code-foundry 0.31.17 → 0.32.0

package/.github/CONTRIBUTING.md

@@ -48,7 +48,7 @@ docs/*  test/*  refactor/*         │              │
 | `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
 | `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
 
-The default Git workflow is `staging-release`: topic branches merge into `staging`, then a promotion PR moves validated changes into `main`, followed by the versioned release PR. The default merge strategy is `rebase`, which preserves the linear Conventional Commit history. Configure `merge_strategy` as `squash` or `merge` in `.github/code-foundry.yml` when the repository intentionally uses another policy. Re-align `staging` with `main` after a release when needed.
+The default Git workflow is `staging-release`: topic branches merge into `staging` (typically after rebasing), then a promotion PR moves validated changes into `main`, followed by the versioned release PR. The default release merge strategy is `merge`, matching your preference for merge-commit promotions from staging to main. Configure `merge_strategy` as `rebase` or `squash` in `.github/code-foundry.yml` if a repository intentionally differs. Re-align `staging` with `main` after a release when needed.
 
 ## Before you start
 
@@ -163,7 +163,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 The workflows use separate concurrency groups keyed by the commit under test. A newer run for the same commit cancels a duplicate event-triggered run, while newer commits cancel older runs and independent CI, Test, Security, and CodeQL workflows continue in parallel.
 
-Required checks are enforced by branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
+Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 
 ### Release conventions
 

package/.github/code-foundry.yml

@@ -16,7 +16,7 @@ release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: staging-release
-merge_strategy: rebase
+merge_strategy: merge
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto

package/.github/workflows/codeql.yml

@@ -344,7 +344,7 @@ jobs:
           set -euo pipefail
           scope="$RUST_SCOPE"
           scope_id="$(node -e 'process.stdout.write(require("node:crypto").createHash("sha256").update(process.argv[1]).digest("hex").slice(0, 12))' "$scope")"
-          config_file="$RUNNER_TEMP/codeql-rust-$scope_id.yml"
+          config_file="$GITHUB_WORKSPACE/.github/codeql-rust-$scope_id.yml"
           cat > "$config_file" <<'EOF'
           name: code-foundry-rust
           EOF

package/.github/workflows/draft-pr.yml

@@ -36,12 +36,36 @@ jobs:
         if: steps.check-pr.outputs.existing == '0'
         run: |
           BRANCH="${{ github.ref_name }}"
+          PREFIX="${BRANCH%%/*}"
+          SUFFIX="${BRANCH#*/}"
+          PR_TITLE=""
+
+          case "$PREFIX" in
+            feat|fix|chore|refactor|docs|test|style|ci|build)
+              if [ "$SUFFIX" != "$BRANCH" ] && [ -n "$SUFFIX" ]; then
+                PR_TITLE="${PREFIX}: ${SUFFIX}"
+              fi
+              ;;
+            *)
+              ;;
+          esac
+
+          PR_TITLE="${PR_TITLE//[\/_]/ }"
+          PR_TITLE="$(printf '%s' "$PR_TITLE" | tr -s ' ' | sed 's/^ *//; s/ *$//')"
+
+          if [ -z "$PR_TITLE" ]; then
+            PR_TITLE=$(git log -1 --pretty=%s 2>/dev/null || true)
+          fi
+          if [ -z "$PR_TITLE" ]; then
+            PR_TITLE="$BRANCH"
+          fi
+
           gh pr create \
             --repo "$GITHUB_REPOSITORY" \
             --base staging \
             --head "$BRANCH" \
             --draft \
-            --title "[WIP] $BRANCH" \
+            --title "$PR_TITLE" \
             --body "Draft PR created automatically by CI.
 
             This PR is a draft and should not be merged until CI passes and a reviewer (or the Daily Review agent) marks it ready.

package/.github/workflows/release-pr.yml

@@ -157,7 +157,7 @@ jobs:
           ### Validation
 
           - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge using the repository's configured \`merge_strategy\` (default: **rebase**).
+          - Merge using the repository's configured \`merge_strategy\` (default: **merge**).
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 

