code-foundry 0.32.0 → 0.32.2

package/.github/code-foundry.yml

@@ -16,7 +16,8 @@ release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: staging-release
-merge_strategy: merge
+merge_strategy: rebase
+release_merge_strategy: rebase
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto

package/.github/workflows/ci.yml

@@ -35,7 +35,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-ci-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-ci-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/codeql.yml

@@ -47,7 +47,7 @@ env:
   REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
 
 concurrency:
-  group: code-foundry-codeql-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-codeql-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/release-pr.yml

@@ -157,7 +157,7 @@ jobs:
           ### Validation
 
           - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge using the repository's configured \`merge_strategy\` (default: **merge**).
+          - Merge using the repository's configured \`merge_strategy\` (default: **rebase**).
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 

package/.github/workflows/release.yml

@@ -72,7 +72,7 @@ jobs:
             : {}
           let releaseType = config.release_type || 'auto'
           let npmPublish = config.npm_publish || 'false'
-          let releaseMergeStrategy = String(config.merge_strategy || 'merge').trim().toLowerCase()
+          let releaseMergeStrategy = String(config.release_merge_strategy || config.merge_strategy || 'merge').trim().toLowerCase()
           if (releaseType === 'auto') {
             releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
           }
@@ -86,6 +86,8 @@ jobs:
             const releaseConfig = JSON.parse(fs.readFileSync(sourcePath, 'utf8'))
             if (!releaseConfig.packages && !releaseConfig['release-type']) {
               legacyReleaseType = releaseType
+            } else if (!fs.existsSync('.release-please-manifest.json')) {
+              throw new Error('Missing .release-please-manifest.json: run code-foundry sync to bootstrap the release manifest.')
             }
           }
           fs.appendFileSync(
@@ -170,7 +172,7 @@ jobs:
   reconcile:
     name: Release / Reconcile
     needs: release
-    if: needs.release.outputs.release_created == 'true'
+    if: needs.release.result == 'success'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:

package/.github/workflows/security.yml

@@ -31,7 +31,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-security-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/.github/workflows/test.yml

@@ -40,7 +40,7 @@ env:
   REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: code-foundry-test-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  group: code-foundry-test-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.32.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.1...v0.32.2) (2026-07-31)
+
+
+### Bug Fixes
+
+* **release:** mirror staging onto main and require rebase merges on main ([31ab9b1](https://github.com/0xPlayerOne/code-foundry/commit/31ab9b125e66ae35f7d2a2c6893d0a3aec5d4560))
+* **release:** synchronize staging with a linear commit instead of a blocked fast-forward ([b808dff](https://github.com/0xPlayerOne/code-foundry/commit/b808dffeae38ec8211f8f0dee79e19d60f70b708))
+
+## [0.32.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.0...v0.32.1) (2026-07-31)
+
+
+### Bug Fixes
+
+* **ci:** key runtime concurrency by event so promotion PRs do not cancel push checks ([5a8d8fd](https://github.com/0xPlayerOne/code-foundry/commit/5a8d8fd80e62feabc887869e07219a77f2c46c1a))
+* **release:** bootstrap release-please manifest during sync ([98c7e5d](https://github.com/0xPlayerOne/code-foundry/commit/98c7e5d9341eedf22d49611f19825a5ef8d6d596))
+* **release:** satisfy JSDoc type-check for manifest bootstrap ([02ddb45](https://github.com/0xPlayerOne/code-foundry/commit/02ddb459405ee9d54c91afdc3cf5602790a4c2b4))
+* **release:** squash release PRs so staging can fast-forward after releases ([5d9a788](https://github.com/0xPlayerOne/code-foundry/commit/5d9a78843fde4ce764237eacfde9b1720d15696e))
+
 ## [0.32.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.31.18...v0.32.0) (2026-07-31)
 
 

package/docs/RELEASES.md

@@ -30,12 +30,35 @@ Set these values in `.github/code-foundry.yml`:
 ```yaml
 release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
+merge_strategy: rebase # merge, squash, or rebase; used for promotion PRs
+release_merge_strategy: rebase # merge, squash, or rebase; used for Release Please PRs
 ```
 
+`merge_strategy` applies to promotion PRs (`staging` into `main`) and
+`release_merge_strategy` to Release Please version PRs; both default to
+`merge` when unset. Use **rebase** for both. Rebase merges keep `main` fully
+linear, which is what makes the post-release reconciliation possible:
+`staging` requires linear history, and any merge commit on `main` becomes an
+uncrossable barrier for `staging` (the linear-history rule rejects pushes
+whose new commits contain merge commits). With a linear `main`, the release
+workflow mirrors `staging` onto `main`'s tip after every release — a verified
+fast-forward when possible, otherwise a forced linear update, otherwise a
+single-parent synchronization commit — so `staging` is never left behind and
+never needs a manual rebase.
+
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
 repository without a package manifest and `none` for a repository that should
 not release automatically.
 
