code-foundry 0.31.18 → 0.32.1

package/.github/CONTRIBUTING.md

@@ -48,7 +48,7 @@ docs/*  test/*  refactor/*         │              │
 | `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
 | `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
 
-The default Git workflow is `staging-release`: topic branches merge into `staging`, then a promotion PR moves validated changes into `main`, followed by the versioned release PR. The default merge strategy is `rebase`, which preserves the linear Conventional Commit history. Configure `merge_strategy` as `squash` or `merge` in `.github/code-foundry.yml` when the repository intentionally uses another policy. Re-align `staging` with `main` after a release when needed.
+The default Git workflow is `staging-release`: topic branches merge into `staging` (typically after rebasing), then a promotion PR moves validated changes into `main`, followed by the versioned release PR. The default release merge strategy is `merge`, matching your preference for merge-commit promotions from staging to main. Configure `merge_strategy` as `rebase` or `squash` in `.github/code-foundry.yml` if a repository intentionally differs. Re-align `staging` with `main` after a release when needed.
 
 ## Before you start
 
@@ -163,7 +163,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 The workflows use separate concurrency groups keyed by the commit under test. A newer run for the same commit cancels a duplicate event-triggered run, while newer commits cancel older runs and independent CI, Test, Security, and CodeQL workflows continue in parallel.
 
-Required checks are enforced by branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
+Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 
 ### Release conventions
 

package/.github/code-foundry.yml

@@ -16,7 +16,8 @@ release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: staging-release
-merge_strategy: rebase
+merge_strategy: merge
+release_merge_strategy: squash
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto

package/.github/workflows/ci.yml

@@ -35,7 +35,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-ci-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/codeql.yml

@@ -47,7 +47,7 @@ env:
   REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
 
 concurrency:
-  group: code-foundry-codeql-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-codeql-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/draft-pr.yml

@@ -36,12 +36,36 @@ jobs:
         if: steps.check-pr.outputs.existing == '0'
         run: |
           BRANCH="${{ github.ref_name }}"
+          PREFIX="${BRANCH%%/*}"
+          SUFFIX="${BRANCH#*/}"
+          PR_TITLE=""
+
+          case "$PREFIX" in
+            feat|fix|chore|refactor|docs|test|style|ci|build)
+              if [ "$SUFFIX" != "$BRANCH" ] && [ -n "$SUFFIX" ]; then
+                PR_TITLE="${PREFIX}: ${SUFFIX}"
+              fi
+              ;;
+            *)
+              ;;
+          esac
+
+          PR_TITLE="${PR_TITLE//[\/_]/ }"
+          PR_TITLE="$(printf '%s' "$PR_TITLE" | tr -s ' ' | sed 's/^ *//; s/ *$//')"
+
+          if [ -z "$PR_TITLE" ]; then
+            PR_TITLE=$(git log -1 --pretty=%s 2>/dev/null || true)
+          fi
+          if [ -z "$PR_TITLE" ]; then
+            PR_TITLE="$BRANCH"
+          fi
+
           gh pr create \
             --repo "$GITHUB_REPOSITORY" \
             --base staging \
             --head "$BRANCH" \
             --draft \
-            --title "[WIP] $BRANCH" \
+            --title "$PR_TITLE" \
             --body "Draft PR created automatically by CI.
 
             This PR is a draft and should not be merged until CI passes and a reviewer (or the Daily Review agent) marks it ready.

