code-foundry 0.32.1 → 0.32.2

package/.github/code-foundry.yml

@@ -16,8 +16,8 @@ release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: staging-release
-merge_strategy: merge
-release_merge_strategy: squash
+merge_strategy: rebase
+release_merge_strategy: rebase
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto

package/.github/workflows/release-pr.yml

@@ -157,7 +157,7 @@ jobs:
           ### Validation
 
           - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge using the repository's configured \`merge_strategy\` (default: **merge**).
+          - Merge using the repository's configured \`merge_strategy\` (default: **rebase**).
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.32.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.1...v0.32.2) (2026-07-31)
+
+
+### Bug Fixes
+
+* **release:** mirror staging onto main and require rebase merges on main ([31ab9b1](https://github.com/0xPlayerOne/code-foundry/commit/31ab9b125e66ae35f7d2a2c6893d0a3aec5d4560))
+* **release:** synchronize staging with a linear commit instead of a blocked fast-forward ([b808dff](https://github.com/0xPlayerOne/code-foundry/commit/b808dffeae38ec8211f8f0dee79e19d60f70b708))
+
 ## [0.32.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.0...v0.32.1) (2026-07-31)
 
 

package/docs/RELEASES.md

@@ -30,16 +30,21 @@ Set these values in `.github/code-foundry.yml`:
 ```yaml
 release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
-merge_strategy: merge # merge, squash, or rebase; used for promotion PRs
-release_merge_strategy: squash # merge, squash, or rebase; used for Release Please PRs
+merge_strategy: rebase # merge, squash, or rebase; used for promotion PRs
+release_merge_strategy: rebase # merge, squash, or rebase; used for Release Please PRs
 ```
 
-`merge_strategy` applies to promotion PRs (`staging` into `main`); merging
-those with a merge commit keeps `staging` an ancestor of `main`.
-`release_merge_strategy` applies to Release Please version PRs; squash-merging
-them keeps `main`'s tip linear so the post-release reconciliation can
-fast-forward `staging` to `main` without violating `staging`'s required-linear-
-history rule. Defaults to `merge` when unset.
+`merge_strategy` applies to promotion PRs (`staging` into `main`) and
+`release_merge_strategy` to Release Please version PRs; both default to
+`merge` when unset. Use **rebase** for both. Rebase merges keep `main` fully
+linear, which is what makes the post-release reconciliation possible:
+`staging` requires linear history, and any merge commit on `main` becomes an
+uncrossable barrier for `staging` (the linear-history rule rejects pushes
+whose new commits contain merge commits). With a linear `main`, the release
+workflow mirrors `staging` onto `main`'s tip after every release — a verified
+fast-forward when possible, otherwise a forced linear update, otherwise a
+single-parent synchronization commit — so `staging` is never left behind and
+never needs a manual rebase.
 
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
 repository without a package manifest and `none` for a repository that should
@@ -71,6 +76,6 @@ the generated version pull request before using the token to merge it.
 
 1. Merge tested changes from `staging` into `main`.
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository.s configured `release_merge_strategy` (default `merge`, recommended `squash`).
+3. Merge the release PR with the repository's configured `release_merge_strategy` (default `merge`, recommended `rebase`).
 4. Confirm the GitHub Release and any package publication.
 5. Synchronize `staging` with the new `main` release commit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.32.1",
+  "version": "0.32.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/release.mjs

@@ -10,8 +10,9 @@ import { hasDeliveredHook, releaseDeliveryKey, selectHookDelivery } from '../lib
 