+Release Please runs in manifest mode whenever the release config declares
+`packages` or a top-level `release-type`; `code-foundry sync` bootstraps
+`.release-please-manifest.json` from the current package versions the first
+time it is needed. Release Please owns the manifest after the first release
+and sync never overwrites existing manifest versions. Legacy configs without
+`packages` or `release-type` continue to run in simple mode and need no
+manifest; `code-foundry doctor` fails when a manifest-mode config is missing
+its manifest.
+
 ## Pull request permissions
 
 Release Please falls back to the repository's `GITHUB_TOKEN` when a
@@ -53,6 +76,6 @@ the generated version pull request before using the token to merge it.
 
 1. Merge tested changes from `staging` into `main`.
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's configured `merge_strategy` (default `merge`).
+3. Merge the release PR with the repository's configured `release_merge_strategy` (default `merge`, recommended `rebase`).
 4. Confirm the GitHub Release and any package publication.
 5. Synchronize `staging` with the new `main` release commit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.32.0",
+  "version": "0.32.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/doctor.mjs

@@ -56,6 +56,18 @@ export function doctor(root, options = {}) {
   }
   if (profile.languages.split(',').includes('python') && !commandExists('python') && !existsSync(join(target, '.venv/bin/python'))) error('Python is required for this repository')
 
+  const releaseConfigPath = join(target, 'release-please-config.json')
+  if (existsSync(releaseConfigPath)) {
+    /** @type {Record<string, any>} */
+    let releaseConfig = {}
+    try { releaseConfig = JSON.parse(readFileSync(releaseConfigPath, 'utf8')) }
+    catch { error('release-please-config.json is not valid JSON') }
+    const manifestMode = Boolean(releaseConfig.packages || releaseConfig['release-type'])
+    if (manifestMode && !existsSync(join(target, '.release-please-manifest.json'))) {
+      error('release-please-config.json requires .release-please-manifest.json; run code-foundry sync to bootstrap it')
+    }
+  }
+
   for (const workflow of ['ci', 'codeql', 'security', 'test', 'draft-pr', 'release-pr', 'release']) {
     if (includesValue(config.features ?? 'all', workflow) && !existsSync(join(target, `.github/workflows/${workflow}.yml`))) error(`missing enabled workflow: ${workflow}.yml`)
   }

package/src/commands/release.mjs

@@ -10,8 +10,9 @@ import { hasDeliveredHook, releaseDeliveryKey, selectHookDelivery } from '../lib
 