package/.github/workflows/release-pr.yml

@@ -157,7 +157,7 @@ jobs:
           ### Validation
 
           - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge using the repository's configured \`merge_strategy\` (default: **rebase**).
+          - Merge using the repository's configured \`merge_strategy\` (default: **merge**).
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 

package/.github/workflows/release.yml

@@ -72,10 +72,12 @@ jobs:
             : {}
           let releaseType = config.release_type || 'auto'
           let npmPublish = config.npm_publish || 'false'
+          let releaseMergeStrategy = String(config.release_merge_strategy || config.merge_strategy || 'merge').trim().toLowerCase()
           if (releaseType === 'auto') {
             releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
           }
           if (!['node', 'python', 'rust', 'simple', 'none'].includes(releaseType)) throw new Error(`Unsupported release_type: ${releaseType}`)
+          if (!['rebase', 'squash', 'merge'].includes(releaseMergeStrategy)) throw new Error(`Unsupported merge_strategy: ${releaseMergeStrategy}`)
           if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
           let legacyReleaseType = ''
           if (releaseType !== 'none') {
@@ -84,11 +86,13 @@ jobs:
             const releaseConfig = JSON.parse(fs.readFileSync(sourcePath, 'utf8'))
             if (!releaseConfig.packages && !releaseConfig['release-type']) {
               legacyReleaseType = releaseType
+            } else if (!fs.existsSync('.release-please-manifest.json')) {
+              throw new Error('Missing .release-please-manifest.json: run code-foundry sync to bootstrap the release manifest.')
             }
           }
           fs.appendFileSync(
             process.env.GITHUB_OUTPUT,
-            `release_type=${releaseType}\nlegacy_release_type=${legacyReleaseType}\nnpm_publish=${npmPublish}\n`,
+            `release_type=${releaseType}\nlegacy_release_type=${legacyReleaseType}\nnpm_publish=${npmPublish}\nrelease_merge_strategy=${releaseMergeStrategy}\n`,
           )
           NODE
       - name: Detect release credentials
@@ -161,14 +165,14 @@ jobs:
             gh pr merge "$pr" \
               --repo "$GITHUB_REPOSITORY" \
               --admin \
-              --rebase \
+              --${{ steps.profile.outputs.release_merge_strategy }} \
               --delete-branch
           done
 
   reconcile:
     name: Release / Reconcile
     needs: release
-    if: needs.release.outputs.release_created == 'true'
+    if: needs.release.result == 'success'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:

package/.github/workflows/security.yml

@@ -31,7 +31,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-security-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/test.yml

@@ -40,7 +40,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-test-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-test-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.32.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.0...v0.32.1) (2026-07-31)
+
+
+### Bug Fixes
+
+* **ci:** key runtime concurrency by event so promotion PRs do not cancel push checks ([5a8d8fd](https://github.com/0xPlayerOne/code-foundry/commit/5a8d8fd80e62feabc887869e07219a77f2c46c1a))
+* **release:** bootstrap release-please manifest during sync ([98c7e5d](https://github.com/0xPlayerOne/code-foundry/commit/98c7e5d9341eedf22d49611f19825a5ef8d6d596))
+* **release:** satisfy JSDoc type-check for manifest bootstrap ([02ddb45](https://github.com/0xPlayerOne/code-foundry/commit/02ddb459405ee9d54c91afdc3cf5602790a4c2b4))
+* **release:** squash release PRs so staging can fast-forward after releases ([5d9a788](https://github.com/0xPlayerOne/code-foundry/commit/5d9a78843fde4ce764237eacfde9b1720d15696e))
+
+## [0.32.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.18...v0.32.0) (2026-07-31)
+
+
+### Features
+
+* improve draft PR titles from branch conventions ([#290](https://github.com/0xPlayerOne/code-foundry/issues/290)) ([7b215db](https://github.com/0xPlayerOne/code-foundry/commit/7b215db961347dfdb74241fc2c3489d390b34533))
+
 ## [0.31.18](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.17...v0.31.18) (2026-07-30)
 
 

package/docs/CONFIGURATION.md

@@ -48,7 +48,7 @@ repository manifests and source
 | `npm_publish` | `true` or `false` | Opt into npm publication |
 | `license` | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3 |
 | `git_workflow` | `staging-release` | Branch/release model; the standard model promotes `staging` into `main` |
-| `merge_strategy` | `rebase`, `squash`, `merge` | Preferred merge method for contribution and release PRs; defaults to `rebase` |
+| `merge_strategy` | `rebase`, `squash`, `merge` | Preferred merge method for contribution and release PRs; defaults to `merge` |
 | `runner` fields | GitHub runner names | Per-workflow runner policy |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,

package/docs/RELEASES.md

@@ -12,9 +12,8 @@ Keep commits Conventional Commit-shaped (`feat:`, `fix:`, `docs:`, `ci:`,
 `chore:`, and so on). Release Please uses them to select patch/minor/major
 versions and generate grouped changelog notes.
 
