code-foundry 0.27.16 → 0.27.18

package/.github/workflows/release.yml

@@ -71,6 +71,16 @@ jobs:
             `release_type=${releaseType}\nlegacy_release_type=${legacyReleaseType}\nnpm_publish=${npmPublish}\n`,
           )
           NODE
+      - name: Detect release credentials
+        id: credentials
+        env:
+          RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+        run: |
+          if [ -n "$RELEASE_PLEASE_TOKEN" ]; then
+            echo "auto_merge=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "auto_merge=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Release Please
         id: release
         if: steps.profile.outputs.release_type != 'none'
@@ -79,6 +89,84 @@ jobs:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
           config-file: release-please-config.json
           release-type: ${{ steps.profile.outputs.legacy_release_type }}
+      - name: Leave release pull request for manual merge
+        if: steps.release.outputs.prs_created == 'true' && steps.credentials.outputs.auto_merge != 'true'
+        run: |
+          echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. RELEASE_PLEASE_TOKEN is not configured, so Code Foundry skipped guarded auto-merge. Configure the token before merging when downstream release workflows must run automatically."
+      - name: Merge generated version pull requests
+        if: steps.release.outputs.prs_created == 'true' && steps.credentials.outputs.auto_merge == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          allowed_paths="$(
+            node <<'NODE'
+          const fs = require('node:fs')
+          const config = JSON.parse(fs.readFileSync('release-please-config.json', 'utf8'))
+          const common = [
+            '.release-please-manifest.json',
+            'CHANGELOG.md',
+            'Cargo.lock',
+            'Cargo.toml',
+            'bun.lock',
+            'bun.lockb',
+            'package-lock.json',
+            'package.json',
+            'pnpm-lock.yaml',
+            'pyproject.toml',
+            'uv.lock',
+            'version.txt',
+            'yarn.lock',
+          ]
+          const allowed = new Set(common)
+          const addExtraFiles = (files = [], prefix = '') => {
+            for (const entry of files) {
+              const path = typeof entry === 'string' ? entry : entry.path
+              if (path) allowed.add(prefix ? `${prefix}/${path}` : path)
+            }
+          }
+          addExtraFiles(config['extra-files'])
+          for (const [directory, packageConfig] of Object.entries(config.packages || {})) {
+            const prefix = directory === '.' ? '' : directory.replace(/\/$/, '')
+            for (const path of common) allowed.add(prefix ? `${prefix}/${path}` : path)
+            addExtraFiles(packageConfig['extra-files'], prefix)
+          }
+          process.stdout.write(JSON.stringify([...allowed]))
+          NODE
+          )"
+
+          mapfile -t release_prs < <(
+            gh pr list \
+              --repo "$GITHUB_REPOSITORY" \
+              --state open \
+              --base main \
+              --json number,title,headRefName \
+              --jq '.[] | select(.title | startswith("chore(main): release ")) | select(.headRefName | startswith("release-please--branches--main")) | .number'
+          )
+          [ "${#release_prs[@]}" -gt 0 ] || {
+            echo "Release Please reported a pull request, but no generated release PR was found." >&2
+            exit 1
+          }
+
+          for pr in "${release_prs[@]}"; do
+            mapfile -t changed_paths < <(gh pr diff "$pr" --repo "$GITHUB_REPOSITORY" --name-only)
+            [ "${#changed_paths[@]}" -gt 0 ] || {
+              echo "Generated release PR #$pr has no changed files." >&2
+              exit 1
+            }
+            for path in "${changed_paths[@]}"; do
+              jq -e --arg path "$path" 'index($path) != null' <<<"$allowed_paths" >/dev/null || {
+                echo "Refusing to auto-merge release PR #$pr with unexpected path: $path" >&2
+                exit 1
+              }
+            done
+            gh pr merge "$pr" \
+              --repo "$GITHUB_REPOSITORY" \
+              --admin \
+              --rebase \
+              --delete-branch
+          done
 
   npm:
     name: Release / Publish npm

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.27.18](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.17...v0.27.18) (2026-07-29)
+
+
+### Bug Fixes
+
+* **release:** degrade gracefully without release token ([69ac43a](https://github.com/0xPlayerOne/code-foundry/commit/69ac43acfa2813495b8da0535942afbbedae3017))
+
+## [0.27.17](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.16...v0.27.17) (2026-07-29)
+
+
+### Bug Fixes
+
+* **release:** auto-merge generated version PRs ([3032cfc](https://github.com/0xPlayerOne/code-foundry/commit/3032cfc458e4508ad637354ee98447c544a5a1d4))
+
 ## [0.27.16](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.15...v0.27.16) (2026-07-29)
 
 ### Bug Fixes

package/docs/RELEASES.md

@@ -29,8 +29,8 @@ body. Existing `CHANGELOG.md` history remains repository-owned.
 Set these values in `.github/code-foundry.yml`:
 
 ```yaml
-release_type: auto   # auto, node, python, rust, simple, or none
-npm_publish: false   # true only for an npm package
+release_type: auto # auto, node, python, rust, simple, or none
+npm_publish: false # true only for an npm package
 ```
 
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
@@ -39,9 +39,16 @@ not release automatically.
 
 ## Pull request permissions
 
-If the default `GITHUB_TOKEN` cannot create pull requests, configure a narrowly
-scoped `RELEASE_PLEASE_TOKEN` repository or organization secret. The release
-workflow needs `contents`, `issues`, and `pull-requests` permissions.
+Release Please falls back to the repository's `GITHUB_TOKEN` when a
+`RELEASE_PLEASE_TOKEN` secret is unavailable. In that mode, Code Foundry opens
+or updates the version pull request, leaves it for manual merge, and completes
+the release job successfully.
+
+Configure a narrowly scoped `RELEASE_PLEASE_TOKEN` repository or organization
+secret to enable guarded automatic merging and downstream workflows triggered
+by the resulting release. The token needs `contents`, `issues`, and
+`pull-requests` write permissions. Code Foundry validates every changed path in
+the generated version pull request before using the token to merge it.
 
 ## Operational checklist
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.27.16",
+  "version": "0.27.18",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",