code-foundry 0.32.0 → 0.32.1

package/.github/code-foundry.yml

@@ -17,6 +17,7 @@ npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: staging-release
 merge_strategy: merge
+release_merge_strategy: squash
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto

package/.github/workflows/ci.yml

@@ -35,7 +35,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-ci-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/codeql.yml

@@ -47,7 +47,7 @@ env:
   REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
 
 concurrency:
-  group: code-foundry-codeql-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-codeql-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/release.yml

@@ -72,7 +72,7 @@ jobs:
             : {}
           let releaseType = config.release_type || 'auto'
           let npmPublish = config.npm_publish || 'false'
-          let releaseMergeStrategy = String(config.merge_strategy || 'merge').trim().toLowerCase()
+          let releaseMergeStrategy = String(config.release_merge_strategy || config.merge_strategy || 'merge').trim().toLowerCase()
           if (releaseType === 'auto') {
             releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
           }
@@ -86,6 +86,8 @@ jobs:
             const releaseConfig = JSON.parse(fs.readFileSync(sourcePath, 'utf8'))
             if (!releaseConfig.packages && !releaseConfig['release-type']) {
               legacyReleaseType = releaseType
+            } else if (!fs.existsSync('.release-please-manifest.json')) {
+              throw new Error('Missing .release-please-manifest.json: run code-foundry sync to bootstrap the release manifest.')
             }
           }
           fs.appendFileSync(
@@ -170,7 +172,7 @@ jobs:
   reconcile:
     name: Release / Reconcile
     needs: release
-    if: needs.release.outputs.release_created == 'true'
+    if: needs.release.result == 'success'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:

package/.github/workflows/security.yml

@@ -31,7 +31,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-security-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/test.yml

@@ -40,7 +40,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-test-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-test-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.32.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.0...v0.32.1) (2026-07-31)
+
+
+### Bug Fixes
+
+* **ci:** key runtime concurrency by event so promotion PRs do not cancel push checks ([5a8d8fd](https://github.com/0xPlayerOne/code-foundry/commit/5a8d8fd80e62feabc887869e07219a77f2c46c1a))
+* **release:** bootstrap release-please manifest during sync ([98c7e5d](https://github.com/0xPlayerOne/code-foundry/commit/98c7e5d9341eedf22d49611f19825a5ef8d6d596))
+* **release:** satisfy JSDoc type-check for manifest bootstrap ([02ddb45](https://github.com/0xPlayerOne/code-foundry/commit/02ddb459405ee9d54c91afdc3cf5602790a4c2b4))
+* **release:** squash release PRs so staging can fast-forward after releases ([5d9a788](https://github.com/0xPlayerOne/code-foundry/commit/5d9a78843fde4ce764237eacfde9b1720d15696e))
+
 ## [0.32.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.18...v0.32.0) (2026-07-31)
 
 

package/docs/RELEASES.md

@@ -30,12 +30,30 @@ Set these values in `.github/code-foundry.yml`:
 ```yaml
 release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
+merge_strategy: merge # merge, squash, or rebase; used for promotion PRs
+release_merge_strategy: squash # merge, squash, or rebase; used for Release Please PRs
 ```
 
+`merge_strategy` applies to promotion PRs (`staging` into `main`); merging
+those with a merge commit keeps `staging` an ancestor of `main`.
+`release_merge_strategy` applies to Release Please version PRs; squash-merging
+them keeps `main`'s tip linear so the post-release reconciliation can
+fast-forward `staging` to `main` without violating `staging`'s required-linear-
+history rule. Defaults to `merge` when unset.
+
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
 repository without a package manifest and `none` for a repository that should
 not release automatically.
 
+Release Please runs in manifest mode whenever the release config declares
+`packages` or a top-level `release-type`; `code-foundry sync` bootstraps
+`.release-please-manifest.json` from the current package versions the first
+time it is needed. Release Please owns the manifest after the first release
+and sync never overwrites existing manifest versions. Legacy configs without
+`packages` or `release-type` continue to run in simple mode and need no
+manifest; `code-foundry doctor` fails when a manifest-mode config is missing
+its manifest.
+
 ## Pull request permissions
 
 Release Please falls back to the repository's `GITHUB_TOKEN` when a
@@ -53,6 +71,6 @@ the generated version pull request before using the token to merge it.
 
 1. Merge tested changes from `staging` into `main`.
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's configured `merge_strategy` (default `merge`).
+3. Merge the release PR with the repository.s configured `release_merge_strategy` (default `merge`, recommended `squash`).
 4. Confirm the GitHub Release and any package publication.
 5. Synchronize `staging` with the new `main` release commit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/doctor.mjs

@@ -56,6 +56,18 @@ export function doctor(root, options = {}) {
   }
   if (profile.languages.split(',').includes('python') && !commandExists('python') && !existsSync(join(target, '.venv/bin/python'))) error('Python is required for this repository')
 