-The default `merge_strategy` is `rebase`, matching the repository's linear
-history policy. Set it to `squash` or `merge` in `.github/code-foundry.yml` when
-that repository intentionally uses a different merge convention. The current
+The default `merge_strategy` is `merge`, matching promotion PRs from `staging` into `main`.
+Configure it to `squash` or `rebase` in `.github/code-foundry.yml` if a repository intentionally differs. The current
 supported `git_workflow` is `staging-release`.
 
 The release workflow opens or updates a versioned PR after changes reach
@@ -31,12 +30,30 @@ Set these values in `.github/code-foundry.yml`:
 ```yaml
 release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
+merge_strategy: merge # merge, squash, or rebase; used for promotion PRs
+release_merge_strategy: squash # merge, squash, or rebase; used for Release Please PRs
 ```
 
+`merge_strategy` applies to promotion PRs (`staging` into `main`); merging
+those with a merge commit keeps `staging` an ancestor of `main`.
+`release_merge_strategy` applies to Release Please version PRs; squash-merging
+them keeps `main`'s tip linear so the post-release reconciliation can
+fast-forward `staging` to `main` without violating `staging`'s required-linear-
+history rule. Defaults to `merge` when unset.
+
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
 repository without a package manifest and `none` for a repository that should
 not release automatically.
 
+Release Please runs in manifest mode whenever the release config declares
+`packages` or a top-level `release-type`; `code-foundry sync` bootstraps
+`.release-please-manifest.json` from the current package versions the first
+time it is needed. Release Please owns the manifest after the first release
+and sync never overwrites existing manifest versions. Legacy configs without
+`packages` or `release-type` continue to run in simple mode and need no
+manifest; `code-foundry doctor` fails when a manifest-mode config is missing
+its manifest.
+
 ## Pull request permissions
 
 Release Please falls back to the repository's `GITHUB_TOKEN` when a
@@ -54,6 +71,6 @@ the generated version pull request before using the token to merge it.
 
 1. Merge tested changes from `staging` into `main`.
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's normal linear-history policy.
+3. Merge the release PR with the repository.s configured `release_merge_strategy` (default `merge`, recommended `squash`).
 4. Confirm the GitHub Release and any package publication.
 5. Synchronize `staging` with the new `main` release commit.

package/docs/WORKFLOWS.md

@@ -61,13 +61,14 @@ checks disabled.
 
 ## Branch protection
 
-Use the repository's GitHub settings or the maintainer's branch-protection
-automation after reviewing the repository's enabled features:
+Use repository rulesets (or legacy branch protection settings) to mirror the
+required checks for each protected branch. Review the repository's enabled
+features and enforce only checks that actually run:
 
 ```bash
 Apply only checks for enabled workflows.
 ```
 
-Keep strict status checks, linear history, and conversation resolution enabled.
-For a repository with optional features disabled, do not require checks that
-will never run.
+Keep strict status checks, linear history, and conversation resolution enabled
+where required. For a repository with optional features disabled, do not require
+checks that will never run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.18",
+  "version": "0.32.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/doctor.mjs

@@ -56,6 +56,18 @@ export function doctor(root, options = {}) {
   }
   if (profile.languages.split(',').includes('python') && !commandExists('python') && !existsSync(join(target, '.venv/bin/python'))) error('Python is required for this repository')
 
