code-foundry 1.9.5 → 1.9.7

package/.github/CONTRIBUTING.md

@@ -19,7 +19,7 @@ Agents must follow these rules before changing code:
 1. Read this file, `AGENTS.md`, and the relevant project documentation.
 2. Inspect the current branch, worktree, remotes, and existing changes before editing.
 3. Preserve user-owned changes. Never discard or overwrite unrelated work.
-4. Branch from `staging` and target pull requests at `staging`; do not work directly on `main`.
+4. Branch from `main` and target pull requests at `main`; do not push directly to `main`.
 5. Keep the change focused. Do not expand scope without documenting why.
 6. Run the applicable format, lint, type-check, build, unit, performance, integration, E2E, smoke, and security checks.
 7. Report exact validation results, skipped checks, known limitations, and remaining risks.
@@ -35,22 +35,20 @@ Agents must not:
 ## Branching model
 
 ```text
-                                      release PR
-                                   ┌──────────────┐
-                                   │              ▼
-feat/*  fix/*  chore/*  ──PR──▶  staging  ──PR──▶  main
-docs/*  test/*  refactor/*         │              │
-                                   │              └── protected release branch
-                                   └── integration branch
+                              release PR
+                           ┌──────────────┐
+                           │              ▼
+feat/*  fix/*  chore/*  ──PR──▶  main
+docs/*  test/*  refactor/*         │
+                                   └── protected release branch
 ```
 
-| Branch                                                         | Purpose                  | Contribution rule                                                         |
-| -------------------------------------------------------------- | ------------------------ | ------------------------------------------------------------------------- |
-| `main`                                                         | Protected release branch | Merge through the `staging` → `main` release PR. No direct pushes.        |
-| `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
-| `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
+| Branch                                                         | Purpose                  | Contribution rule                                      |
+| -------------------------------------------------------------- | ------------------------ | ------------------------------------------------------ |
+| `main`                                                         | Protected release branch | Merge through pull requests only. No direct pushes.    |
+| `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `main`; keep changes small and reviewable. |
 
-The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.
+The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. This repository has one protected integration and release branch: `main`.
 
 ## Before you start
 
@@ -67,8 +65,8 @@ The Git workflow is `staging-release`: topic branches **squash** into `staging`,
 ```sh
 git status --short --branch
 git fetch origin
-git switch staging
-git pull --ff-only origin staging
+git switch main
+git pull --ff-only origin main
 git switch -c feat/short-description
 ```
 
@@ -93,7 +91,7 @@ Run the checks relevant to the change. For a release or security-sensitive chang
 
 For maintainers, trusted contributors, and automation agents:
 
-1. Start from an up-to-date `staging` branch.
+1. Start from an up-to-date `main` branch.
 2. Create a focused branch with a descriptive prefix.
 3. Inspect the relevant code and tests before making changes.
 4. Implement the smallest complete change.
@@ -107,9 +105,9 @@ For maintainers, trusted contributors, and automation agents:
    chore(ci): cache Rust dependencies
    ```
 
-8. Push the branch and open a pull request into `staging`.
+8. Push the branch and open a pull request into `main`.
 9. Address review feedback and failed checks on the same branch.
-10. Merge with a squash after required checks pass and the change is ready; feature PRs land on `staging` with squash merges.
+10. Merge with a squash after required checks pass and the change is ready; feature PRs land on `main` with squash merges.
 
 ### Internal agent handoff
 
@@ -130,11 +128,11 @@ For contributors who do not have direct write access:
 
 1. Fork the repository on GitHub.
 2. Add the upstream repository as `upstream`.
-3. Branch from the upstream `staging` branch.
+3. Branch from the upstream `main` branch.
 4. Make a focused change and follow the local setup instructions.
 5. Add tests and documentation for behavior changes.
 6. Run all applicable checks locally.
-7. Push to the fork and open a pull request targeting `staging`.
+7. Push to the fork and open a pull request targeting `main`.
 8. Explain the problem, proposed solution, validation, compatibility, and rollout impact.
 9. Address maintainer feedback without rewriting unrelated history or scope.
 
@@ -157,17 +155,14 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 | Event                                              | Expected automation                                                                   |
 | -------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |
-| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |
-| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |
-| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |
+| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |
+| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |
 | Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate`                         |
 | Scheduled or manual validation                     | Full audit tier                                                                       |
 | Push to a working branch                           | Draft PR workflow                                                                     |
-| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |
 | Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |
 
-Draft pull requests do not start runner-heavy validation. Marking a pull request ready for review starts the applicable validation tier; converting it back to draft cancels in-flight validation, and no replacement starts until it is ready again.
+Draft pull requests do not start validation. Marking a pull request ready for review starts the applicable validation tier. Convert it back to draft after an update, then mark it ready again after every update so the required checks attach to the current head. Converting it to draft runs only the lightweight cancellation control.
 
 Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Both callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate.
 
@@ -181,11 +176,10 @@ Security checks can be skipped when repository visibility or the GitHub plan doe
 
 ## Review and merge protocol
 
-| Change                       | Target    | Merge method                                    | Merge gate                                                |
-| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |
-| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |
-| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |
-| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |
+| Change                    | Target | Merge method                      | Merge gate                              |
+| ------------------------- | ------ | --------------------------------- | --------------------------------------- |
+| Working branch            | `main` | Squash                            | All applicable required checks pass     |
+| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |
 
 Reviewers focus on correctness, security, maintainability, test coverage, operational impact, and compatibility. Authors remain responsible for responding to feedback and verifying the final commit.
 
@@ -195,7 +189,7 @@ Report vulnerabilities privately using [SECURITY.md](./SECURITY.md), never in a
 
 For an urgent production or security issue:
 
-1. Create a focused branch from `staging`.
+1. Create a focused branch from `main`.
 2. Document the urgency and affected systems without exposing secrets.
 3. Open a pull request and run the narrowest complete validation available.
 4. Request the appropriate maintainer review.

package/.github/SECURITY.md

@@ -4,11 +4,10 @@
 
 ## Supported Versions
 
-The latest commit on `staging` receives security patches. Patches are promoted to `main` through the next release cycle.
+The latest commit on `main` receives security patches.
 
 | Branch           | Supported |
 | ---------------- | --------- |
-| `staging`        | ✅        |
 | `main`           | ✅        |
 | Feature branches | ❌        |
 

package/.github/actions/setup/action.yml

@@ -748,8 +748,9 @@ runs:
           ${{ runner.os }}-rust-build-v2-
     - name: Setup
       if: ${{ steps.profile.outputs.mise_required == 'true' }}
-      uses: jdx/mise-action@v4
+      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
       with:
+        version: 2026.9.2
         cache: true
         install_args: ${{ steps.profile.outputs.mise_tools }}
     - name: Setup Rust components

package/.github/code-foundry.yml

@@ -11,7 +11,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v1.3.1
+runtime_ref: v1.9.6
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
@@ -35,10 +35,8 @@ prune_standard: false
 post_release: false
 post_release_workflow:
 post_release_mode: auto
-opencode_security: false
 sync_mode: overlay
 custom_workflows: preserve
-staging_validation_mode: fast
 performance: auto
 performance_command:
 performance_profile:

package/.github/workflows/ci.yml

@@ -71,7 +71,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run format >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run format >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -86,7 +86,7 @@ jobs:
           task: format
       - name: Format
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci format
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci format
 
   lint:
     name: Lint
@@ -115,7 +115,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run lint >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run lint >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -125,7 +125,7 @@ jobs:
           task: lint
       - name: Lint
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci lint
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci lint
 
   type-check:
     name: Type-Check
@@ -154,7 +154,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run type_check >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run type_check >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -164,7 +164,7 @@ jobs:
           task: type_check
       - name: Type-Check
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci type_check
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
 
   build:
     name: Build
@@ -198,7 +198,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci should_run build >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run build >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -208,4 +208,4 @@ jobs:
           task: build
       - name: Build
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci build
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build

package/.github/workflows/cloudflare-deploy.yml

@@ -13,6 +13,21 @@ on:
         required: false
         type: string
         default: '.'
+      install-working-directory:
+        description: 'Directory containing bun.lock. Used only when build-script is set.'
+        required: false
+        type: string
+        default: '.'
+      build-script:
+        description: 'Optional Bun package script to run before Wrangler deploys.'
+        required: false
+        type: string
+        default: ''
+      bun-version:
+        description: 'Bun version used for dependency installation and the optional build.'
+        required: false
+        type: string
+        default: '1.4.0'
       runner:
         required: false
         type: string
@@ -48,6 +63,24 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Set up Bun
+        if: inputs.build-script != ''
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+
+      - name: Install dependencies
+        if: inputs.build-script != ''
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile
+
+      - name: Build Worker
+        if: inputs.build-script != ''
+        working-directory: ${{ inputs.working-directory }}
+        env:
+          BUILD_SCRIPT: ${{ inputs.build-script }}
+        run: bun run "$BUILD_SCRIPT"
+
       - name: Deploy to Cloudflare
         id: deploy
         working-directory: ${{ inputs.working-directory }}

