code-foundry 0.30.3 → 0.31.0

package/.github/actions/setup/action.yml

@@ -723,7 +723,7 @@ runs:
         path: ~/.cargo/advisory-db
         # The advisory database is independent of project dependencies. Keep
         # it warm for Security without invalidating it on every lockfile edit.
-        key: ${{ runner.os }}-rust-advisory-${{ hashFiles('.code-foundry/src/runtime.mjs') }}
+        key: ${{ runner.os }}-rust-advisory-${{ hashFiles('.github/.code-foundry/src/runtime.mjs') }}
         restore-keys: |
           ${{ runner.os }}-rust-advisory-
     - name: Cache Rust builds
@@ -773,7 +773,7 @@ runs:
         REPO_FOUNDRY_INSTALL_PYTHON: ${{ inputs.install-python }}
         REPO_FOUNDRY_INSTALL_RUST: ${{ inputs.install-rust }}
         REPO_FOUNDRY_TASK: ${{ inputs.task }}
-      run: node .code-foundry/src/runtime.mjs ci install
+      run: node .github/.code-foundry/src/runtime.mjs ci install
     - name: Measure Bun dependencies
       id: javascript-bun-cache
       if: >-

package/.github/workflows/ci.yml

@@ -50,7 +50,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -58,10 +58,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci should_run format >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci should_run format >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -76,7 +76,7 @@ jobs:
           task: format
       - name: Format
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci format
+        run: node .github/.code-foundry/src/runtime.mjs ci format
 
   lint:
     name: Lint
@@ -89,7 +89,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -97,10 +97,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci should_run lint >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci should_run lint >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -110,7 +110,7 @@ jobs:
           task: lint
       - name: Lint
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci lint
+        run: node .github/.code-foundry/src/runtime.mjs ci lint
 
   type-check:
     name: Type-Check
@@ -123,7 +123,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -131,10 +131,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci should_run type_check >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci should_run type_check >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -144,7 +144,7 @@ jobs:
           task: type_check
       - name: Type-Check
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci type_check
+        run: node .github/.code-foundry/src/runtime.mjs ci type_check
 
   build:
     name: Build
@@ -162,7 +162,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -170,10 +170,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci should_run build >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci should_run build >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -183,4 +183,4 @@ jobs:
           task: build
       - name: Build
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci build
+        run: node .github/.code-foundry/src/runtime.mjs ci build

package/.github/workflows/ci_self-ci.yml

@@ -16,6 +16,6 @@ jobs:
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: staging
+      runtime-ref: ${{ github.sha }}
       runner: ubuntu-latest
     secrets: inherit

package/.github/workflows/codeql.yml

@@ -90,7 +90,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -98,7 +98,7 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - id: languages
         name: Detect languages
         env:
@@ -106,7 +106,7 @@ jobs:
           REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
-        run: node .code-foundry/src/runtime.mjs codeql
+        run: node .github/.code-foundry/src/runtime.mjs codeql
 
   analyze-actions:
     name: Analyze (Actions)
@@ -132,7 +132,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -144,7 +144,7 @@ jobs:
           needs.detect.outputs.actions_changed == 'true'
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Analyze
         if: >-
           needs.detect.outputs.enabled == 'true' &&
@@ -186,7 +186,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -198,7 +198,7 @@ jobs:
           needs.detect.outputs.javascript_changed == 'true'
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Analyze
         if: >-
           needs.detect.outputs.enabled == 'true' &&
@@ -240,7 +240,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -252,7 +252,7 @@ jobs:
           needs.detect.outputs.python_changed == 'true'
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Analyze
         if: >-
           needs.detect.outputs.enabled == 'true' &&
@@ -294,7 +294,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -306,7 +306,7 @@ jobs:
           needs.detect.outputs.rust_changed == 'true'
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Analyze
         if: >-
           needs.detect.outputs.enabled == 'true' &&

package/.github/workflows/codeql_self-ci.yml

@@ -21,6 +21,6 @@ jobs:
     uses: ./.github/workflows/codeql.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: staging
+      runtime-ref: ${{ github.sha }}
       runner: ubuntu-latest
     secrets: inherit