package/.github/workflows/release.yml

@@ -72,10 +72,12 @@ jobs:
             : {}
           let releaseType = config.release_type || 'auto'
           let npmPublish = config.npm_publish || 'false'
+          let releaseMergeStrategy = String(config.merge_strategy || 'merge').trim().toLowerCase()
           if (releaseType === 'auto') {
             releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
           }
           if (!['node', 'python', 'rust', 'simple', 'none'].includes(releaseType)) throw new Error(`Unsupported release_type: ${releaseType}`)
+          if (!['rebase', 'squash', 'merge'].includes(releaseMergeStrategy)) throw new Error(`Unsupported merge_strategy: ${releaseMergeStrategy}`)
           if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
           let legacyReleaseType = ''
           if (releaseType !== 'none') {
@@ -88,7 +90,7 @@ jobs:
           }
           fs.appendFileSync(
             process.env.GITHUB_OUTPUT,
-            `release_type=${releaseType}\nlegacy_release_type=${legacyReleaseType}\nnpm_publish=${npmPublish}\n`,
+            `release_type=${releaseType}\nlegacy_release_type=${legacyReleaseType}\nnpm_publish=${npmPublish}\nrelease_merge_strategy=${releaseMergeStrategy}\n`,
           )
           NODE
       - name: Detect release credentials
@@ -161,7 +163,7 @@ jobs:
             gh pr merge "$pr" \
               --repo "$GITHUB_REPOSITORY" \
               --admin \
-              --rebase \
+              --${{ steps.profile.outputs.release_merge_strategy }} \
               --delete-branch
           done
 

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.32.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.18...v0.32.0) (2026-07-31)
+
+
+### Features
+
+* improve draft PR titles from branch conventions ([#290](https://github.com/0xPlayerOne/code-foundry/issues/290)) ([7b215db](https://github.com/0xPlayerOne/code-foundry/commit/7b215db961347dfdb74241fc2c3489d390b34533))
+
+## [0.31.18](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.17...v0.31.18) (2026-07-30)
+
+
+### Bug Fixes
+
+* **codeql:** keep generated config in workspace ([9ca8f3b](https://github.com/0xPlayerOne/code-foundry/commit/9ca8f3b958e40209727f305bd0c0856f4820e1b6))
+
 ## [0.31.17](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.16...v0.31.17) (2026-07-30)
 
 

package/docs/CONFIGURATION.md

@@ -48,7 +48,7 @@ repository manifests and source
 | `npm_publish` | `true` or `false` | Opt into npm publication |
 | `license` | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3 |
 | `git_workflow` | `staging-release` | Branch/release model; the standard model promotes `staging` into `main` |
-| `merge_strategy` | `rebase`, `squash`, `merge` | Preferred merge method for contribution and release PRs; defaults to `rebase` |
+| `merge_strategy` | `rebase`, `squash`, `merge` | Preferred merge method for contribution and release PRs; defaults to `merge` |
 | `runner` fields | GitHub runner names | Per-workflow runner policy |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,

package/docs/RELEASES.md

@@ -12,9 +12,8 @@ Keep commits Conventional Commit-shaped (`feat:`, `fix:`, `docs:`, `ci:`,
 `chore:`, and so on). Release Please uses them to select patch/minor/major
 versions and generate grouped changelog notes.
 
-The default `merge_strategy` is `rebase`, matching the repository's linear
-history policy. Set it to `squash` or `merge` in `.github/code-foundry.yml` when
-that repository intentionally uses a different merge convention. The current
+The default `merge_strategy` is `merge`, matching promotion PRs from `staging` into `main`.
+Configure it to `squash` or `rebase` in `.github/code-foundry.yml` if a repository intentionally differs. The current
 supported `git_workflow` is `staging-release`.
 
 The release workflow opens or updates a versioned PR after changes reach
@@ -54,6 +53,6 @@ the generated version pull request before using the token to merge it.
 
 1. Merge tested changes from `staging` into `main`.
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's normal linear-history policy.
+3. Merge the release PR with the repository's configured `merge_strategy` (default `merge`).
 4. Confirm the GitHub Release and any package publication.
 5. Synchronize `staging` with the new `main` release commit.

package/docs/WORKFLOWS.md

@@ -61,13 +61,14 @@ checks disabled.
 
 ## Branch protection
 
-Use the repository's GitHub settings or the maintainer's branch-protection
-automation after reviewing the repository's enabled features:
+Use repository rulesets (or legacy branch protection settings) to mirror the
+required checks for each protected branch. Review the repository's enabled
+features and enforce only checks that actually run:
 
 ```bash
 Apply only checks for enabled workflows.
 ```
 
-Keep strict status checks, linear history, and conversation resolution enabled.
-For a repository with optional features disabled, do not require checks that
-will never run.
+Keep strict status checks, linear history, and conversation resolution enabled
+where required. For a repository with optional features disabled, do not require
+checks that will never run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.17",
+  "version": "0.32.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -339,7 +339,7 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'merge',
   }
 }
 

