code-foundry 0.27.18 → 0.29.0

package/.github/workflows/release.yml

@@ -8,6 +8,16 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: false
+        type: string
+        default: 0xPlayerOne/code-foundry
+      runtime-ref:
+        description: Code Foundry runtime tag or ref.
+        required: false
+        type: string
+        default: v0.27.18
 
 permissions:
   contents: write
@@ -168,6 +178,47 @@ jobs:
               --delete-branch
           done
 
+  reconcile:
+    name: Release / Reconcile
+    needs: release
+    if: needs.release.outputs.release_created == 'true'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Checkout runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            src
+            release-please-config.json
+      - name: Check staging branch
+        id: staging
+        run: |
+          if git ls-remote --exit-code origin refs/heads/staging >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            git fetch --no-tags origin main staging
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Reconcile release metadata
+        if: steps.staging.outputs.exists == 'true'
+        run: node .code-foundry/src/cli.mjs release reconcile --github --base main --head staging
+      - name: Skip without staging
+        if: steps.staging.outputs.exists != 'true'
+        run: echo 'No staging branch exists; release reconciliation is not applicable.'
+
   npm:
     name: Release / Publish npm
     needs: release

package/.github/workflows/release_self-ci.yml

@@ -17,4 +17,6 @@ jobs:
     uses: ./.github/workflows/release.yml
     with:
       runner: ubuntu-slim
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.27.18
     secrets: inherit

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.29.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.28.0...v0.29.0) (2026-07-29)
+
+
+### Features
+
+* **release:** detect mixed-language release manifests ([f2daa61](https://github.com/0xPlayerOne/code-foundry/commit/f2daa616f2d8cfd2883f960823e862768454fbd6))
+
+## [0.28.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.18...v0.28.0) (2026-07-29)
+
+
+### Features
+
+* **release:** reconcile staging after release metadata ([4de1ad6](https://github.com/0xPlayerOne/code-foundry/commit/4de1ad64bd9276344368934ab555e6cb31a90784))
+
 ## [0.27.18](https://github.com/0xPlayerOne/code-foundry/compare/v0.27.17...v0.27.18) (2026-07-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.27.18",
+  "version": "0.29.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/cli.mjs

@@ -4,11 +4,12 @@
 import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { doctor } from './commands/doctor.mjs'
+import { reconcileRelease } from './commands/release.mjs'
 import { syncRepository } from './commands/sync.mjs'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
-/** @typedef {{ target: string, dryRun: boolean, force: boolean }} Options */
+/** @typedef {{ target: string, dryRun: boolean, force: boolean, github: boolean, base: string, head: string }} Options */
 /** @typedef {{ command: string, options: Options }} ParsedArgs */
 
 const usage = `code-foundry — initialize and maintain agent-ready repositories
@@ -17,6 +18,7 @@ Usage:
   npx code-foundry init [--target PATH]
   npx code-foundry sync [--target PATH]
   npx code-foundry doctor [--target PATH]
+  npx code-foundry release reconcile [--github] [--base BRANCH] [--head BRANCH]
 
 The repository configuration lives in .github/code-foundry.yml.
 init detects the repository, creates that file, and renders the baseline.
@@ -26,6 +28,9 @@ Options:
   --target PATH   Repository directory (default: current directory)
   --dry-run       Preview changes without writing files
   --force         Replace protected standard documents
+  --github        Apply a verified fast-forward through GitHub
+  --base BRANCH   Release source branch (default: main)
+  --head BRANCH   Branch to reconcile (default: staging)
   -h, --help      Show this help
 `
 
@@ -40,7 +45,12 @@ function parseArgs(argv) {
   const first = argv[0]
   const hasCommand = Boolean(first && !first.startsWith('-'))
   const command = hasCommand ? /** @type {string} */ (argv.shift()) : 'init'
-  const options = { target: process.cwd(), dryRun: false, force: false }
+  const options = { target: process.cwd(), dryRun: false, force: false, github: false, base: 'main', head: 'staging' }
+
+  if (command === 'release') {
+    const subcommand = argv.shift()
+    if (subcommand !== 'reconcile') fail(`unknown release command: ${subcommand ?? '(missing)'}; use release reconcile`)
+  }
 
   while (argv.length) {
     const arg = argv.shift()
@@ -54,6 +64,9 @@ function parseArgs(argv) {
       options.target = value
     } else if (arg === '--dry-run') options.dryRun = true
     else if (arg === '--force') options.force = true
+    else if (arg === '--github') options.github = true
+    else if (arg === '--base') options.base = argv.shift() ?? fail('--base requires a branch')
+    else if (arg === '--head') options.head = argv.shift() ?? fail('--head requires a branch')
     else fail(`unknown option: ${arg}; run --help for the supported options`)
   }
 
