code-foundry 0.31.6 → 0.31.8

package/.github/code-foundry.yml

@@ -8,7 +8,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v0.27.15
+runtime_ref: v0.31.7
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later

package/.github/workflows/ci.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.20.2
+        default: v0.31.7
       runner:
         description: Runner used by CI jobs.
         required: false

package/.github/workflows/codeql.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.20.2
+        default: v0.31.7
       runner:
         description: Runner used by CodeQL jobs.
         required: false

package/.github/workflows/release-pr_self-ci.yml

@@ -3,16 +3,66 @@ name: Code Foundry
 on:
   push:
     branches: [staging]
+  pull_request:
+    branches: [main]
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   pull-requests: write
+  packages: read
+  security-events: write
 
 jobs:
   release-pr:
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      startsWith(github.head_ref, 'release-please--branches--main')
     name: Release PR
     uses: ./.github/workflows/release-pr.yml
     with:
       runner: ubuntu-slim
     secrets: inherit
+
+  ci:
+    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+    secrets: inherit
+
+  test:
+    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
+    name: Test
+    uses: ./.github/workflows/test.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+      unit-runner: ubuntu-slim
+    secrets: inherit
+
+  security:
+    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
+    name: Security
+    uses: ./.github/workflows/security.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-slim
+    secrets: inherit
+
+  codeql:
+    if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--branches--main')
+    name: CodeQL
+    uses: ./.github/workflows/codeql.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: ${{ github.sha }}
+      runner: ubuntu-latest
+    secrets: inherit

package/.github/workflows/release.yml

@@ -17,7 +17,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.27.18
+        default: v0.31.7
 
 permissions:
   actions: write
@@ -114,12 +114,11 @@ jobs:
         run: |
           echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. RELEASE_PLEASE_TOKEN is not configured, so Code Foundry skipped guarded auto-merge. Configure the token before merging when downstream release workflows must run automatically."
       - name: Merge generated version pull requests
-        if: steps.release.outputs.prs_created == 'true' && steps.credentials.outputs.auto_merge == 'true'
+        if: steps.credentials.outputs.auto_merge == 'true'
         env:
           GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
         run: |
           set -euo pipefail
-          node $RUNNER_TEMP/code-foundry/src/cli.mjs release validate-prs
           mapfile -t release_prs < <(
             gh pr list \
               --repo "$GITHUB_REPOSITORY" \
@@ -128,7 +127,37 @@ jobs:
               --json number,title,headRefName \
               --jq '.[] | select(.title | startswith("chore(main): release ")) | select(.headRefName | startswith("release-please--branches--main")) | .number'
           )
+          if [ "${#release_prs[@]}" -eq 0 ]; then
+            echo 'No generated release pull request is open; nothing to merge.'
+            exit 0
+          fi
+          node $RUNNER_TEMP/code-foundry/src/cli.mjs release validate-prs
           for pr in "${release_prs[@]}"; do
+            echo "Waiting for required checks on release PR #$pr"
+            checks_seen=false
+            for attempt in $(seq 1 60); do
+              if required_count=$(gh pr checks "$pr" \
+                --repo "$GITHUB_REPOSITORY" \
+                --required \
+                --json name \
+                --jq 'length' 2>/dev/null); then
+                if [ "$required_count" -gt 0 ]; then
+                  checks_seen=true
+                  break
+                fi
+              fi
+              sleep 5
+            done
+            if [ "$checks_seen" != true ]; then
+              echo "Required checks were not registered for release PR #$pr within the readiness window." >&2
+              exit 1
+            fi
+            gh pr checks "$pr" \
+              --repo "$GITHUB_REPOSITORY" \
+              --required \
+              --watch \
+              --fail-fast \
+              --interval 10
             gh pr merge "$pr" \
               --repo "$GITHUB_REPOSITORY" \
               --admin \

package/.github/workflows/security.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.20.2
+        default: v0.31.7
       runner:
         description: Runner used by Security jobs.
         required: false

package/.github/workflows/test.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.20.2
+        default: v0.31.7
       runner:
         description: Runner used by non-unit test jobs.
         required: false

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.31.8](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.7...v0.31.8) (2026-07-30)
+
+
+### Bug Fixes
+
+* **runtime:** pin self workflows to v0.31.7 ([565b5bc](https://github.com/0xPlayerOne/code-foundry/commit/565b5bcc2b8f4ade8b3addc02f72c96a42308325))
+
+## [0.31.7](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.6...v0.31.7) (2026-07-30)
+
+
+### Bug Fixes
+
+* **ci:** remove duplicate promotion checks ([b210b7f](https://github.com/0xPlayerOne/code-foundry/commit/b210b7f0aa5bdb6cb7e121cc751b6f618512ebf3))
+
 ## [0.31.6](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.5...v0.31.6) (2026-07-30)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.6",
+  "version": "0.31.8",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/release.mjs

@@ -74,8 +74,8 @@ function createSynchronizationPullRequest(root, repository, base, head, mainSha,
     if (apply.status !== 0) throw new Error(`Synchronization patch did not apply cleanly: ${apply.stderr.trim()}`)
     const add = spawnSync('git', ['add', '--', ...changedPaths], { cwd: root, encoding: 'utf8' })
     if (add.status !== 0) throw new Error(`Failed to stage synchronization metadata: ${add.stderr.trim()}`)
-    const commit = spawnSync('git', ['commit', '-m', `chore(release): synchronize ${base} -> ${head}`], { cwd: root, encoding: 'utf8' })
-    if (commit.status !== 0) throw new Error(`Failed to commit synchronization metadata: ${commit.stderr.trim()}`)
+    const identity = spawnSync('git', ['-c', 'user.name=github-actions[bot]', '-c', 'user.email=41898282+github-actions[bot]@users.noreply.github.com', 'commit', '-m', `chore(release): synchronize ${base} -> ${head}`], { cwd: root, encoding: 'utf8' })
+    if (identity.status !== 0) throw new Error(`Failed to commit synchronization metadata: ${identity.stderr.trim()}`)
     const push = spawnSync('git', ['push', '--set-upstream', 'origin', branch], { cwd: root, encoding: 'utf8', env: { ...process.env, GH_TOKEN: token } })
     if (push.status !== 0) throw new Error(`Failed to publish synchronization branch: ${push.stderr.trim()}`)
   }

package/.github/workflows/promotion_self-ci.yml

@@ -1,58 +0,0 @@
-name: Code Foundry
-
-on:
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  actions: read
-  contents: read
-  packages: read
-  pull-requests: read
-  security-events: write
-
-jobs:
-  ci:
-    name: CI
-    uses: ./.github/workflows/ci.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-    secrets: inherit
-
-  test:
-    name: Test
-    uses: ./.github/workflows/test.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-      unit-runner: ubuntu-slim
-    secrets: inherit
-
-  security:
-    name: Security
-    uses: ./.github/workflows/security.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-slim
-    secrets: inherit
-
-  codeql:
-    name: CodeQL
-    uses: ./.github/workflows/codeql.yml
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: ${{ github.sha }}
-      runner: ubuntu-latest
-    secrets: inherit
-
-  release-pr:
-    name: Release PR / Create
-    runs-on: ubuntu-slim
-    steps:
-      - name: Validate promotion
-        run: echo 'Main promotion validation is handled by this workflow; version release remains a post-merge action.'