+  const releaseConfigPath = join(target, 'release-please-config.json')
+  if (existsSync(releaseConfigPath)) {
+    /** @type {Record<string, any>} */
+    let releaseConfig = {}
+    try { releaseConfig = JSON.parse(readFileSync(releaseConfigPath, 'utf8')) }
+    catch { error('release-please-config.json is not valid JSON') }
+    const manifestMode = Boolean(releaseConfig.packages || releaseConfig['release-type'])
+    if (manifestMode && !existsSync(join(target, '.release-please-manifest.json'))) {
+      error('release-please-config.json requires .release-please-manifest.json; run code-foundry sync to bootstrap it')
+    }
+  }
+
   for (const workflow of ['ci', 'codeql', 'security', 'test', 'draft-pr', 'release-pr', 'release']) {
     if (includesValue(config.features ?? 'all', workflow) && !existsSync(join(target, `.github/workflows/${workflow}.yml`))) error(`missing enabled workflow: ${workflow}.yml`)
   }

package/src/commands/sync.mjs

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectLanguages, detectPackageManager, detectProfile, recommendRunners } from '../lib/profile.mjs'
 import { configured, includesValue, readConfig } from '../lib/config.mjs'
-import { buildReleaseConfig } from '../lib/release-manifest.mjs'
+import { buildReleaseConfig, buildReleaseManifest } from '../lib/release-manifest.mjs'
 import { customWorkflowFiles, overlayPolicy } from '../lib/overlay.mjs'
 
 const standardFiles = [
@@ -118,6 +118,27 @@ export function syncRepository(options) {
     }
   }
 
+  const releaseManifest = buildReleaseManifest(target, mergeReleaseConfig(target, sourcePath(source, 'release-please-config.json')))
+  if (releaseManifest) {
+    const manifestPath = join(target, '.release-please-manifest.json')
+    /** @type {Record<string, string>} */
+    let existingManifest = {}
+    if (existsSync(manifestPath)) {
+      try { existingManifest = JSON.parse(readFileSync(manifestPath, 'utf8')) }
+      catch { existingManifest = {} }
+    }
+    /** @type {Record<string, string>} */
+    const mergedManifest = {}
+    for (const directory of [...new Set([...Object.keys(releaseManifest), ...Object.keys(existingManifest)])].sort()) {
+      mergedManifest[directory] = existingManifest[directory] ?? releaseManifest[directory]
+    }
+    const content = `${JSON.stringify(mergedManifest, null, 2)}\n`
+    if (!existsSync(manifestPath) || readFileSync(manifestPath, 'utf8') !== content) {
+      changed.push('.release-please-manifest.json')
+      writeOrReport(manifestPath, content, dryRun)
+    }
+  }
+
   if (license !== 'preserve' && license !== 'none') {
     const licenseFile = license === 'mit' ? 'MIT.txt' : license === 'agpl-3.0-or-later' ? 'AGPL-3.0-or-later.txt' : 'GPL-3.0-or-later.txt'
     const sourceLicense = join(source, '.github/licenses', licenseFile)
@@ -161,8 +182,8 @@ export function syncRepository(options) {
   return { changed, config }
 }
 
-/** @param {string} target @param {string} sourceFile @returns {string} */
-function renderReleaseConfig(target, sourceFile) {
+/** @param {string} target @param {string} sourceFile @returns {Record<string, any>} */
+function mergeReleaseConfig(target, sourceFile) {
   let baseline = {}
   try { baseline = JSON.parse(readFileSync(sourceFile, 'utf8')) }
   catch { baseline = {} }
@@ -172,8 +193,12 @@ function renderReleaseConfig(target, sourceFile) {
     try { existing = JSON.parse(readFileSync(destination, 'utf8')) }
     catch { existing = baseline }
   }
-  const merged = { ...baseline, ...existing }
-  return `${JSON.stringify(buildReleaseConfig(target, merged), null, 2)}\n`
+  return buildReleaseConfig(target, { ...baseline, ...existing })
+}
+
+/** @param {string} target @param {string} sourceFile @returns {string} */
+function renderReleaseConfig(target, sourceFile) {
+  return `${JSON.stringify(mergeReleaseConfig(target, sourceFile), null, 2)}\n`
 }
 