@@ -83,6 +96,12 @@ function main() {
       console.error(`code-foundry: ${error instanceof Error ? error.message : String(error)}`)
       process.exitCode = 1
     }
+  } else if (command === 'release') {
+    try {
+      reconcileRelease(target, options)
+    } catch (error) {
+      fail(error instanceof Error ? error.message : String(error))
+    }
   }
   else fail(`unknown command: ${command}`)
 }

package/src/commands/release.mjs

@@ -0,0 +1,64 @@
+// @ts-check
+
+import { existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { approvedReleaseFiles, classifyReconciliation, readReleaseConfig } from '../lib/release-policy.mjs'
+
+/** @typedef {{ target: string, dryRun: boolean, github: boolean, base: string, head: string }} ReleaseOptions */
+
+/**
+ * Reconcile staging after Release Please updates main. The local mode is
+ * deterministic and suitable for CI; --github applies only a verified
+ * fast-forward through the GitHub API and otherwise fails closed.
+ * @param {string} root
+ * @param {ReleaseOptions} options
+ */
+export function reconcileRelease(root, options) {
+  const target = resolve(root)
+  const base = options.base || 'main'
+  const head = options.head || 'staging'
+  const mainSha = git(target, ['rev-parse', `origin/${base}`]) || git(target, ['rev-parse', base])
+  const stagingSha = git(target, ['rev-parse', `origin/${head}`]) || git(target, ['rev-parse', head])
+  const mergeBaseSha = git(target, ['merge-base', mainSha, stagingSha])
+  const mainChangedPaths = diffNames(target, mergeBaseSha, mainSha)
+  const stagingChangedPaths = diffNames(target, mergeBaseSha, stagingSha)
+  const plan = classifyReconciliation({
+    mainSha,
+    stagingSha,
+    mergeBaseSha,
+    mainChangedPaths,
+    stagingChangedPaths,
+    allowed: approvedReleaseFiles(readReleaseConfig(target)),
+  })
+  console.log(JSON.stringify({ base, head, ...plan }, null, 2))
+  if (plan.action === 'fail') throw new Error(plan.reason + (plan.unexpected?.length ? ` Unexpected paths: ${plan.unexpected.join(', ')}` : ''))
+  if (plan.action !== 'fast-forward' || !options.github || options.dryRun) return plan
+  if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for --github reconciliation.')
+  const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
+  if (!token) throw new Error('GH_TOKEN or GITHUB_TOKEN is required for --github reconciliation.')
+  const result = spawnSync('gh', [
+    'api', '--method', 'PATCH', `repos/${process.env.GITHUB_REPOSITORY}/git/refs/heads/${head}`,
+    '-f', `sha=${plan.targetSha}`, '-F', 'force=false',
+  ], { cwd: target, stdio: 'inherit', env: { ...process.env, GH_TOKEN: token } })
+  if (result.status !== 0) throw new Error(`GitHub refused the protected fast-forward of ${head}.`)
+  return plan
+}
+
+/** @param {string} root @param {string[]} args @returns {string} */
+function git(root, args) {
+  const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' })
+  return result.status === 0 ? result.stdout.trim() : ''
+}
+
+/** @param {string} root @param {string} from @param {string} to @returns {string[]} */
+function diffNames(root, from, to) {
+  if (!from || !to || from === to) return []
+  const result = spawnSync('git', ['diff', '--name-only', from, to], { cwd: root, encoding: 'utf8' })
+  return result.status === 0 ? result.stdout.split(/\r?\n/).filter(Boolean) : []
+}
+
+/** @param {string} root */
+export function releaseConfigExists(root) {
+  return existsSync(join(resolve(root), 'release-please-config.json'))
+}