 /**
  * Reconcile staging after Release Please updates main. The local mode is
- * deterministic and suitable for CI; --github applies only a verified
- * fast-forward through the GitHub API and otherwise fails closed.
+ * deterministic and suitable for CI; --github mirrors staging onto main's
+ * tip through the GitHub API (fast-forward, then forced, then a linear sync
+ * commit) and otherwise fails closed.
  * @param {string} root
  * @param {ReleaseOptions} options
  */
@@ -38,55 +39,31 @@ export function reconcileRelease(root, options) {
   })
   console.log(JSON.stringify({ base, head, ...plan }, null, 2))
   if (plan.action === 'fail') throw new Error(plan.reason + (plan.unexpected?.length ? ` Unexpected paths: ${plan.unexpected.join(', ')}` : ''))
-  if (plan.action === 'pull-request' && options.github && !options.dryRun) {
-    if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for synchronization PRs.')
-    const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
-    if (!token) throw new Error('GH_TOKEN or GITHUB_TOKEN is required for synchronization PRs.')
-    const existing = ghJson(target, ['pr', 'list', '--repo', process.env.GITHUB_REPOSITORY, '--state', 'open', '--base', head, '--search', `chore(release): synchronize ${base} -> ${head} in:title`, '--json', 'number,url,headRefName'])
-    if (Array.isArray(existing) && existing.length) {
-      return { ...plan, synchronizationPullRequest: existing[0].url ?? existing[0].number }
-    }
-    const synchronizationPullRequest = createSynchronizationPullRequest(target, process.env.GITHUB_REPOSITORY, base, head, mainSha, stagingSha, mainChangedPaths, token)
-    return { ...plan, synchronizationPullRequest }
-  }
-  if (plan.action !== 'fast-forward' || !options.github || options.dryRun) return plan
+  if (!['fast-forward', 'pull-request', 'aligned'].includes(plan.action) || !options.github || options.dryRun) return plan
   if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for --github reconciliation.')
   const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
   if (!token) throw new Error('GH_TOKEN or GITHUB_TOKEN is required for --github reconciliation.')
-  const result = spawnSync('gh', [
+  const targetSha = /** @type {string} */ (plan.targetSha)
+  // 1. Verified fast-forward through the API (linear, no force).
+  const fastForward = spawnSync('gh', [
     'api', '--method', 'PATCH', `repos/${process.env.GITHUB_REPOSITORY}/git/refs/heads/${head}`,
-    '-f', `sha=${plan.targetSha}`, '-F', 'force=false',
+    '-f', `sha=${targetSha}`, '-F', 'force=false',
   ], { cwd: target, stdio: 'inherit', env: { ...process.env, GH_TOKEN: token } })
-  if (result.status !== 0) throw new Error(`GitHub refused the protected fast-forward of ${head}.`)
-  return plan
-}
-
-/** @param {string} root @param {string} repository @param {string} base @param {string} head @param {string} mainSha @param {string} stagingSha @param {string[]} changedPaths @param {string} token */
-function createSynchronizationPullRequest(root, repository, base, head, mainSha, stagingSha, changedPaths, token) {
-  const branch = `codex/release-sync-${head}-${mainSha.slice(0, 12)}`
-  const remote = spawnSync('git', ['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${branch}`], { cwd: root, encoding: 'utf8' })
-  if (remote.status !== 0) {
-    const checkout = spawnSync('git', ['switch', '--create', branch, `origin/${head}`], { cwd: root, encoding: 'utf8' })
-    if (checkout.status !== 0) throw new Error(`Failed to create synchronization branch: ${checkout.stderr.trim()}`)
-    const patch = spawnSync('git', ['diff', '--binary', stagingSha, mainSha, '--', ...changedPaths], { cwd: root, encoding: 'utf8' })
-    if (patch.status !== 0) throw new Error(`Failed to prepare synchronization patch: ${patch.stderr.trim()}`)
-    const apply = spawnSync('git', ['apply', '--whitespace=nowarn'], { cwd: root, input: patch.stdout, encoding: 'utf8' })
-    if (apply.status !== 0) throw new Error(`Synchronization patch did not apply cleanly: ${apply.stderr.trim()}`)
-    const add = spawnSync('git', ['add', '--', ...changedPaths], { cwd: root, encoding: 'utf8' })
-    if (add.status !== 0) throw new Error(`Failed to stage synchronization metadata: ${add.stderr.trim()}`)
-    const identity = spawnSync('git', ['-c', 'user.name=github-actions[bot]', '-c', 'user.email=41898282+github-actions[bot]@users.noreply.github.com', 'commit', '-m', `chore(release): synchronize ${base} -> ${head}`], { cwd: root, encoding: 'utf8' })
-    if (identity.status !== 0) throw new Error(`Failed to commit synchronization metadata: ${identity.stderr.trim()}`)
-    const push = spawnSync('git', ['push', '--set-upstream', 'origin', branch], { cwd: root, encoding: 'utf8', env: { ...process.env, GH_TOKEN: token } })
-    if (push.status !== 0) throw new Error(`Failed to publish synchronization branch: ${push.stderr.trim()}`)
-  }
-  const result = spawnSync('gh', [
-    'pr', 'create', '--repo', repository,
-    '--base', head, '--head', branch,
-    '--title', `chore(release): synchronize ${base} -> ${head}`,
-    '--body', `Synchronize ${head} with ${base} after Release Please publication.\n\nCode Foundry verified that only approved release metadata differs between the branch tips, then applied that metadata to an isolated synchronization branch.`,
-  ], { cwd: resolve(root), encoding: 'utf8', env: { ...process.env, GH_TOKEN: token } })
-    if (result.status !== 0) throw new Error(`Failed to create synchronization PR: ${result.stderr.trim()}`)
-  return result.stdout.trim()
+  if (fastForward.status === 0) return { ...plan, synchronization: 'fast-forward' }
+  // 2. Forced update when staging may be rewritten without violating the
+  // linear-history rule (main's tip is linear and already contains staging's
+  // content, so nothing unpromoted is lost).
+  const forced = spawnSync('gh', [
+    'api', '--method', 'PATCH', `repos/${process.env.GITHUB_REPOSITORY}/git/refs/heads/${head}`,
+    '-f', `sha=${targetSha}`, '-F', 'force=true',
+  ], { cwd: target, stdio: 'inherit', env: { ...process.env, GH_TOKEN: token } })
+  if (forced.status === 0) return { ...plan, synchronization: 'forced' }
+  // 3. Linear sync commit fallback: staging keeps its history and receives
+  // main's tree as a single-parent commit, which the ruleset always accepts.
+  const syncSha = createLinearSyncCommit(target, stagingSha, targetSha)
+  const push = spawnSync('git', ['push', 'origin', `${syncSha}:refs/heads/${head}`], { cwd: target, stdio: 'inherit', env: { ...process.env, GH_TOKEN: token } })
+  if (push.status !== 0) throw new Error(`GitHub refused the linear synchronization of ${head}.`)
+  return { ...plan, syncSha, synchronization: 'linear-commit' }
 }
 
