code-foundry 0.32.2 → 0.32.4

package/.github/code-foundry.yml

@@ -11,13 +11,13 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v0.31.12
+runtime_ref: v0.32.3
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: staging-release
 merge_strategy: rebase
-release_merge_strategy: rebase
+release_merge_strategy: squash
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto
@@ -31,3 +31,9 @@ codeql_runner: ubuntu-latest
 pr_runner: ubuntu-slim
 release_runner: ubuntu-slim
 prune_standard: false
+post_release: false
+post_release_workflow:
+post_release_mode: auto
+opencode_security: false
+sync_mode: overlay
+custom_workflows: preserve

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.32.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.3...v0.32.4) (2026-08-01)
+
+
+### Bug Fixes
+
+* **sync:** never leak runtime release-type into consumer configs ([b7c51f3](https://github.com/0xPlayerOne/code-foundry/commit/b7c51f3e465e048be933292e0db9ca08d5420c9a))
+* **sync:** quote collection-like config values so prettier accepts them ([b0d4fea](https://github.com/0xPlayerOne/code-foundry/commit/b0d4fea815b6417de23cf577cba525e2017004dc))
+* **sync:** satisfy JSDoc type-check for baseline merge ([ce54339](https://github.com/0xPlayerOne/code-foundry/commit/ce54339b2092722e4d0d4e43afdb7ab5bacd2bc1))
+
+## [0.32.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.2...v0.32.3) (2026-07-31)
+
+
+### Bug Fixes
+
+* **release:** no-op when staging already points at main's commit ([a47180a](https://github.com/0xPlayerOne/code-foundry/commit/a47180a16ae8b9fd66548aba284939b3cdfaeba8))
+* **release:** squash Release Please PRs for release-please compatibility ([41c808b](https://github.com/0xPlayerOne/code-foundry/commit/41c808b8c2502ca78e271cb6702334daf90169da))
+
 ## [0.32.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.1...v0.32.2) (2026-07-31)
 
 

package/docs/RELEASES.md

@@ -36,15 +36,17 @@ release_merge_strategy: rebase # merge, squash, or rebase; used for Release Plea
 
 `merge_strategy` applies to promotion PRs (`staging` into `main`) and
 `release_merge_strategy` to Release Please version PRs; both default to
-`merge` when unset. Use **rebase** for both. Rebase merges keep `main` fully
-linear, which is what makes the post-release reconciliation possible:
-`staging` requires linear history, and any merge commit on `main` becomes an
-uncrossable barrier for `staging` (the linear-history rule rejects pushes
-whose new commits contain merge commits). With a linear `main`, the release
-workflow mirrors `staging` onto `main`'s tip after every release — a verified
-fast-forward when possible, otherwise a forced linear update, otherwise a
-single-parent synchronization commit — so `staging` is never left behind and
-never needs a manual rebase.
+`merge` when unset. Use **rebase** for promotion PRs and **squash** for
+Release Please PRs. Both keep `main` fully linear, which is what makes the
+post-release reconciliation possible: `staging` requires linear history, and
+any merge commit on `main` becomes an uncrossable barrier for `staging` (the
+linear-history rule rejects pushes whose new commits contain merge commits).
+Release Please itself also requires squash merges for its version PRs (rebase
+merges rewrite commit SHAs and break its merged-PR detection). With a linear
+`main`, the release workflow mirrors `staging` onto `main`'s tip after every
+release — a verified fast-forward when possible, otherwise a forced linear
+update, otherwise a single-parent synchronization commit — so `staging` is
+never left behind and never needs a manual rebase.
 
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
 repository without a package manifest and `none` for a repository that should
@@ -76,6 +78,6 @@ the generated version pull request before using the token to merge it.
 