package/src/commands/sync.mjs

@@ -5,6 +5,7 @@ import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectLanguages, detectPackageManager, detectProfile } from '../lib/profile.mjs'
 import { configured, includesValue, readConfig } from '../lib/config.mjs'
+import { buildReleaseConfig } from '../lib/release-manifest.mjs'
 
 const standardFiles = [
   '.editorconfig', '.gitattributes', '.gitignore', 'release-please-config.json',
@@ -82,6 +83,9 @@ export function syncRepository(options) {
     if ((file === 'LICENSE' || file === 'NOTICE') && license === 'none') continue
     if (file === '.github/CODEOWNERS' && existsSync(destination)) continue
     let content = readFileSync(sourceFile)
+    if (file === 'release-please-config.json') {
+      content = Buffer.from(renderReleaseConfig(target, sourceFile))
+    }
     if (file.endsWith('.yml') && file.startsWith('.github/workflows/')) {
       content = Buffer.from(renderWorkflow(content.toString('utf8'), config, runtimeRepository, runtimeRef))
     }
@@ -133,6 +137,21 @@ export function syncRepository(options) {
   return { changed, config }
 }
 
+/** @param {string} target @param {string} sourceFile @returns {string} */
+function renderReleaseConfig(target, sourceFile) {
+  let baseline = {}
+  try { baseline = JSON.parse(readFileSync(sourceFile, 'utf8')) }
+  catch { baseline = {} }
+  const destination = join(target, 'release-please-config.json')
+  let existing = baseline
+  if (existsSync(destination)) {
+    try { existing = JSON.parse(readFileSync(destination, 'utf8')) }
+    catch { existing = baseline }
+  }
+  const merged = { ...baseline, ...existing }
+  return `${JSON.stringify(buildReleaseConfig(target, merged), null, 2)}\n`
+}
+
 /** @param {string} file @param {string} languages @param {string} features */
 function shouldInclude(file, languages, features) {
   if (file === 'ruff.toml') return includesValue(languages, 'python')