+  const releaseConfigPath = join(target, 'release-please-config.json')
+  if (existsSync(releaseConfigPath)) {
+    /** @type {Record<string, any>} */
+    let releaseConfig = {}
+    try { releaseConfig = JSON.parse(readFileSync(releaseConfigPath, 'utf8')) }
+    catch { error('release-please-config.json is not valid JSON') }
+    const manifestMode = Boolean(releaseConfig.packages || releaseConfig['release-type'])
+    if (manifestMode && !existsSync(join(target, '.release-please-manifest.json'))) {
+      error('release-please-config.json requires .release-please-manifest.json; run code-foundry sync to bootstrap it')
+    }
+  }
+
   for (const workflow of ['ci', 'codeql', 'security', 'test', 'draft-pr', 'release-pr', 'release']) {
     if (includesValue(config.features ?? 'all', workflow) && !existsSync(join(target, `.github/workflows/${workflow}.yml`))) error(`missing enabled workflow: ${workflow}.yml`)
   }

package/src/commands/sync.mjs

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectLanguages, detectPackageManager, detectProfile, recommendRunners } from '../lib/profile.mjs'
 import { configured, includesValue, readConfig } from '../lib/config.mjs'
-import { buildReleaseConfig } from '../lib/release-manifest.mjs'
+import { buildReleaseConfig, buildReleaseManifest } from '../lib/release-manifest.mjs'
 import { customWorkflowFiles, overlayPolicy } from '../lib/overlay.mjs'
 
 const standardFiles = [
@@ -118,6 +118,27 @@ export function syncRepository(options) {
     }
   }
 
+  const releaseManifest = buildReleaseManifest(target, mergeReleaseConfig(target, sourcePath(source, 'release-please-config.json')))
+  if (releaseManifest) {
+    const manifestPath = join(target, '.release-please-manifest.json')
+    /** @type {Record<string, string>} */
+    let existingManifest = {}
+    if (existsSync(manifestPath)) {
+      try { existingManifest = JSON.parse(readFileSync(manifestPath, 'utf8')) }
+      catch { existingManifest = {} }
+    }
+    /** @type {Record<string, string>} */
+    const mergedManifest = {}
+    for (const directory of [...new Set([...Object.keys(releaseManifest), ...Object.keys(existingManifest)])].sort()) {
+      mergedManifest[directory] = existingManifest[directory] ?? releaseManifest[directory]
+    }
+    const content = `${JSON.stringify(mergedManifest, null, 2)}\n`
+    if (!existsSync(manifestPath) || readFileSync(manifestPath, 'utf8') !== content) {
+      changed.push('.release-please-manifest.json')
+      writeOrReport(manifestPath, content, dryRun)
+    }
+  }
+
   if (license !== 'preserve' && license !== 'none') {
     const licenseFile = license === 'mit' ? 'MIT.txt' : license === 'agpl-3.0-or-later' ? 'AGPL-3.0-or-later.txt' : 'GPL-3.0-or-later.txt'
     const sourceLicense = join(source, '.github/licenses', licenseFile)
@@ -161,8 +182,8 @@ export function syncRepository(options) {
   return { changed, config }
 }
 
-/** @param {string} target @param {string} sourceFile @returns {string} */
-function renderReleaseConfig(target, sourceFile) {
+/** @param {string} target @param {string} sourceFile @returns {Record<string, any>} */
+function mergeReleaseConfig(target, sourceFile) {
   let baseline = {}
   try { baseline = JSON.parse(readFileSync(sourceFile, 'utf8')) }
   catch { baseline = {} }
@@ -172,8 +193,12 @@ function renderReleaseConfig(target, sourceFile) {
     try { existing = JSON.parse(readFileSync(destination, 'utf8')) }
     catch { existing = baseline }
   }
-  const merged = { ...baseline, ...existing }
-  return `${JSON.stringify(buildReleaseConfig(target, merged), null, 2)}\n`
+  return buildReleaseConfig(target, { ...baseline, ...existing })
+}
+
+/** @param {string} target @param {string} sourceFile @returns {string} */
+function renderReleaseConfig(target, sourceFile) {
+  return `${JSON.stringify(mergeReleaseConfig(target, sourceFile), null, 2)}\n`
 }
 
 /** @param {string} file @param {string} languages @param {string} features @param {Record<string, string>} config */
@@ -339,7 +364,7 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'merge',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'merge', release_merge_strategy: 'squash',
   }
 }
 

package/src/lib/release-manifest.mjs

@@ -66,6 +66,45 @@ export function buildReleaseConfig(root, existing = {}) {
   return result
 }
 
+/**
+ * Build the initial Release Please manifest from current package versions.
+ * Returns null when the config does not enable manifest mode (legacy configs
+ * without `packages`/`release-type` run in simple mode and need no manifest).
+ * @param {string} root
+ * @param {Record<string, any>} config
+ * @returns {Record<string, string>|null}
+ */
+export function buildReleaseManifest(root, config = {}) {
+  const packages = config.packages && typeof config.packages === 'object' && !Array.isArray(config.packages)
+    ? config.packages
+    : config['release-type'] ? { '.': {} } : null
+  if (!packages || !Object.keys(packages).length) return null
+  /** @type {Record<string, string>} */
+  const manifest = {}
+  for (const directory of Object.keys(packages)) {
+    manifest[directory] = readDirectoryVersion(join(root, directory === '.' ? '' : directory))
+  }
+  return manifest
+}
+
+/** @param {string} directory @returns {string} */
+function readDirectoryVersion(directory) {
+  const packagePath = join(directory, 'package.json')
+  if (existsSync(packagePath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(packagePath, 'utf8'))
+      if (typeof parsed?.version === 'string' && parsed.version) return parsed.version
+    } catch { /* fall through to other manifests */ }
+  }
+  for (const file of ['pyproject.toml', 'Cargo.toml']) {
+    const path = join(directory, file)
+    if (!existsSync(path)) continue
+    const match = readFileSync(path, 'utf8').match(/^version\s*=\s*["']([^"']+)["']/m)
+    if (match?.[1]) return match[1]
+  }
+  return '0.0.0'
+}
+
 /** @param {string} root @param {Record<string, any>} config @returns {string[]} */
 export function validateReleaseConfig(root, config) {
   const detected = detectReleasePackages(root)