code-foundry 0.32.3 → 0.32.4

package/.github/code-foundry.yml

@@ -11,7 +11,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v0.31.12
+runtime_ref: v0.32.3
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
@@ -31,3 +31,9 @@ codeql_runner: ubuntu-latest
 pr_runner: ubuntu-slim
 release_runner: ubuntu-slim
 prune_standard: false
+post_release: false
+post_release_workflow:
+post_release_mode: auto
+opencode_security: false
+sync_mode: overlay
+custom_workflows: preserve

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.32.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.3...v0.32.4) (2026-08-01)
+
+
+### Bug Fixes
+
+* **sync:** never leak runtime release-type into consumer configs ([b7c51f3](https://github.com/0xPlayerOne/code-foundry/commit/b7c51f3e465e048be933292e0db9ca08d5420c9a))
+* **sync:** quote collection-like config values so prettier accepts them ([b0d4fea](https://github.com/0xPlayerOne/code-foundry/commit/b0d4fea815b6417de23cf577cba525e2017004dc))
+* **sync:** satisfy JSDoc type-check for baseline merge ([ce54339](https://github.com/0xPlayerOne/code-foundry/commit/ce54339b2092722e4d0d4e43afdb7ab5bacd2bc1))
+
 ## [0.32.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.2...v0.32.3) (2026-07-31)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.32.3",
+  "version": "0.32.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -182,18 +182,27 @@ export function syncRepository(options) {
   return { changed, config }
 }
 
+/**
+ * Baseline keys that are safe to merge into a repository's release config.
+ * Package and release-type policy is detected from the repository itself and
+ * must never leak from the runtime template.
+ */
+const RELEASE_BASELINE_KEYS = ['$schema', 'bump-minor-pre-major', 'changelog-sections', 'include-component-in-tag']
+
 /** @param {string} target @param {string} sourceFile @returns {Record<string, any>} */
 function mergeReleaseConfig(target, sourceFile) {
+  /** @type {Record<string, any>} */
   let baseline = {}
   try { baseline = JSON.parse(readFileSync(sourceFile, 'utf8')) }
   catch { baseline = {} }
+  const safeBaseline = Object.fromEntries(RELEASE_BASELINE_KEYS.filter((key) => key in baseline).map((key) => [key, baseline[key]]))
   const destination = join(target, 'release-please-config.json')
   let existing = baseline
   if (existsSync(destination)) {
     try { existing = JSON.parse(readFileSync(destination, 'utf8')) }
     catch { existing = baseline }
   }
-  return buildReleaseConfig(target, { ...baseline, ...existing })
+  return buildReleaseConfig(target, { ...safeBaseline, ...existing })
 }
 
 /** @param {string} target @param {string} sourceFile @returns {string} */
@@ -371,7 +380,13 @@ function createDefaultConfig(root, source) {
 /** @param {Record<string,string>} config */
 function renderConfig(config) { return `${Object.entries(config).map(([key, value]) => renderConfigLine(key, value)).join('\n')}\n` }
 /** @param {string} key @param {string} value */
-function renderConfigLine(key, value) { return value === '' ? `${key}:` : `${key}: ${value}` }
+function renderConfigLine(key, value) {
+  if (value === '') return `${key}:`
+  // Quote values that YAML would parse as collections or that would trip
+  // prettier's formatter (e.g. codeql_rust_shards: '["all"]').
+  const needsQuotes = /^[\[\]{]|[:,#]\s|\s#/.test(value)
+  return needsQuotes ? `${key}: '${value.replace(/'/g, "''")}'` : `${key}: ${value}`
+}
 /** @param {string} root */
 function readPackageVersion(root) {
   try { return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')).version ?? '0.0.0' } catch { return '0.0.0' }

package/src/lib/release-manifest.mjs

@@ -3,7 +3,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
 
-const ignored = new Set(['.git', '.code-foundry', '.venv', 'node_modules', 'target', 'vendor', 'dist', 'build'])
+const ignored = new Set(['.git', '.code-foundry', '.venv', 'node_modules', 'target', 'vendor', 'dist', 'build', '.next', '.kilo', '.turbo', '.cache', '.vercel', '.output', '.nuxt', '.svelte-kit', '.parcel-cache', 'out', 'coverage'])
 
 /** @typedef {{ directory: string, manifest: string, releaseType: 'node'|'python'|'rust', packageName?: string, extraFiles: string[] }} ReleasePackage */