 1. Merge tested changes from `staging` into `main`.
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's configured `release_merge_strategy` (default `merge`, recommended `rebase`).
+3. Merge the release PR with the repository.s configured `release_merge_strategy` (default `merge`, recommended `squash`).
 4. Confirm the GitHub Release and any package publication.
 5. Synchronize `staging` with the new `main` release commit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.32.2",
+  "version": "0.32.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/release.mjs

@@ -40,6 +40,7 @@ export function reconcileRelease(root, options) {
   console.log(JSON.stringify({ base, head, ...plan }, null, 2))
   if (plan.action === 'fail') throw new Error(plan.reason + (plan.unexpected?.length ? ` Unexpected paths: ${plan.unexpected.join(', ')}` : ''))
   if (!['fast-forward', 'pull-request', 'aligned'].includes(plan.action) || !options.github || options.dryRun) return plan
+  if (!plan.targetSha) return plan
   if (!process.env.GITHUB_REPOSITORY) throw new Error('GITHUB_REPOSITORY is required for --github reconciliation.')
   const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
   if (!token) throw new Error('GH_TOKEN or GITHUB_TOKEN is required for --github reconciliation.')

package/src/commands/sync.mjs

@@ -182,18 +182,27 @@ export function syncRepository(options) {
   return { changed, config }
 }
 
+/**
+ * Baseline keys that are safe to merge into a repository's release config.
+ * Package and release-type policy is detected from the repository itself and
+ * must never leak from the runtime template.
+ */
+const RELEASE_BASELINE_KEYS = ['$schema', 'bump-minor-pre-major', 'changelog-sections', 'include-component-in-tag']
+
 /** @param {string} target @param {string} sourceFile @returns {Record<string, any>} */
 function mergeReleaseConfig(target, sourceFile) {
+  /** @type {Record<string, any>} */
   let baseline = {}
   try { baseline = JSON.parse(readFileSync(sourceFile, 'utf8')) }
   catch { baseline = {} }
+  const safeBaseline = Object.fromEntries(RELEASE_BASELINE_KEYS.filter((key) => key in baseline).map((key) => [key, baseline[key]]))
   const destination = join(target, 'release-please-config.json')
   let existing = baseline
   if (existsSync(destination)) {
     try { existing = JSON.parse(readFileSync(destination, 'utf8')) }
     catch { existing = baseline }
   }
-  return buildReleaseConfig(target, { ...baseline, ...existing })
+  return buildReleaseConfig(target, { ...safeBaseline, ...existing })
 }
 
 /** @param {string} target @param {string} sourceFile @returns {string} */
@@ -364,14 +373,20 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase', release_merge_strategy: 'rebase',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase', release_merge_strategy: 'squash',
   }
 }
 
 /** @param {Record<string,string>} config */
 function renderConfig(config) { return `${Object.entries(config).map(([key, value]) => renderConfigLine(key, value)).join('\n')}\n` }
 /** @param {string} key @param {string} value */
-function renderConfigLine(key, value) { return value === '' ? `${key}:` : `${key}: ${value}` }
+function renderConfigLine(key, value) {
+  if (value === '') return `${key}:`
+  // Quote values that YAML would parse as collections or that would trip
+  // prettier's formatter (e.g. codeql_rust_shards: '["all"]').
+  const needsQuotes = /^[\[\]{]|[:,#]\s|\s#/.test(value)
+  return needsQuotes ? `${key}: '${value.replace(/'/g, "''")}'` : `${key}: ${value}`
+}
 /** @param {string} root */
 function readPackageVersion(root) {
   try { return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')).version ?? '0.0.0' } catch { return '0.0.0' }

package/src/lib/release-manifest.mjs

@@ -3,7 +3,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 
-const ignored = new Set(['.git', '.code-foundry', '.venv', 'node_modules', 'target', 'vendor', 'dist', 'build'])
+const ignored = new Set(['.git', '.code-foundry', '.venv', 'node_modules', 'target', 'vendor', 'dist', 'build', '.next', '.kilo', '.turbo', '.cache', '.vercel', '.output', '.nuxt', '.svelte-kit', '.parcel-cache', 'out', 'coverage'])
 
 /** @typedef {{ directory: string, manifest: string, releaseType: 'node'|'python'|'rust', packageName?: string, extraFiles: string[] }} ReleasePackage */