code-foundry 0.31.3 → 0.31.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.31.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.3...v0.31.4) (2026-07-29)
+
+
+### Bug Fixes
+
+* harden fleet pins and github doctor ([c6efa7a](https://github.com/0xPlayerOne/code-foundry/commit/c6efa7a436308959950d958c5897574193cd763b))
+
 ## [0.31.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.2...v0.31.3) (2026-07-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.3",
+  "version": "0.31.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/fleet.mjs

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { existsSync, mkdtempSync, readFileSync, readdirSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { spawnSync } from 'node:child_process'
@@ -73,6 +73,17 @@ function upgradeRepository(repository, source, version) {
     const add = spawnSync('git', ['-C', repository.path, 'worktree', 'add', '-b', branch, temporary, baseline.stdout.trim()], { encoding: 'utf8' })
     if (add.status !== 0) return { path: repository.path, status: 'skipped', reason: add.stderr.trim() || 'unable to create isolated worktree' }
     const result = syncRepository({ target: temporary, source, force: false })
+    const configFile = join(temporary, '.github/code-foundry.yml')
+    if (existsSync(configFile)) {
+      const current = readFileSync(configFile, 'utf8')
+      const updated = current.match(/^runtime_ref:\s*.*$/m)
+        ? current.replace(/^runtime_ref:\s*.*$/m, `runtime_ref: ${version}`)
+        : `${current.trimEnd()}\nruntime_ref: ${version}\n`
+      if (updated !== current) {
+        writeFileSync(configFile, updated)
+        if (!result.changed.includes('.github/code-foundry.yml')) result.changed.push('.github/code-foundry.yml')
+      }
+    }
     if (!result.changed.length) return { path: repository.path, status: 'unchanged', branch }
     spawnSync('git', ['-C', temporary, 'add', '-A'], { stdio: 'ignore' })
     const commit = spawnSync('git', ['-C', temporary, 'commit', '-m', `chore(code-foundry): upgrade runtime to ${version}`], { encoding: 'utf8' })

package/src/lib/github-doctor.mjs

@@ -55,6 +55,16 @@ export function doctorGithub(root) {
   if (['workflow-dispatch', 'dispatch'].includes(config.post_release_mode) && config.post_release !== 'false' && !details.secrets.releasePleaseTokenPresent) {
     errors.push('post-release workflow-dispatch mode requires RELEASE_PLEASE_TOKEN to be present.')
   }
+  const credentialChecks = {
+    npmTokenPresent: secretNames.includes('NPM_TOKEN'),
+    turboTokenPresent: secretNames.includes('TURBO_TOKEN'),
+    turboTeamPresent: Boolean(ghJson(['variable', 'list', '--repo', repository, '--json', 'name'])?.some(/** @param {{ name?: string }} variable */ (variable) => variable.name === 'TURBO_TEAM')),
+    opencodeApiKeyPresent: secretNames.includes('OPENCODE_API_KEY'),
+  }
+  details.credentials = credentialChecks
+  if (config.npm_publish === 'true' && !credentialChecks.npmTokenPresent) warnings.push('npm_publish is enabled but NPM_TOKEN is not configured; npm trusted publishing must be configured for tokenless publication.')
+  if (['true', 'auto'].includes(config.turbo_remote ?? 'false') && (!credentialChecks.turboTokenPresent || !credentialChecks.turboTeamPresent)) warnings.push('turbo_remote is enabled but TURBO_TOKEN and/or TURBO_TEAM is not configured; remote caching will be skipped.')
+  if (['true', 'auto'].includes(config.opencode_security ?? 'false') && !credentialChecks.opencodeApiKeyPresent) warnings.push('opencode_security is enabled but OPENCODE_API_KEY is not configured; the optional scan will be skipped.')
 
   const prs = ghJson(['pr', 'list', '--repo', repository, '--state', 'open', '--base', 'main', '--json', 'number,title,headRefName'])
   const openPrs = Array.isArray(prs) ? prs : []