code-foundry 0.31.8 → 0.31.10

package/.github/workflows/opencode-security_self-ci.yml

@@ -39,7 +39,7 @@ jobs:
     if: needs.detect.outputs.enabled == 'true' && needs.detect.outputs.token == 'true'
     uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@main
     with:
-      source_ref: main
+      source_ref: ${{ github.event.pull_request.head.ref || 'main' }}
       runner: ubuntu-latest
       mode: standard
       fail_on_severity: high

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.31.10](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.9...v0.31.10) (2026-07-30)
+
+
+### Bug Fixes
+
+* **opencode:** avoid duplicate self checks ([71b1201](https://github.com/0xPlayerOne/code-foundry/commit/71b1201baf58624401676b99fa257780b1eb1abc))
+
+## [0.31.9](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.8...v0.31.9) (2026-07-30)
+
+
+### Bug Fixes
+
+* **doctor:** deduplicate required check contexts ([f244494](https://github.com/0xPlayerOne/code-foundry/commit/f24449448f177c99978fe216b92385909f275d89))
+
 ## [0.31.8](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.7...v0.31.8) (2026-07-30)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.31.8",
+  "version": "0.31.10",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/lib/github-doctor.mjs

@@ -18,10 +18,7 @@ export function doctorGithub(root) {
   const protection = ghJson(['api', `repos/${repository}/branches/main/protection`])
   if (!protection) warnings.push('main branch protection is not readable or is not configured.')
   else {
-    const required = [
-      ...(protection.required_status_checks?.contexts ?? []),
-      ...(protection.required_status_checks?.checks ?? []).map(/** @param {any} check */ (check) => check.context),
-    ].filter(Boolean)
+    const required = requiredContexts(protection)
     details.requiredChecks = required
     const duplicateNames = required.filter((name) => /\b([^/]+) \/ \1\b/i.test(name))
     if (duplicateNames.length) errors.push(`required checks contain duplicate workflow prefixes: ${duplicateNames.join(', ')}`)
@@ -34,10 +31,7 @@ export function doctorGithub(root) {
   details.observedChecks = observed
   if (!observed.length) warnings.push('no check runs were observed on the current main commit; exact check validation is deferred until CI runs.')
   if (protection?.required_status_checks) {
-    const required = [
-      ...(protection.required_status_checks.contexts ?? []),
-      ...(protection.required_status_checks.checks ?? []).map(/** @param {any} check */ (check) => check.context),
-    ].filter(Boolean)
+    const required = requiredContexts(protection)
     const missing = required.filter((name) => observed.length && !observed.includes(name))
     if (missing.length) warnings.push(`required checks not observed on current main: ${missing.join(', ')}`)
   }
@@ -75,6 +69,14 @@ export function doctorGithub(root) {
   return { errors, warnings, details }
 }
 
+/** @param {any} protection @returns {string[]} */
+function requiredContexts(protection) {
+  return [...new Set([
+    ...(protection.required_status_checks?.contexts ?? []),
+    ...(protection.required_status_checks?.checks ?? []).map(/** @param {any} check */ (check) => check.context),
+  ].filter(Boolean))]
+}
+
 /** @param {string} root @returns {{ errors: string[], warnings: string[] }} */
 function inspectWorkflows(root) {
   /** @type {string[]} */

package/.github/workflows/opencode-security.yml

@@ -1,48 +0,0 @@
-name: Code Foundry
-
-on:
-  pull_request:
-    branches: [staging]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  detect:
-    name: OpenCode Security / Detect
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')
-    runs-on: ubuntu-slim
-    outputs:
-      enabled: ${{ steps.detect.outputs.enabled }}
-      token: ${{ steps.detect.outputs.token }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Detect configuration and token
-        id: detect
-        env:
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-        run: |
-          enabled=false
-          token=false
-          if grep -Eq '^opencode_security:\s*(true|auto)\s*$' .github/code-foundry.yml 2>/dev/null; then enabled=true; fi
-          if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
-          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
-          echo "token=$token" >> "$GITHUB_OUTPUT"
-
-  scan:
-    name: OpenCode Security / Scan
-    needs: detect
-    if: needs.detect.outputs.enabled == 'true' && needs.detect.outputs.token == 'true'
-    uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@main
-    with:
-      source_ref: main
-      runner: ubuntu-latest
-      mode: standard
-      fail_on_severity: high
-      max_cost_usd: 1
-    secrets:
-      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}