code-foundry 0.31.15 → 0.31.17

package/.github/workflows/ci_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/.github/workflows/codeql_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   schedule:
     - cron: '31 6 * * 1'
   workflow_dispatch:

package/.github/workflows/opencode-security_self-ci.yml

@@ -2,7 +2,7 @@ name: Code Foundry
 
 on:
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/.github/workflows/release-pr_self-ci.yml

@@ -8,11 +8,8 @@ on:
   workflow_dispatch:
 
 permissions:
-  actions: read
   contents: read
   pull-requests: write
-  packages: read
-  security-events: write
 
 jobs:
   release-pr:
@@ -25,44 +22,3 @@ jobs:
     with:
       runner: ubuntu-slim
     secrets: inherit
-
-  ci:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: CI
-    uses: ./.github/workflows/ci.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-    secrets: inherit
-
-  test:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: Test
-    uses: ./.github/workflows/test.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-      unit-runner: ubuntu-slim
-    secrets: inherit
-
-  security:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: Security
-    uses: ./.github/workflows/security.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-slim
-    secrets: inherit
-
-  codeql:
-    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
-    name: CodeQL
-    uses: ./.github/workflows/codeql.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-    secrets: inherit

package/.github/workflows/security_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/.github/workflows/test_self-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, staging]
   pull_request:
-    branches: [staging]
+    branches: [main, staging]
   workflow_dispatch:
 
 permissions:

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.31.17](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.16...v0.31.17) (2026-07-30)
+
+
+### Bug Fixes
+
+* **sync:** preserve repository release policy ([8a8291b](https://github.com/0xPlayerOne/code-foundry/commit/8a8291b940bcc777e4aa9a426e56235b031fd002))
+
+## [0.31.16](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.15...v0.31.16) (2026-07-30)
+
+
+### Bug Fixes
+
+* **release:** avoid duplicate release PR checks ([42d7354](https://github.com/0xPlayerOne/code-foundry/commit/42d735404cd7b77d5a30a03a4fb8856096e931b0))
+* **workflows:** validate main promotion PRs ([4f41f90](https://github.com/0xPlayerOne/code-foundry/commit/4f41f90a3e4a5eec8e80d46c21083c1380655341))
+
 ## [0.31.15](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.14...v0.31.15) (2026-07-30)
 
 

package/docs/WORKFLOWS.md

@@ -8,7 +8,7 @@ The default standard callers use:
 push:
   branches: [main, staging]
 pull_request:
-  branches: [staging]
+  branches: [main, staging]
 ```
 
 Draft PR automation may additionally listen to supported topic branches.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.15",
+  "version": "0.31.17",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -225,6 +225,9 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   const workflow = content.match(/\.github\/workflows\/([^/]+)\.yml/)?.[1]
   const runner = workflow ? runners[workflow] : undefined
   if (runner) rendered = rendered.replace(/^(\s+runner:)\s+.*$/m, `$1 ${runner}`)
+  if (workflow === 'test' && config.unit_runner) {
+    rendered = rendered.replace(/^(\s+unit-runner:)\s+.*$/m, `$1 ${config.unit_runner}`)
+  }
   if (workflow === 'codeql') {
     rendered = rendered.replace(/^(\s+rust-shards:)\s+.*$/m, `$1 '${rustCodeql.shards}'`)
     rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/m, `$1 '${rustCodeql.threads}'`)

package/src/lib/release-manifest.mjs

@@ -36,6 +36,9 @@ export function buildReleaseConfig(root, existing = {}) {
   const packages = detectReleasePackages(root)
   const result = { ...existing }
   if (!packages.length) return result
+  // An explicit packages map is repository policy. Do not silently turn
+  // version-synchronized subprojects or vendored manifests into releases.
+  if (Object.prototype.hasOwnProperty.call(existing, 'packages')) return result
   if (packages.length === 1 && packages[0].directory === '.') {
     result['release-type'] ??= packages[0].releaseType
     /** @type {any[]} */