package/.github/workflows/codeql.yml

@@ -131,7 +131,7 @@ jobs:
           REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs codeql
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" codeql
       - id: matrix
         name: Build analysis matrix
         env:

package/.github/workflows/draft-control_self-ci.yml

@@ -0,0 +1,44 @@
+name: Code Foundry Draft Control
+
+on:
+  pull_request:
+    branches: [main, staging]
+    types:
+      - converted_to_draft
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  cancel:
+    name: Draft Control / Halt CI
+    if: vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    steps:
+      - name: Cancel queued and running checks for this branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+          CURRENT_RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          for status in queued in_progress; do
+            gh api "repos/$GITHUB_REPOSITORY/actions/runs" \
+              --method GET \
+              -f branch="$HEAD_BRANCH" \
+              -f event=pull_request \
+              -f status="$status" \
+              --paginate \
+              --jq '.workflow_runs[].id' |
+              while read -r run_id; do
+                if [ -n "$run_id" ] && [ "$run_id" -lt "$CURRENT_RUN_ID" ]; then
+                  gh api \
+                    --method POST \
+                    "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/cancel" \
+                    --silent || true
+                fi
+              done
+          done
+          echo "CI is halted while pull request #${{ github.event.pull_request.number }} remains draft."

package/.github/workflows/opencode-security_self-ci.yml

@@ -4,11 +4,7 @@ on:
   pull_request:
     branches: [main, staging]
     types:
-      - opened
-      - synchronize
-      - reopened
       - ready_for_review
-      - converted_to_draft
   workflow_dispatch:
 
 permissions:
@@ -20,8 +16,7 @@ jobs:
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
       (github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.draft == false &&
-      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')))
+      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}
@@ -35,18 +30,15 @@ jobs:
         id: detect
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          OPENCODE_SECURITY_OVERRIDE: ${{ vars.OPENCODE_SECURITY }}
+          OPENCODE_SECURITY: ${{ vars.OPENCODE_SECURITY }}
         run: |
           enabled=false
           token=false
-          # The OPENCODE_SECURITY repository variable overrides the
-          # configuration: true opts a repository in, false opts it out, and
-          # an unset value falls back to the code-foundry configuration.
-          if [ "$OPENCODE_SECURITY_OVERRIDE" = "true" ]; then
+          # OpenCode Security is controlled only by the repository or
+          # organization variable. An unset value is disabled.
+          if [ "$OPENCODE_SECURITY" = "true" ]; then
             enabled=true
-          elif [ "$OPENCODE_SECURITY_OVERRIDE" = "false" ]; then
-            enabled=false
-          elif grep -Eq '^opencode_security:\s*(true|auto)\s*$' .github/code-foundry.yml 2>/dev/null; then enabled=true; fi
+          fi
           if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
           echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
           echo "token=$token" >> "$GITHUB_OUTPUT"

package/.github/workflows/release.yml

@@ -101,9 +101,9 @@ jobs:
             releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
           }
           if (!['node', 'python', 'rust', 'simple', 'none'].includes(releaseType)) throw new Error(`Unsupported release_type: ${releaseType}`)
-          const allowedStrategies = gitWorkflow === 'staging-release' ? ['rebase'] : ['rebase', 'squash']
+          const allowedStrategies = gitWorkflow === 'staging-release' ? ['rebase'] : ['squash']
           if (!allowedStrategies.includes(releaseMergeStrategy)) {
-            throw new Error(`release_merge_strategy must be "rebase"${gitWorkflow === 'staging-release' ? '' : ' or "squash" (direct topology)'} for automated release merges; got ${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}`)
+            throw new Error(`release_merge_strategy must be "${gitWorkflow === 'staging-release' ? 'rebase' : 'squash'}" for automated release merges; got ${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}`)
           }
           if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
           let legacyReleaseType = ''
@@ -218,9 +218,13 @@ jobs:
           for pr in "${release_prs[@]}"; do
             PR_DRAFT=$(gh pr view "$pr" --repo "$GITHUB_REPOSITORY" --json isDraft --jq '.isDraft')
             if [ "$AUTO_MERGE" = true ]; then
-              if [ "$PR_DRAFT" = true ]; then
-                gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
+              if [ "$PR_DRAFT" = false ]; then
+                # A Release Please PR can be updated while already ready. Reset
+                # it so ready_for_review always starts validation for the exact
+                # current release head.
+                gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"
               fi
+              gh pr ready "$pr" --repo "$GITHUB_REPOSITORY"
             else
               if [ "$PR_DRAFT" = false ]; then
                 gh pr ready --undo "$pr" --repo "$GITHUB_REPOSITORY"

package/.github/workflows/release_self-ci.yml

@@ -30,5 +30,4 @@ jobs:
       runtime-ref: ${{ github.sha }}
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
-      STAGING_DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/security.yml

