code-foundry 1.9.9 → 1.9.11

package/.github/workflows/opencode-security_self-ci.yml

@@ -13,10 +13,7 @@ permissions:
 jobs:
   detect:
     name: OpenCode Security / Detect
-    if: >-
-      vars.CI_BILLING_PAUSED != 'true' &&
-      (github.event_name == 'workflow_dispatch' ||
-      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
+    if: vars.CI_BILLING_PAUSED != 'true'
     runs-on: ubuntu-slim
     outputs:
       enabled: ${{ steps.detect.outputs.enabled }}
@@ -44,9 +41,9 @@ jobs:
           echo "token=$token" >> "$GITHUB_OUTPUT"
 
   # Reusable workflows can only be called from a job level, so the scan is
-  # its own job gated on the detect outputs. The scan itself still runs only
-  # for generated release pull requests (or manual dispatch) with the
-  # scanner configured and keyed.
+  # its own job gated on the detect outputs. The scanner runs for any ready
+  # pull request (or manual dispatch) when the repository variable opts in
+  # and the API key is configured.
   scan:
     name: OpenCode Security / Scan
     needs: detect

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.9.11](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.10...v1.9.11) (2026-09-08)
+
+
+### Bug Fixes
+
+* **doctor:** support nested Rust crates ([#525](https://github.com/0xPlayerOne/code-foundry/issues/525)) ([0ffc87d](https://github.com/0xPlayerOne/code-foundry/commit/0ffc87d71c5e8069a26814dea2250e93a3e87416))
+
+## [1.9.10](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.9...v1.9.10) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** keep OpenCode detection visible ([#523](https://github.com/0xPlayerOne/code-foundry/issues/523)) ([5499db8](https://github.com/0xPlayerOne/code-foundry/commit/5499db818f0b06e98f07173893104c655b2b63c1))
+
 ## [1.9.9](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.8...v1.9.9) (2026-09-08)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.9",
+  "version": "1.9.11",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/doctor.mjs

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { includesValue, readConfig } from '../lib/config.mjs'
@@ -80,11 +80,16 @@ export function doctor(root, options = {}) {
   if (profile.languages.split(',').includes('rust') && !commandExists('cargo'))
     error('Cargo is required for this repository')
   if (profile.languages.split(',').includes('rust')) {
-    const metadata = spawnSync('cargo', ['metadata', '--no-deps', '--format-version', '1'], {
-      cwd: target,
-      stdio: 'ignore',
-    })
-    if (metadata.status !== 0) error('cargo metadata failed')
+    const manifests = rustManifestPaths(target)
+    if (!manifests.length) error('no Cargo.toml was found for the configured Rust language')
+    for (const manifest of manifests) {
+      const metadata = spawnSync(
+        'cargo',
+        ['metadata', '--manifest-path', manifest, '--no-deps', '--format-version', '1'],
+        { cwd: target, stdio: 'ignore' }
+      )
+      if (metadata.status !== 0) error(`cargo metadata failed for ${manifest}`)
+    }
   }
   if (
     profile.languages.split(',').includes('python') &&
@@ -229,6 +234,45 @@ export function doctor(root, options = {}) {
   console.log('Repository doctor passed.')
 }
 
+const ignoredRustDirectories = new Set([
+  '.git',
+  '.code-foundry',
+  '.mise',
+  '.next',
+  '.nuxt',
+  '.venv',
+  'node_modules',
+  'target',
+  'vendor',
+])
+
+/**
+ * Return repository-relative Cargo manifests that represent owned Rust code.
+ * A root workspace is authoritative; otherwise validate each nested crate while
+ * excluding dependency/build trees that CodeQL shards should not treat as owned.
+ * @param {string} root
+ * @returns {string[]}
+ */
+export function rustManifestPaths(root) {
+  if (existsSync(join(root, 'Cargo.toml'))) return ['Cargo.toml']
+  /** @type {string[]} */
+  const manifests = []
+  /** @param {string} directory @param {string} relative */
+  function visit(directory, relative) {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.isDirectory() && ignoredRustDirectories.has(entry.name)) continue
+      const childRelative = relative ? join(relative, entry.name) : entry.name
+      const child = join(directory, entry.name)
+      if (entry.isDirectory()) visit(child, childRelative)
+      else if (entry.name === 'Cargo.toml') manifests.push(childRelative)
+    }
+  }
+  visit(root, '')
+  // Sorting a fresh local collection is deterministic and cannot mutate caller-owned state.
+  // oxlint-disable-next-line unicorn/no-array-sort
+  return manifests.sort()
+}
+
 /** @param {string} root @param {string[]} args */
 function git(root, args) {
   return spawnSync('git', args, { cwd: root, encoding: 'utf8' }).stdout?.trim() ?? ''