package/src/lib/github-doctor.mjs

@@ -15,23 +15,22 @@ export function doctorGithub(root) {
   const warnings = []
   /** @type {Record<string, any>} */
   const details = { repository }
+  const rulesets = hydrateRulesets(repository, ghJson(['api', `repos/${repository}/rulesets`]))
+  const mainRulesets = rulesetsForBranch(rulesets, 'main')
   const protection = ghJson(['api', `repos/${repository}/branches/main/protection`])
-  if (!protection) warnings.push('main branch protection is not readable or is not configured.')
-  else {
-    const required = requiredContexts(protection)
-    details.requiredChecks = required
-    const duplicateNames = required.filter((name) => /\b([^/]+) \/ \1\b/i.test(name))
-    if (duplicateNames.length) errors.push(`required checks contain duplicate workflow prefixes: ${duplicateNames.join(', ')}`)
-    if (!protection.required_status_checks) warnings.push('main protection has no required status checks.')
-  }
+  const required = mainRulesets.length ? requiredContextsFromRulesets(mainRulesets) : requiredContextsFromProtection(protection)
+  details.requiredChecks = required
+  if (!protection && !mainRulesets.length) warnings.push('main branch protection or repository rulesets are not readable or are not configured.')
+  else if (!required.length) warnings.push(mainRulesets.length ? 'main ruleset has no required status checks.' : 'main protection has no required status checks.')
+  const duplicateNames = required.filter((name) => /\b([^/]+) \/ \1\b/i.test(name))
+  if (duplicateNames.length) errors.push(`required checks contain duplicate workflow prefixes: ${duplicateNames.join(', ')}`)
 
   const sha = String(ghJson(['api', `repos/${repository}/git/ref/heads/main`])?.object?.sha ?? '')
   const checks = sha ? ghJson(['api', `repos/${repository}/commits/${sha}/check-runs?per_page=100`])?.check_runs ?? [] : []
   const observed = checks.map(/** @param {any} check */ (check) => check.name).filter(Boolean)
   details.observedChecks = observed
   if (!observed.length) warnings.push('no check runs were observed on the current main commit; exact check validation is deferred until CI runs.')
-  if (protection?.required_status_checks) {
-    const required = requiredContexts(protection)
+  if (required.length) {
     const missing = required.filter((name) => observed.length && !observed.includes(name))
     if (missing.length) warnings.push(`required checks not observed on current main: ${missing.join(', ')}`)
   }
@@ -70,13 +69,62 @@ export function doctorGithub(root) {
 }
 
 /** @param {any} protection @returns {string[]} */
-function requiredContexts(protection) {
+function requiredContextsFromProtection(protection) {
   return [...new Set([
-    ...(protection.required_status_checks?.contexts ?? []),
-    ...(protection.required_status_checks?.checks ?? []).map(/** @param {any} check */ (check) => check.context),
+    ...(protection?.required_status_checks?.contexts ?? []),
+    ...(protection?.required_status_checks?.checks ?? []).map(/** @param {any} check */ (check) => check.context),
   ].filter(Boolean))]
 }
 
+/** @param {any[]} rulesets @returns {string[]} */
+function requiredContextsFromRulesets(rulesets) {
+  return [...new Set(
+    (Array.isArray(rulesets) ? rulesets : []).flatMap((/** @type {any} */ ruleset) =>
+      (ruleset.rules ?? []).flatMap((/** @type {any} */ rule) =>
+        rule?.type === 'required_status_checks' ?
+          (rule.parameters?.required_status_checks ?? []).map((/** @type {any} */ check) => check?.context).filter(Boolean) :
+          []
+      ),
+    ),
+  )]
+}
+
+/** @param {string} repository @param {any[] | null} rulesets @returns {any[]} */
+function hydrateRulesets(repository, rulesets) {
+  if (!Array.isArray(rulesets)) return []
+  return rulesets.map((ruleset) => {
+    if (!ruleset?.id) return ruleset
+    const details = ghJson(['api', `repos/${repository}/rulesets/${ruleset.id}`])
+    return details && typeof details === 'object' ? details : ruleset
+  })
+}
+
+/** @param {any[] | null} rulesets @param {string} branch @returns {any[]} */
+function rulesetsForBranch(rulesets, branch) {
+  if (!Array.isArray(rulesets)) return []
+  return rulesets.filter((ruleset) => (
+    ruleset?.target === 'branch' &&
+    Array.isArray(ruleset?.conditions?.ref_name?.include) &&
+    Array.isArray(ruleset?.conditions?.ref_name?.exclude) &&
+    includesBranch(ruleset.conditions.ref_name.include, branch) &&
+    !includesBranch(ruleset.conditions.ref_name.exclude, branch)
+  ))
+}
+
+/** @param {(string | null | undefined)[]} patterns @param {string} branch @returns {boolean} */
+function includesBranch(patterns, branch) {
+  const target = `refs/heads/${branch}`
+  return patterns.some((pattern) => {
+    if (!pattern) return false
+    if (pattern === '~ALL') return true
+    if (pattern === target || pattern === branch) return true
+    if (!/[\*?]/.test(pattern)) return false
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\\\*/g, '.*').replace(/\\\?/g, '.')
+    const regex = new RegExp(`^${escaped}$`)
+    return regex.test(target) || regex.test(branch)
+  })
+}
+
 /** @param {string} root @returns {{ errors: string[], warnings: string[] }} */
 function inspectWorkflows(root) {
   /** @type {string[]} */