 /** @param {string} file @param {string} languages @param {string} features @param {Record<string, string>} config */
@@ -339,7 +364,7 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'merge', release_merge_strategy: 'squash',
   }
 }
 

package/src/lib/github-doctor.mjs

@@ -15,23 +15,22 @@ export function doctorGithub(root) {
   const warnings = []
   /** @type {Record<string, any>} */
   const details = { repository }
+  const rulesets = hydrateRulesets(repository, ghJson(['api', `repos/${repository}/rulesets`]))
+  const mainRulesets = rulesetsForBranch(rulesets, 'main')
   const protection = ghJson(['api', `repos/${repository}/branches/main/protection`])
-  if (!protection) warnings.push('main branch protection is not readable or is not configured.')
-  else {
-    const required = requiredContexts(protection)
-    details.requiredChecks = required
-    const duplicateNames = required.filter((name) => /\b([^/]+) \/ \1\b/i.test(name))
-    if (duplicateNames.length) errors.push(`required checks contain duplicate workflow prefixes: ${duplicateNames.join(', ')}`)
-    if (!protection.required_status_checks) warnings.push('main protection has no required status checks.')
-  }
+  const required = mainRulesets.length ? requiredContextsFromRulesets(mainRulesets) : requiredContextsFromProtection(protection)
+  details.requiredChecks = required
+  if (!protection && !mainRulesets.length) warnings.push('main branch protection or repository rulesets are not readable or are not configured.')
+  else if (!required.length) warnings.push(mainRulesets.length ? 'main ruleset has no required status checks.' : 'main protection has no required status checks.')
+  const duplicateNames = required.filter((name) => /\b([^/]+) \/ \1\b/i.test(name))
+  if (duplicateNames.length) errors.push(`required checks contain duplicate workflow prefixes: ${duplicateNames.join(', ')}`)
 
   const sha = String(ghJson(['api', `repos/${repository}/git/ref/heads/main`])?.object?.sha ?? '')
   const checks = sha ? ghJson(['api', `repos/${repository}/commits/${sha}/check-runs?per_page=100`])?.check_runs ?? [] : []
   const observed = checks.map(/** @param {any} check */ (check) => check.name).filter(Boolean)
   details.observedChecks = observed
   if (!observed.length) warnings.push('no check runs were observed on the current main commit; exact check validation is deferred until CI runs.')
-  if (protection?.required_status_checks) {
-    const required = requiredContexts(protection)
+  if (required.length) {
     const missing = required.filter((name) => observed.length && !observed.includes(name))
     if (missing.length) warnings.push(`required checks not observed on current main: ${missing.join(', ')}`)
   }
@@ -70,13 +69,62 @@ export function doctorGithub(root) {
 }
 
 /** @param {any} protection @returns {string[]} */
-function requiredContexts(protection) {
+function requiredContextsFromProtection(protection) {
   return [...new Set([
-    ...(protection.required_status_checks?.contexts ?? []),
-    ...(protection.required_status_checks?.checks ?? []).map(/** @param {any} check */ (check) => check.context),
+    ...(protection?.required_status_checks?.contexts ?? []),
+    ...(protection?.required_status_checks?.checks ?? []).map(/** @param {any} check */ (check) => check.context),
   ].filter(Boolean))]
 }
 
