier, because there is no integration branch for a fast pass.
 Scheduled and manual runs select the audit tier in both topologies. Draft PR
-automation separately listens to supported topic-branch pushes, promotion
-automation listens to `staging` pushes (staging-release only), and release
+automation separately listens to supported topic-branch pushes and always
+opens those PRs as drafts. Promotion automation listens to `staging` pushes
+(staging-release only) and also always opens its PR as a draft. Release
 automation listens to `main` pushes.
 Custom deployment, indexing, search, Slither, or other workflows are
 repository-owned extensions and should keep their own triggers and permissions.
@@ -204,8 +210,7 @@ validation gate. Land changes through the standard `direct` or
   test/security workflows.
 
 Jobs detect applicability before installing tools. Per-language CodeQL and
-security-audit jobs are generated from detection, so empty language surfaces
-produce no checks at all instead of skipped rows; the aggregate
+security-audit jobs are generated from detection; the aggregate
 `Validation / Gate` keeps branch protection unambiguous for mixed-language
 repositories by failing closed unless every generated check succeeds. An
 empty analysis matrix while analysis is enabled fails the build instead of
@@ -214,12 +219,16 @@ silently skipping every analyzer.
 ## Security behavior
 
 CodeQL is a separate workflow using GitHub's official actions. The default
-`codeql: auto` policy enables it for public repositories and skips it for
-private repositories unless explicitly enabled and Advanced Security is
-available. Dependency Review follows the same policy through
-`dependency_review: auto`; JavaScript, Python, and Rust audits remain
-available without Advanced Security. If GitHub default setup is enabled,
-disable its generated CodeQL workflow to avoid duplicate analysis.
+`codeql: auto` policy enables it for public repositories and detects Advanced
+Security availability for private repositories. When CodeQL is unavailable,
+set `codeql: false` and sync: the generated caller selects an orchestrator that
+omits CodeQL entirely, so pull requests do not show a skipped analyzer.
+Dependency Review follows the same capability policy through
+`dependency_review: auto`, but executes as a conditional step inside the
+Security profile job and never registers a separate skipped pull-request
+check. JavaScript, Python, and Rust audits remain available without Advanced
+Security. If GitHub default setup is enabled, disable its generated CodeQL
+workflow to avoid duplicate analysis.
 
 Code Foundry does not enable GitHub Code Quality or any paid GitHub feature.
 The repository's format and lint jobs are ordinary CI checks. Set `codeql:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -153,7 +153,7 @@ export function doctor(root, options = {}) {
       )
     }
     if (
-      !/uses:\s+(?:\.\/\.github\/workflows\/validation\.yml|\S+\/\.github\/workflows\/validation\.yml@)/.test(
+      !/uses:\s+(?:\.\/\.github\/workflows\/validation(?:-no-codeql)?\.yml|\S+\/\.github\/workflows\/validation(?:-no-codeql)?\.yml@)/.test(
         caller
       )
     ) {

package/src/commands/sync.mjs

@@ -500,6 +500,15 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   const localPrefix = 'uses: ./.github/workflows/'
   const remotePrefix = `uses: ${repository}/.github/workflows/`
   let rendered = content.replaceAll(localPrefix, remotePrefix)
+  // An explicitly unavailable CodeQL capability selects an orchestrator that
+  // omits the job entirely, so GitHub does not register a misleading skipped
+  // check on every pull request. `auto` retains runtime capability detection.
+  if (configured(config.codeql, 'auto') === 'false') {
+    rendered = rendered.replaceAll(
+      `${remotePrefix}validation.yml`,
+      `${remotePrefix}validation-no-codeql.yml`
+    )
+  }
   rendered = rendered.replace(
     new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'),
     `$&@${ref}`