@@ -99,7 +99,7 @@ jobs:
         env:
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security profile >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security profile >> "$GITHUB_OUTPUT"
       - id: matrix
         name: Build audit matrix
         env:
@@ -268,21 +268,24 @@ jobs:
             esac
           fi
 
-          printf 'toolchain_mode=%s\n' "$toolchain" >> "$GITHUB_OUTPUT"
-          printf 'package_manager=%s\n' "$package_manager" >> "$GITHUB_OUTPUT"
-          printf 'mise_tools=%s\n' "$mise_tools" >> "$GITHUB_OUTPUT"
+          {
+            printf 'toolchain_mode=%s\n' "$toolchain"
+            printf 'package_manager=%s\n' "$package_manager"
+            printf 'mise_tools=%s\n' "$mise_tools"
+          } >> "$GITHUB_OUTPUT"
       - name: Detect JavaScript
         id: applicability-javascript
         if: matrix.entry.language == 'javascript'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security should_run javascript >> "$GITHUB_OUTPUT"
       - name: Detect Rust
         id: applicability-rust
         if: matrix.entry.language == 'rust'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security should_run rust >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security should_run rust >> "$GITHUB_OUTPUT"
       - name: Setup mise toolchain
         if: steps.audit-toolchain.outputs.mise_tools != ''
         uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
         with:
+          version: 2026.9.2
           cache: false
           install_args: ${{ steps.audit-toolchain.outputs.mise_tools }}
       - name: Setup Node
@@ -316,7 +319,7 @@ jobs:
         if: >-
           matrix.entry.language == 'javascript' &&
           steps.applicability-javascript.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit javascript
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit javascript
       - name: Check Rust
         id: system-rust
         if: >-
@@ -349,7 +352,7 @@ jobs:
         if: >-
           matrix.entry.language == 'rust' &&
           steps.applicability-rust.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit rust
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit rust
       - name: Setup Python
         if: >-
           matrix.entry.language == 'python' &&
@@ -375,4 +378,4 @@ jobs:
           enable-cache: false
       - name: Audit Python dependencies
         if: matrix.entry.language == 'python'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs security audit python
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit python

package/.github/workflows/test.yml

@@ -86,7 +86,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile unit >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile unit >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -104,7 +104,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci unit
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci unit
       - name: Upload coverage
         if: >-
           always() &&
@@ -151,7 +151,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile performance >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile performance >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -170,7 +170,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Performance
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci performance
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci performance
       - name: Upload performance results
         if: >-
           always() &&
@@ -216,7 +216,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile integration >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile integration >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -234,7 +234,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci integration
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
 
   e2e:
     name: E2E
@@ -265,7 +265,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile e2e >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile e2e >> "$GITHUB_OUTPUT"
       - name: Cache browser binaries
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
         uses: ./.github/actions/cache
@@ -295,7 +295,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci e2e
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci e2e
 
   smoke:
     name: Smoke
@@ -326,7 +326,7 @@ jobs:
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
       - name: Detect
         id: applicability
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci task_profile smoke >> "$GITHUB_OUTPUT"
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile smoke >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -344,4 +344,4 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
         if: steps.applicability.outputs.applicable == 'true'
-        run: node $RUNNER_TEMP/code-foundry/src/runtime.mjs ci smoke
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci smoke

package/.github/workflows/validation.yml

@@ -80,7 +80,7 @@ permissions:
 jobs:
   ci:
     name: CI
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -92,7 +92,7 @@ jobs:
 
   test:
     name: Test
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -106,7 +106,7 @@ jobs:
 
   security:
     name: Security
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -129,9 +129,10 @@ jobs:
 
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
-  # The release tier runs no suite jobs: its policy (generated release diff
-  # validation) executes as a conditional step below, so no separate
-  # release-policy job renders skipped checks on ordinary pull requests.
+  # The release tier runs the full audit suite so Release Please pull requests
+  # expose no neutral suite checks. Its generated release diff policy executes
+  # as a conditional step below, so ordinary pull requests still render no
+  # skipped release-policy row.
   gate:
     name: Gate
     needs: [ci, test, security, codeql]