 /**
  * Reconcile staging after Release Please updates main. The local mode is
- * deterministic and suitable for CI; --github applies only a verified
- * fast-forward through the GitHub API and otherwise fails closed.
+ * deterministic and suitable for CI; --github mirrors staging onto main's
+ * tip through the GitHub API (fast-forward, then forced, then a linear sync
+ * commit) and otherwise fails closed.
  * @param {string} root
  * @param {ReleaseOptions} options
  */
@@ -38,55 +39,31 @@ export function reconcileRelease(root, options) {
   })
   console.log(JSON.stringify({ base, head, ...plan }, null, 2))
   if (plan.action === 'fail') throw new Error(plan.reason + (plan.unexpected?.length ? ` Unexpected paths: ${plan.unexpected.join(', ')}` : ''))
-  if (plan.action === 'pull-request' && options.github && !options.dryRun) {
-    if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for synchronization PRs.')
-    const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
-    if (!token) throw new Error('GH_TOKEN or GITHUB_TOKEN is required for synchronization PRs.')
-    const existing = ghJson(target, ['pr', 'list', '--repo', process.env.GITHUB_REPOSITORY, '--state', 'open', '--base', head, '--search', `chore(release): synchronize ${base} -> ${head} in:title`, '--json', 'number,url,headRefName'])
-    if (Array.isArray(existing) && existing.length) {
-      return { ...plan, synchronizationPullRequest: existing[0].url ?? existing[0].number }
-    }
-    const synchronizationPullRequest = createSynchronizationPullRequest(target, process.env.GITHUB_REPOSITORY, base, head, mainSha, stagingSha, mainChangedPaths, token)
-    return { ...plan, synchronizationPullRequest }
-  }
-  if (plan.action !== 'fast-forward' || !options.github || options.dryRun) return plan
+  if (!['fast-forward', 'pull-request', 'aligned'].includes(plan.action) || !options.github || options.dryRun) return plan
   if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for --github reconciliation.')
   const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
   if (!token) throw new Error('GH_TOKEN or GITHUB_TOKEN is required for --github reconciliation.')
-  const result = spawnSync('gh', [
+  const targetSha = /** @type {string} */ (plan.targetSha)
+  // 1. Verified fast-forward through the API (linear, no force).
+  const fastForward = spawnSync('gh', [
     'api', '--method', 'PATCH', `repos/${process.env.GITHUB_REPOSITORY}/git/refs/heads/${head}`,
-    '-f', `sha=${plan.targetSha}`, '-F', 'force=false',
+    '-f', `sha=${targetSha}`, '-F', 'force=false',
   ], { cwd: target, stdio: 'inherit', env: { ...process.env, GH_TOKEN: token } })
-  if (result.status !== 0) throw new Error(`GitHub refused the protected fast-forward of ${head}.`)
-  return plan
-}
-
-/** @param {string} root @param {string} repository @param {string} base @param {string} head @param {string} mainSha @param {string} stagingSha @param {string[]} changedPaths @param {string} token */
-function createSynchronizationPullRequest(root, repository, base, head, mainSha, stagingSha, changedPaths, token) {
-  const branch = `codex/release-sync-${head}-${mainSha.slice(0, 12)}`
-  const remote = spawnSync('git', ['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${branch}`], { cwd: root, encoding: 'utf8' })
-  if (remote.status !== 0) {
-    const checkout = spawnSync('git', ['switch', '--create', branch, `origin/${head}`], { cwd: root, encoding: 'utf8' })
-    if (checkout.status !== 0) throw new Error(`Failed to create synchronization branch: ${checkout.stderr.trim()}`)
-    const patch = spawnSync('git', ['diff', '--binary', stagingSha, mainSha, '--', ...changedPaths], { cwd: root, encoding: 'utf8' })
-    if (patch.status !== 0) throw new Error(`Failed to prepare synchronization patch: ${patch.stderr.trim()}`)
-    const apply = spawnSync('git', ['apply', '--whitespace=nowarn'], { cwd: root, input: patch.stdout, encoding: 'utf8' })
-    if (apply.status !== 0) throw new Error(`Synchronization patch did not apply cleanly: ${apply.stderr.trim()}`)
-    const add = spawnSync('git', ['add', '--', ...changedPaths], { cwd: root, encoding: 'utf8' })
-    if (add.status !== 0) throw new Error(`Failed to stage synchronization metadata: ${add.stderr.trim()}`)
-    const identity = spawnSync('git', ['-c', 'user.name=github-actions[bot]', '-c', 'user.email=41898282+github-actions[bot]@users.noreply.github.com', 'commit', '-m', `chore(release): synchronize ${base} -> ${head}`], { cwd: root, encoding: 'utf8' })
-    if (identity.status !== 0) throw new Error(`Failed to commit synchronization metadata: ${identity.stderr.trim()}`)
-    const push = spawnSync('git', ['push', '--set-upstream', 'origin', branch], { cwd: root, encoding: 'utf8', env: { ...process.env, GH_TOKEN: token } })
-    if (push.status !== 0) throw new Error(`Failed to publish synchronization branch: ${push.stderr.trim()}`)
-  }
-  const result = spawnSync('gh', [
-    'pr', 'create', '--repo', repository,
-    '--base', head, '--head', branch,
-    '--title', `chore(release): synchronize ${base} -> ${head}`,
-    '--body', `Synchronize ${head} with ${base} after Release Please publication.\n\nCode Foundry verified that only approved release metadata differs between the branch tips, then applied that metadata to an isolated synchronization branch.`,
-  ], { cwd: resolve(root), encoding: 'utf8', env: { ...process.env, GH_TOKEN: token } })
-    if (result.status !== 0) throw new Error(`Failed to create synchronization PR: ${result.stderr.trim()}`)
-  return result.stdout.trim()
+  if (fastForward.status === 0) return { ...plan, synchronization: 'fast-forward' }
+  // 2. Forced update when staging may be rewritten without violating the
+  // linear-history rule (main's tip is linear and already contains staging's
+  // content, so nothing unpromoted is lost).
+  const forced = spawnSync('gh', [
+    'api', '--method', 'PATCH', `repos/${process.env.GITHUB_REPOSITORY}/git/refs/heads/${head}`,
+    '-f', `sha=${targetSha}`, '-F', 'force=true',
+  ], { cwd: target, stdio: 'inherit', env: { ...process.env, GH_TOKEN: token } })
+  if (forced.status === 0) return { ...plan, synchronization: 'forced' }
+  // 3. Linear sync commit fallback: staging keeps its history and receives
+  // main's tree as a single-parent commit, which the ruleset always accepts.
+  const syncSha = createLinearSyncCommit(target, stagingSha, targetSha)
+  const push = spawnSync('git', ['push', 'origin', `${syncSha}:refs/heads/${head}`], { cwd: target, stdio: 'inherit', env: { ...process.env, GH_TOKEN: token } })
+  if (push.status !== 0) throw new Error(`GitHub refused the linear synchronization of ${head}.`)
+  return { ...plan, syncSha, synchronization: 'linear-commit' }
 }
 