package/.github/workflows/release.yml

@@ -55,7 +55,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: src
       - name: Detect release profile
         id: profile
@@ -117,7 +117,7 @@ jobs:
           GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
         run: |
           set -euo pipefail
-          node .code-foundry/src/cli.mjs release validate-prs
+          node .github/.code-foundry/src/cli.mjs release validate-prs
           mapfile -t release_prs < <(
             gh pr list \
               --repo "$GITHUB_REPOSITORY" \
@@ -155,7 +155,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             src
             release-please-config.json
@@ -170,7 +170,7 @@ jobs:
           fi
       - name: Reconcile release metadata
         if: steps.staging.outputs.exists == 'true'
-        run: node .code-foundry/src/cli.mjs release reconcile --github --base main --head staging
+        run: node .github/.code-foundry/src/cli.mjs release reconcile --github --base main --head staging
       - name: Skip without staging
         if: steps.staging.outputs.exists != 'true'
         run: echo 'No staging branch exists; release reconciliation is not applicable.'
@@ -200,7 +200,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: src
       - name: Detect post-release hook
         id: hook
@@ -221,7 +221,7 @@ jobs:
           NODE
       - name: Dispatch post-release hook once
         if: steps.hook.outputs.enabled == 'true' && steps.hook.outputs.workflow != ''
-        run: node .code-foundry/src/cli.mjs release hook --tag '${{ needs.release.outputs.tag_name }}' --workflow '${{ steps.hook.outputs.workflow }}' --mode '${{ steps.hook.outputs.mode }}'
+        run: node .github/.code-foundry/src/cli.mjs release hook --tag '${{ needs.release.outputs.tag_name }}' --workflow '${{ steps.hook.outputs.workflow }}' --mode '${{ steps.hook.outputs.mode }}'
       - name: Explain disabled post-release hook
         if: steps.hook.outputs.enabled != 'true' || steps.hook.outputs.workflow == ''
         run: echo 'No post-release workflow configured; artifact delivery is intentionally skipped.'

package/.github/workflows/release_self-ci.yml

@@ -19,5 +19,5 @@ jobs:
     with:
       runner: ubuntu-slim
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: main
+      runtime-ref: ${{ github.sha }}
     secrets: inherit

package/.github/workflows/security.yml

@@ -81,7 +81,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -89,13 +89,13 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: profile
         env:
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
           REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
-        run: node .code-foundry/src/runtime.mjs security profile >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs security profile >> "$GITHUB_OUTPUT"
 
   dependency-audit-javascript:
     name: Dependency Audit (JavaScript)
@@ -127,7 +127,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -135,10 +135,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -147,7 +147,7 @@ jobs:
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Audit dependencies
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs security audit javascript
+        run: node .github/.code-foundry/src/runtime.mjs security audit javascript
 
   dependency-audit-rust:
     name: Dependency Audit (Rust)
@@ -173,7 +173,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -181,10 +181,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs security should_run rust >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs security should_run rust >> "$GITHUB_OUTPUT"
       - name: Check Rust
         id: system-rust
         if: steps.applicability.outputs.applicable == 'true'
@@ -212,7 +212,7 @@ jobs:
           tool: cargo-audit
       - name: Audit dependencies
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs security audit rust
+        run: node .github/.code-foundry/src/runtime.mjs security audit rust
 
   dependency-audit-python:
     name: Dependency Audit (Python) / ${{ matrix.requirement }}
@@ -253,7 +253,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -261,14 +261,14 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Setup
         uses: ./.github/actions/setup
         with:
           mise-scope: python
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Audit dependencies
-        run: node .code-foundry/src/runtime.mjs security audit python
+        run: node .github/.code-foundry/src/runtime.mjs security audit python
 
   dependency-audit-python-gate:
     name: Dependency Audit (Python)

package/.github/workflows/security_self-ci.yml

@@ -16,6 +16,6 @@ jobs:
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: staging
+      runtime-ref: ${{ github.sha }}
       runner: ubuntu-slim
     secrets: inherit

package/.github/workflows/test.yml

@@ -58,7 +58,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -66,10 +66,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci task_profile unit >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci task_profile unit >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -87,7 +87,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci unit
+        run: node .github/.code-foundry/src/runtime.mjs ci unit
       - name: Upload coverage
         if: >-
           always() &&
@@ -119,7 +119,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -127,10 +127,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci task_profile integration >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci task_profile integration >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -148,7 +148,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci integration
+        run: node .github/.code-foundry/src/runtime.mjs ci integration
 
   e2e:
     name: E2E
@@ -164,7 +164,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -172,10 +172,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci task_profile e2e >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci task_profile e2e >> "$GITHUB_OUTPUT"
       - name: Cache browser binaries
         if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
         uses: ./.github/actions/cache
@@ -205,7 +205,7 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci e2e
+        run: node .github/.code-foundry/src/runtime.mjs ci e2e
 