package/src/lib/release-manifest.mjs

@@ -0,0 +1,121 @@
+// @ts-check
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+const ignored = new Set(['.git', '.code-foundry', '.venv', 'node_modules', 'target', 'vendor', 'dist', 'build'])
+
+/** @typedef {{ directory: string, manifest: string, releaseType: 'node'|'python'|'rust', packageName?: string, extraFiles: string[] }} ReleasePackage */
+
+/** @param {string} root @returns {ReleasePackage[]} */
+export function detectReleasePackages(root) {
+  /** @type {ReleasePackage[]} */
+  const packages = []
+  walk(root, (file) => {
+    const name = file.split('/').pop()
+    const directory = file.includes('/') ? file.slice(0, file.lastIndexOf('/')) : '.'
+    if (name === 'package.json') {
+      const parsed = readJson(join(root, file))
+      packages.push({ directory, manifest: file, releaseType: 'node', packageName: typeof parsed?.name === 'string' ? parsed.name : undefined, extraFiles: detectExtraFiles(root, directory) })
+    } else if (name === 'Cargo.toml') {
+      packages.push({ directory, manifest: file, releaseType: 'rust', packageName: tomlPackageName(join(root, file)), extraFiles: detectExtraFiles(root, directory) })
+    } else if (name === 'pyproject.toml') {
+      packages.push({ directory, manifest: file, releaseType: 'python', packageName: pyprojectName(join(root, file)), extraFiles: detectExtraFiles(root, directory) })
+    }
+  })
+  return packages.sort((a, b) => a.directory.localeCompare(b.directory))
+}
+
+/**
+ * Merge automatic package and extra-file detection into a Release Please
+ * configuration without discarding repository-owned settings.
+ * @param {string} root
+ * @param {Record<string, any>} existing
+ */
+export function buildReleaseConfig(root, existing = {}) {
+  const packages = detectReleasePackages(root)
+  const result = { ...existing }
+  if (!packages.length) return result
+  if (packages.length === 1 && packages[0].directory === '.') {
+    result['release-type'] ??= packages[0].releaseType
+    /** @type {any[]} */
+    const extra = Array.isArray(result['extra-files']) ? result['extra-files'] : []
+    result['extra-files'] = extra
+    for (const file of packages[0].extraFiles) {
+      if (!extra.some((entry) => (typeof entry === 'string' ? entry : entry?.path) === file)) extra.push(file)
+    }
+    return result
+  }
+  /** @type {Record<string, any>} */
+  const configuredPackages = { ...(result.packages ?? {}) }
+  for (const entry of packages) {
+    const current = { ...(configuredPackages[entry.directory] ?? {}) }
+    current['release-type'] ??= entry.releaseType
+    if (entry.packageName) current['package-name'] ??= entry.packageName
+    /** @type {any[]} */
+    const extra = Array.isArray(current['extra-files']) ? [...current['extra-files']] : []
+    for (const file of entry.extraFiles) if (!extra.some((item) => (typeof item === 'string' ? item : item?.path) === file)) extra.push(file)
+    if (extra.length) current['extra-files'] = extra
+    configuredPackages[entry.directory] = current
+  }
+  result.packages = configuredPackages
+  delete result['release-type']
+  return result
+}
+
+/** @param {string} root @param {Record<string, any>} config @returns {string[]} */
+export function validateReleaseConfig(root, config) {
+  const detected = detectReleasePackages(root)
+  if (!detected.length) return []
+  const configured = config.packages && typeof config.packages === 'object' ? config.packages : null
+  if (detected.length > 1 && !configured) return ['mixed-language or multi-package repositories require release-please packages configuration']
+  if (!configured) return []
+  const errors = []
+  for (const entry of detected) {
+    const item = configured[entry.directory]
+    if (!item) errors.push(`release-please packages is missing ${entry.directory}`)
+    else if (item['release-type'] !== entry.releaseType) errors.push(`${entry.directory} release-type should be ${entry.releaseType}`)
+  }
+  return errors
+}
+
+/** @param {string} root @param {(file: string) => void} visit */
+function walk(root, visit) {
+  /** @param {string} directory */
+  function descend(directory) {
+    for (const entry of readdirSync(join(root, directory), { withFileTypes: true })) {
+      if (entry.isDirectory() && ignored.has(entry.name)) continue
+      const path = directory ? `${directory}/${entry.name}` : entry.name
+      if (entry.isDirectory()) descend(path)
+      else visit(path)
+    }
+  }
+  descend('')
+}
+
+/** @param {string} root @param {string} directory @returns {string[]} */
+function detectExtraFiles(root, directory) {
+  const candidates = ['version.txt', 'VERSION', '.version', 'version.json', 'src/version.ts', 'src/version.js', 'src/version.py', 'src/version.rs']
+  return candidates
+    .map((file) => directory === '.' ? file : `${directory}/${file}`)
+    .filter((file) => existsSync(join(root, file)))
+    .map((file) => directory === '.' ? file : file.slice(directory.length + 1))
+}
+
+/** @param {string} file @returns {any} */
+function readJson(file) {
+  try { return JSON.parse(readFileSync(file, 'utf8')) }
+  catch { return {} }
+}
+
+/** @param {string} file @returns {string|undefined} */
+function tomlPackageName(file) {
+  const match = readFileSync(file, 'utf8').match(/^name\s*=\s*["']([^"']+)["']/m)
+  return match?.[1]
+}
+
+/** @param {string} file @returns {string|undefined} */
+function pyprojectName(file) {
+  const match = readFileSync(file, 'utf8').match(/^(?:name|name\s*)\s*=\s*["']([^"']+)["']/m)
+  return match?.[1]
+}