 /**
@@ -170,6 +147,24 @@ function git(root, args) {
   return result.status === 0 ? result.stdout.trim() : ''
 }
 
+/**
+ * Build a linear commit whose tree equals main's tip and whose parent is the
+ * current staging tip. Staging requires linear history and main's tip almost
+ * always sits behind promotion merge commits, so a direct fast-forward to
+ * main's tip is rejected by the branch ruleset ("must not contain merge
+ * commits"). A single-parent commit is always pushable and keeps staging
+ * content-identical to main.
+ * @param {string} root @param {string} parentSha @param {string} mainSha @returns {string}
+ */
+function createLinearSyncCommit(root, parentSha, mainSha) {
+  const tree = git(root, ['rev-parse', `${mainSha}^{tree}`])
+  if (!tree) throw new Error('Failed to resolve the target tree.')
+  const identity = ['-c', 'user.name=github-actions[bot]', '-c', 'user.email=41898282+github-actions[bot]@users.noreply.github.com']
+  const result = spawnSync('git', [...identity, 'commit-tree', tree, '-p', parentSha, '-m', 'chore(release): synchronize staging with main'], { cwd: resolve(root), encoding: 'utf8' })
+  if (result.status !== 0) throw new Error(`Failed to create the synchronization commit: ${result.stderr.trim()}`)
+  return result.stdout.trim()
+}
+
 /** @param {string} root @param {string} from @param {string} to @returns {string[]} */
 function diffNames(root, from, to) {
   if (!from || !to || from === to) return []

package/src/commands/sync.mjs

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectLanguages, detectPackageManager, detectProfile, recommendRunners } from '../lib/profile.mjs'
 import { configured, includesValue, readConfig } from '../lib/config.mjs'
-import { buildReleaseConfig } from '../lib/release-manifest.mjs'
+import { buildReleaseConfig, buildReleaseManifest } from '../lib/release-manifest.mjs'
 import { customWorkflowFiles, overlayPolicy } from '../lib/overlay.mjs'
 
 const standardFiles = [
@@ -118,6 +118,27 @@ export function syncRepository(options) {
     }
   }
 
+  const releaseManifest = buildReleaseManifest(target, mergeReleaseConfig(target, sourcePath(source, 'release-please-config.json')))
+  if (releaseManifest) {
+    const manifestPath = join(target, '.release-please-manifest.json')
+    /** @type {Record<string, string>} */
+    let existingManifest = {}
+    if (existsSync(manifestPath)) {
+      try { existingManifest = JSON.parse(readFileSync(manifestPath, 'utf8')) }
+      catch { existingManifest = {} }
+    }
+    /** @type {Record<string, string>} */
+    const mergedManifest = {}
+    for (const directory of [...new Set([...Object.keys(releaseManifest), ...Object.keys(existingManifest)])].sort()) {
+      mergedManifest[directory] = existingManifest[directory] ?? releaseManifest[directory]
+    }
+    const content = `${JSON.stringify(mergedManifest, null, 2)}\n`
+    if (!existsSync(manifestPath) || readFileSync(manifestPath, 'utf8') !== content) {
+      changed.push('.release-please-manifest.json')
+      writeOrReport(manifestPath, content, dryRun)
+    }
+  }
+
   if (license !== 'preserve' && license !== 'none') {
     const licenseFile = license === 'mit' ? 'MIT.txt' : license === 'agpl-3.0-or-later' ? 'AGPL-3.0-or-later.txt' : 'GPL-3.0-or-later.txt'
     const sourceLicense = join(source, '.github/licenses', licenseFile)
@@ -161,8 +182,8 @@ export function syncRepository(options) {
   return { changed, config }
 }
 