   smoke:
     name: Smoke
@@ -221,7 +221,7 @@ jobs:
         with:
           repository: ${{ inputs.runtime-repository }}
           ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
+          path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
             src/lib
@@ -229,10 +229,10 @@ jobs:
       - name: Install runtime
         run: |
           mkdir -p .github/actions
-          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .github/.code-foundry/.github/actions/. .github/actions/
       - name: Detect
         id: applicability
-        run: node .code-foundry/src/runtime.mjs ci task_profile smoke >> "$GITHUB_OUTPUT"
+        run: node .github/.code-foundry/src/runtime.mjs ci task_profile smoke >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -250,4 +250,4 @@ jobs:
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
         if: steps.applicability.outputs.applicable == 'true'
-        run: node .code-foundry/src/runtime.mjs ci smoke
+        run: node .github/.code-foundry/src/runtime.mjs ci smoke

package/.github/workflows/test_self-ci.yml

@@ -16,7 +16,7 @@ jobs:
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: staging
+      runtime-ref: ${{ github.sha }}
       runner: ubuntu-latest
       unit-runner: ubuntu-slim
     secrets: inherit

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.31.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.30.4...v0.31.0) (2026-07-29)
+
+
+### Features
+
+* **release:** open safe staging sync PRs ([6adb1dc](https://github.com/0xPlayerOne/code-foundry/commit/6adb1dc63966e5bfe70deb3ccd3c3aa5e93ccfad))
+
+
+### Bug Fixes
+
+* **release:** compare promoted branch tips ([081666b](https://github.com/0xPlayerOne/code-foundry/commit/081666b774418ab333d34eb9a3ca2a8c3bd60c78))
+
+## [0.30.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.30.3...v0.30.4) (2026-07-29)
+
+
+### Bug Fixes
+
+* **ci:** isolate runtime from consumer tooling ([32fe3ee](https://github.com/0xPlayerOne/code-foundry/commit/32fe3eea20ddad6086c1cfcacff6e7cb90606da0))
+* **self-ci:** test the checked-out runtime revision ([93973ba](https://github.com/0xPlayerOne/code-foundry/commit/93973bac19da7d250e3ccda4d4c79b1b0033008b))
+
 ## [0.30.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.30.2...v0.30.3) (2026-07-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.30.3",
+  "version": "0.31.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/release.mjs

@@ -22,8 +22,12 @@ export function reconcileRelease(root, options) {
   const mainSha = git(target, ['rev-parse', `origin/${base}`]) || git(target, ['rev-parse', base])
   const stagingSha = git(target, ['rev-parse', `origin/${head}`]) || git(target, ['rev-parse', head])
   const mergeBaseSha = git(target, ['merge-base', mainSha, stagingSha])
-  const mainChangedPaths = diffNames(target, mergeBaseSha, mainSha)
-  const stagingChangedPaths = diffNames(target, mergeBaseSha, stagingSha)
+  // Compare the branch tips directly. Release Please may rebase or recreate
+  // commits during promotion, leaving equivalent code with different ancestry.
+  // Comparing both tips preserves the fail-closed behavior for real content
+  // differences without mistaking that normal history rewrite for a change.
+  const mainChangedPaths = diffNames(target, stagingSha, mainSha)
+  const stagingChangedPaths = diffNames(target, mainSha, stagingSha)
   const plan = classifyReconciliation({
     mainSha,
     stagingSha,
@@ -34,6 +38,23 @@ export function reconcileRelease(root, options) {
   })
   console.log(JSON.stringify({ base, head, ...plan }, null, 2))
   if (plan.action === 'fail') throw new Error(plan.reason + (plan.unexpected?.length ? ` Unexpected paths: ${plan.unexpected.join(', ')}` : ''))
+  if (plan.action === 'pull-request' && options.github && !options.dryRun) {
+    if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for synchronization PRs.')
+    const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
+    if (!token) throw new Error('GH_TOKEN or GITHUB_TOKEN is required for synchronization PRs.')
+    const existing = ghJson(target, ['pr', 'list', '--repo', process.env.GITHUB_REPOSITORY, '--state', 'open', '--base', head, '--head', base, '--json', 'number,url'])
+    if (Array.isArray(existing) && existing.length) {
+      return { ...plan, synchronizationPullRequest: existing[0].url ?? existing[0].number }
+    }
+    const result = spawnSync('gh', [
+      'pr', 'create', '--repo', process.env.GITHUB_REPOSITORY,
+      '--base', head, '--head', base,
+      '--title', `chore(release): synchronize ${base} -> ${head}`,
+      '--body', `Synchronize ${head} with ${base} after Release Please publication.\n\nOnly approved release metadata differs between the branch tips; Code Foundry verified the content before opening this PR.`,
+    ], { cwd: resolve(root), encoding: 'utf8', env: { ...process.env, GH_TOKEN: token } })
+    if (result.status !== 0) throw new Error(`Failed to create synchronization PR: ${result.stderr.trim()}`)
+    return { ...plan, synchronizationPullRequest: result.stdout.trim() }
+  }
   if (plan.action !== 'fast-forward' || !options.github || options.dryRun) return plan
   if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for --github reconciliation.')
   const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN

package/src/commands/sync.mjs

@@ -11,7 +11,7 @@ import { customWorkflowFiles, overlayPolicy } from '../lib/overlay.mjs'
 const standardFiles = [
   '.editorconfig', '.gitattributes', '.gitignore', 'release-please-config.json',
   'docs/EXTENSIONS.md',
-  '.githooks/pre-commit', 'AGENTS.md', 'LICENSE', 'NOTICE', 'ruff.toml', '.prettierrc',
+  '.githooks/pre-commit', 'AGENTS.md', 'LICENSE', 'NOTICE', 'ruff.toml', '.prettierrc', '.prettierignore',
   '.github/CODEOWNERS', '.github/CODE_OF_CONDUCT.md', '.github/CONTRIBUTING.md',
   '.github/PULL_REQUEST_TEMPLATE.md', '.github/SECURITY.md', '.github/dependabot.yml',
   '.github/ISSUE_TEMPLATE/bug_report.yml', '.github/ISSUE_TEMPLATE/config.yml',
@@ -108,6 +108,9 @@ export function syncRepository(options) {
     if (file === '.gitignore' && existsSync(destination)) {
       content = Buffer.from(mergeGitignore(content.toString('utf8'), readFileSync(destination, 'utf8')))
     }
+    if (file === '.prettierignore' && existsSync(destination)) {
+      content = Buffer.from(mergeIgnoreFile(content.toString('utf8'), readFileSync(destination, 'utf8')))
+    }
     if (!existsSync(destination) || !buffersEqual(content, readFileSync(destination))) {
       changed.push(file)
       writeOrReport(destination, content, dryRun)
@@ -140,8 +143,8 @@ export function syncRepository(options) {
   }
   if (includesValue(languages, 'typescript') && existsSync(join(target, '.prettierignore'))) {
     const prettierIgnore = readFileSync(join(target, '.prettierignore'), 'utf8')
-    if (!prettierIgnore.split(/\r?\n/).includes('.code-foundry')) {
-      writeOrReport(join(target, '.prettierignore'), `${prettierIgnore.trimEnd()}\n.code-foundry\n`, dryRun)
+    if (!prettierIgnore.split(/\r?\n/).includes('.github/.code-foundry')) {
+      writeOrReport(join(target, '.prettierignore'), `${prettierIgnore.trimEnd()}\n.github/.code-foundry\n`, dryRun)
       changed.push('.prettierignore')
     }
   }
@@ -175,7 +178,7 @@ function renderReleaseConfig(target, sourceFile) {
 /** @param {string} file @param {string} languages @param {string} features @param {Record<string, string>} config */
 function shouldInclude(file, languages, features, config) {
   if (file === 'ruff.toml') return includesValue(languages, 'python')
-  if (file === '.prettierrc') return includesValue(languages, 'typescript')
+  if (file === '.prettierrc' || file === '.prettierignore') return includesValue(languages, 'typescript')
   if (file === '.github/dependabot.yml') return includesValue(features, 'dependabot')
   if (file === '.github/workflows/opencode-security.yml') return ['true', 'auto'].includes(config.opencode_security ?? 'false')
   const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
@@ -228,6 +231,13 @@ function mergeGitignore(baseline, existing) {
   return custom ? `${baseline.trimEnd()}\n\n${marker}\n${custom}\n` : baseline
 }
 
+/** @param {string} baseline @param {string} existing */
+function mergeIgnoreFile(baseline, existing) {
+  const baselineLines = new Set(baseline.split(/\r?\n/).map((line) => line.trim()).filter(Boolean))
+  const custom = existing.split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim() && !baselineLines.has(line.trim()))
+  return custom.length ? `${baseline.trimEnd()}\n\n# Repository-specific rules\n${custom.join('\n')}\n` : baseline
+}
+
 /** @param {string} file @param {string} content */
 function isLegacyManagedDoc(file, content) {
   if (file === 'AGENTS.md') {