+/** @param {any[]} rulesets @returns {string[]} */
+function requiredContextsFromRulesets(rulesets) {
+  return [...new Set(
+    (Array.isArray(rulesets) ? rulesets : []).flatMap((/** @type {any} */ ruleset) =>
+      (ruleset.rules ?? []).flatMap((/** @type {any} */ rule) =>
+        rule?.type === 'required_status_checks' ?
+          (rule.parameters?.required_status_checks ?? []).map((/** @type {any} */ check) => check?.context).filter(Boolean) :
+          []
+      ),
+    ),
+  )]
+}
+
+/** @param {string} repository @param {any[] | null} rulesets @returns {any[]} */
+function hydrateRulesets(repository, rulesets) {
+  if (!Array.isArray(rulesets)) return []
+  return rulesets.map((ruleset) => {
+    if (!ruleset?.id) return ruleset
+    const details = ghJson(['api', `repos/${repository}/rulesets/${ruleset.id}`])
+    return details && typeof details === 'object' ? details : ruleset
+  })
+}
+
+/** @param {any[] | null} rulesets @param {string} branch @returns {any[]} */
+function rulesetsForBranch(rulesets, branch) {
+  if (!Array.isArray(rulesets)) return []
+  return rulesets.filter((ruleset) => (
+    ruleset?.target === 'branch' &&
+    Array.isArray(ruleset?.conditions?.ref_name?.include) &&
+    Array.isArray(ruleset?.conditions?.ref_name?.exclude) &&
+    includesBranch(ruleset.conditions.ref_name.include, branch) &&
+    !includesBranch(ruleset.conditions.ref_name.exclude, branch)
+  ))
+}
+
+/** @param {(string | null | undefined)[]} patterns @param {string} branch @returns {boolean} */
+function includesBranch(patterns, branch) {
+  const target = `refs/heads/${branch}`
+  return patterns.some((pattern) => {
+    if (!pattern) return false
+    if (pattern === '~ALL') return true
+    if (pattern === target || pattern === branch) return true
+    if (!/[\*?]/.test(pattern)) return false
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\\\*/g, '.*').replace(/\\\?/g, '.')
+    const regex = new RegExp(`^${escaped}$`)
+    return regex.test(target) || regex.test(branch)
+  })
+}
+
 /** @param {string} root @returns {{ errors: string[], warnings: string[] }} */
 function inspectWorkflows(root) {
   /** @type {string[]} */

package/src/lib/release-manifest.mjs

@@ -66,6 +66,45 @@ export function buildReleaseConfig(root, existing = {}) {
   return result
 }
 
+/**
+ * Build the initial Release Please manifest from current package versions.
+ * Returns null when the config does not enable manifest mode (legacy configs
+ * without `packages`/`release-type` run in simple mode and need no manifest).
+ * @param {string} root
+ * @param {Record<string, any>} config
+ * @returns {Record<string, string>|null}
+ */
+export function buildReleaseManifest(root, config = {}) {
+  const packages = config.packages && typeof config.packages === 'object' && !Array.isArray(config.packages)
+    ? config.packages
+    : config['release-type'] ? { '.': {} } : null
+  if (!packages || !Object.keys(packages).length) return null
+  /** @type {Record<string, string>} */
+  const manifest = {}
+  for (const directory of Object.keys(packages)) {
+    manifest[directory] = readDirectoryVersion(join(root, directory === '.' ? '' : directory))
+  }
+  return manifest
+}
+
+/** @param {string} directory @returns {string} */
+function readDirectoryVersion(directory) {
+  const packagePath = join(directory, 'package.json')
+  if (existsSync(packagePath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(packagePath, 'utf8'))
+      if (typeof parsed?.version === 'string' && parsed.version) return parsed.version
+    } catch { /* fall through to other manifests */ }
+  }
+  for (const file of ['pyproject.toml', 'Cargo.toml']) {
+    const path = join(directory, file)
+    if (!existsSync(path)) continue
+    const match = readFileSync(path, 'utf8').match(/^version\s*=\s*["']([^"']+)["']/m)
+    if (match?.[1]) return match[1]
+  }
+  return '0.0.0'
+}
+
 /** @param {string} root @param {Record<string, any>} config @returns {string[]} */
 export function validateReleaseConfig(root, config) {
   const detected = detectReleasePackages(root)