-/** @param {string} target @param {string} sourceFile @returns {string} */
-function renderReleaseConfig(target, sourceFile) {
+/** @param {string} target @param {string} sourceFile @returns {Record<string, any>} */
+function mergeReleaseConfig(target, sourceFile) {
   let baseline = {}
   try { baseline = JSON.parse(readFileSync(sourceFile, 'utf8')) }
   catch { baseline = {} }
@@ -172,8 +193,12 @@ function renderReleaseConfig(target, sourceFile) {
     try { existing = JSON.parse(readFileSync(destination, 'utf8')) }
     catch { existing = baseline }
   }
-  const merged = { ...baseline, ...existing }
-  return `${JSON.stringify(buildReleaseConfig(target, merged), null, 2)}\n`
+  return buildReleaseConfig(target, { ...baseline, ...existing })
+}
+
+/** @param {string} target @param {string} sourceFile @returns {string} */
+function renderReleaseConfig(target, sourceFile) {
+  return `${JSON.stringify(mergeReleaseConfig(target, sourceFile), null, 2)}\n`
 }
 
 /** @param {string} file @param {string} languages @param {string} features @param {Record<string, string>} config */
@@ -339,7 +364,7 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'merge',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase', release_merge_strategy: 'rebase',
   }
 }
 

package/src/lib/release-manifest.mjs

@@ -66,6 +66,45 @@ export function buildReleaseConfig(root, existing = {}) {
   return result
 }
 
+/**
+ * Build the initial Release Please manifest from current package versions.
+ * Returns null when the config does not enable manifest mode (legacy configs
+ * without `packages`/`release-type` run in simple mode and need no manifest).
+ * @param {string} root
+ * @param {Record<string, any>} config
+ * @returns {Record<string, string>|null}
+ */
+export function buildReleaseManifest(root, config = {}) {
+  const packages = config.packages && typeof config.packages === 'object' && !Array.isArray(config.packages)
+    ? config.packages
+    : config['release-type'] ? { '.': {} } : null
+  if (!packages || !Object.keys(packages).length) return null
+  /** @type {Record<string, string>} */
+  const manifest = {}
+  for (const directory of Object.keys(packages)) {
+    manifest[directory] = readDirectoryVersion(join(root, directory === '.' ? '' : directory))
+  }
+  return manifest
+}
+
+/** @param {string} directory @returns {string} */
+function readDirectoryVersion(directory) {
+  const packagePath = join(directory, 'package.json')
+  if (existsSync(packagePath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(packagePath, 'utf8'))
+      if (typeof parsed?.version === 'string' && parsed.version) return parsed.version
+    } catch { /* fall through to other manifests */ }
+  }
+  for (const file of ['pyproject.toml', 'Cargo.toml']) {
+    const path = join(directory, file)
+    if (!existsSync(path)) continue
+    const match = readFileSync(path, 'utf8').match(/^version\s*=\s*["']([^"']+)["']/m)
+    if (match?.[1]) return match[1]
+  }
+  return '0.0.0'
+}
+
 /** @param {string} root @param {Record<string, any>} config @returns {string[]} */
 export function validateReleaseConfig(root, config) {
   const detected = detectReleasePackages(root)

package/src/lib/release-policy.mjs

@@ -186,7 +186,7 @@ export function classifyReconciliation(input) {
     return { action: 'none', reason: 'staging contains commits that are not on main; no release-only reconciliation is needed.' }
   }
   if (!mainChangedPaths.length && !stagingChangedPaths.length) {
-    return { action: 'aligned', reason: 'Branches have different history but identical content.' }
+    return { action: 'aligned', targetSha: mainSha, reason: 'Branches have different history but identical content.' }
   }
   const unexpectedMain = unexpectedReleasePaths(mainChangedPaths, allowed)
   const unexpectedStaging = unexpectedReleasePaths(stagingChangedPaths, allowed)