package/src/lib/release-policy.mjs

@@ -0,0 +1,108 @@
+// @ts-check
+
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+const DEFAULT_RELEASE_FILES = new Set([
+  '.release-please-manifest.json',
+  'CHANGELOG.md',
+  'Cargo.lock',
+  'Cargo.toml',
+  'bun.lock',
+  'bun.lockb',
+  'package-lock.json',
+  'package.json',
+  'pnpm-lock.yaml',
+  'pyproject.toml',
+  'uv.lock',
+  'version.txt',
+  'yarn.lock',
+])
+
+/** @param {string} root @returns {Record<string, unknown>} */
+export function readReleaseConfig(root) {
+  const file = join(root, 'release-please-config.json')
+  if (!existsSync(file)) return {}
+  try { return JSON.parse(readFileSync(file, 'utf8')) }
+  catch { return {} }
+}
+
+/**
+ * Return the release files allowed to change during an automated reconciliation.
+ * Package manifests are scoped beneath their Release Please package directory.
+ * @param {Record<string, unknown>} config
+ * @returns {Set<string>}
+ */
+export function approvedReleaseFiles(config = {}) {
+  const allowed = new Set(DEFAULT_RELEASE_FILES)
+  addExtraFiles(allowed, config['extra-files'])
+  const packages = config.packages
+  if (packages && typeof packages === 'object' && !Array.isArray(packages)) {
+    for (const [directory, value] of Object.entries(packages)) {
+      const prefix = directory === '.' ? '' : directory.replace(/\/$/, '')
+      for (const file of DEFAULT_RELEASE_FILES) addPath(allowed, prefix, file)
+      if (value && typeof value === 'object' && !Array.isArray(value)) {
+        addExtraFiles(allowed, value['extra-files'], prefix)
+      }
+    }
+  }
+  return allowed
+}
+
+/** @param {Set<string>} allowed @param {unknown} entries @param {string} [prefix] */
+function addExtraFiles(allowed, entries, prefix = '') {
+  if (!Array.isArray(entries)) return
+  for (const entry of entries) {
+    const path = typeof entry === 'string' ? entry : entry && typeof entry === 'object' && 'path' in entry ? entry.path : ''
+    if (typeof path === 'string' && path) addPath(allowed, prefix, path)
+  }
+}
+
+/** @param {Set<string>} allowed @param {string} prefix @param {string} path */
+function addPath(allowed, prefix, path) {
+  const clean = path.replace(/^\.\//, '').replace(/\\/g, '/')
+  allowed.add(prefix ? `${prefix}/${clean}` : clean)
+}
+
+/** @param {string[]} paths @param {Set<string>} allowed @returns {string[]} */
+export function unexpectedReleasePaths(paths, allowed) {
+  return [...new Set(paths.map((path) => path.trim()).filter(Boolean))]
+    .filter((path) => !allowed.has(path))
+}
+
+/**
+ * Classify the relationship between main and staging. A fast-forward is safe
+ * only when main is the ancestor of staging or staging is the ancestor of main
+ * and the intervening main files are release metadata.
+ * @param {{ mainSha: string, stagingSha: string, mergeBaseSha?: string, mainChangedPaths?: string[], stagingChangedPaths?: string[], allowed?: Set<string> }} input
+ */
+export function classifyReconciliation(input) {
+  const {
+    mainSha,
+    stagingSha,
+    mergeBaseSha = '',
+    mainChangedPaths = [],
+    stagingChangedPaths = [],
+    allowed = approvedReleaseFiles(),
+  } = input
+  if (!mainSha || !stagingSha) return { action: 'fail', reason: 'Missing branch SHA.' }
+  if (mainSha === stagingSha) return { action: 'aligned', reason: 'Branches already point at the same commit.' }
+  if (mainSha === mergeBaseSha) {
+    return { action: 'none', reason: 'staging contains commits that are not on main; no release-only reconciliation is needed.' }
+  }
+  const unexpectedMain = unexpectedReleasePaths(mainChangedPaths, allowed)
+  const unexpectedStaging = unexpectedReleasePaths(stagingChangedPaths, allowed)
+  if (unexpectedMain.length || unexpectedStaging.length) {
+    return {
+      action: 'fail',
+      reason: 'Branch divergence includes repository code or configuration.',
+      unexpected: [...new Set([...unexpectedMain, ...unexpectedStaging])],
+    }
+  }
+  if (stagingSha === mergeBaseSha) {
+    return { action: 'fast-forward', targetSha: mainSha, reason: 'main only added approved release metadata.' }
+  }
+  return { action: 'pull-request', targetSha: mainSha, reason: 'Branches diverged, but only approved release metadata changed.' }
+}
+
+export { DEFAULT_RELEASE_FILES }