 /**
@@ -170,6 +147,24 @@ function git(root, args) {
   return result.status === 0 ? result.stdout.trim() : ''
 }
 
+/**
+ * Build a linear commit whose tree equals main's tip and whose parent is the
+ * current staging tip. Staging requires linear history and main's tip almost
+ * always sits behind promotion merge commits, so a direct fast-forward to
+ * main's tip is rejected by the branch ruleset ("must not contain merge
+ * commits"). A single-parent commit is always pushable and keeps staging
+ * content-identical to main.
+ * @param {string} root @param {string} parentSha @param {string} mainSha @returns {string}
+ */
+function createLinearSyncCommit(root, parentSha, mainSha) {
+  const tree = git(root, ['rev-parse', `${mainSha}^{tree}`])
+  if (!tree) throw new Error('Failed to resolve the target tree.')
+  const identity = ['-c', 'user.name=github-actions[bot]', '-c', 'user.email=41898282+github-actions[bot]@users.noreply.github.com']
+  const result = spawnSync('git', [...identity, 'commit-tree', tree, '-p', parentSha, '-m', 'chore(release): synchronize staging with main'], { cwd: resolve(root), encoding: 'utf8' })
+  if (result.status !== 0) throw new Error(`Failed to create the synchronization commit: ${result.stderr.trim()}`)
+  return result.stdout.trim()
+}
+
 /** @param {string} root @param {string} from @param {string} to @returns {string[]} */
 function diffNames(root, from, to) {
   if (!from || !to || from === to) return []

package/src/commands/sync.mjs

@@ -364,7 +364,7 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'merge', release_merge_strategy: 'squash',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase', release_merge_strategy: 'rebase',
   }
 }
 

package/src/lib/release-policy.mjs

@@ -186,7 +186,7 @@ export function classifyReconciliation(input) {
     return { action: 'none', reason: 'staging contains commits that are not on main; no release-only reconciliation is needed.' }
   }
   if (!mainChangedPaths.length && !stagingChangedPaths.length) {
-    return { action: 'aligned', reason: 'Branches have different history but identical content.' }
+    return { action: 'aligned', targetSha: mainSha, reason: 'Branches have different history but identical content.' }
   }
   const unexpectedMain = unexpectedReleasePaths(mainChangedPaths, allowed)
   const unexpectedStaging = unexpectedReleasePaths(stagingChangedPaths, allowed)