code-foundry 0.33.0 → 0.34.1

package/.github/workflows/release.yml

@@ -218,6 +218,56 @@ jobs:
               --watch \
               --fail-fast \
               --interval 10
+            # gh pr checks --watch only waits for checks registered when the
+            # watch starts; a ruleset may register additional required checks
+            # afterwards (observed: "Validation / Gate" appearing after
+            # "Tauri 2 / Linux" had passed), which leaves the PR blocked by
+            # branch policy at merge time. Poll mergeStateStatus and accept
+            # only states GitHub reports as mergeable: CLEAN, or UNSTABLE with
+            # mergeable MERGEABLE. UNSTABLE is still mergeable when only
+            # non-required checks are failing or still running (observed: Kilo
+            # Code Review running after every required check passed); keep
+            # waiting for BLOCKED/BEHIND/UNKNOWN, fail fast on
+            # DIRTY/CONFLICTING, and fail closed on a bounded timeout so the
+            # workflow never sleeps indefinitely.
+            echo "Waiting for release PR #$pr to become mergeable under branch policy"
+            merge_state=UNKNOWN
+            mergeable=UNKNOWN
+            for attempt in $(seq 1 30); do
+              : "$attempt"
+              if read -r merge_state mergeable < <(
+                gh pr view "$pr" \
+                  --repo "$GITHUB_REPOSITORY" \
+                  --json mergeStateStatus,mergeable \
+                  --jq -r '[.mergeStateStatus, .mergeable] | @tsv' 2>/dev/null
+              ); then
+                case "$merge_state" in
+                  CLEAN|UNSTABLE)
+                    if [ "$mergeable" = MERGEABLE ]; then
+                      break
+                    fi
+                    ;;
+                  DIRTY)
+                    echo "Release PR #$pr is not mergeable (mergeStateStatus=$merge_state); resolve conflicts before retrying the release." >&2
+                    exit 1
+                    ;;
+                esac
+                if [ "$mergeable" = CONFLICTING ]; then
+                  echo "Release PR #$pr is not mergeable (mergeable=$mergeable); resolve conflicts before retrying the release." >&2
+                  exit 1
+                fi
+              else
+                # gh API failure: read leaves the variables empty on EOF;
+                # treat the state as unknown and keep polling.
+                merge_state=UNKNOWN
+                mergeable=UNKNOWN
+              fi
+              sleep 10
+            done
+            if { [ "$merge_state" != CLEAN ] && [ "$merge_state" != UNSTABLE ]; } || [ "$mergeable" != MERGEABLE ]; then
+              echo "Release PR #$pr did not become mergeable within the mergeability window (last mergeStateStatus=$merge_state, mergeable=$mergeable). Required checks may still be pending or branch policy blocks the merge; review the pull request before retrying." >&2
+              exit 1
+            fi
             release_head=$(gh pr view "$pr" \
               --repo "$GITHUB_REPOSITORY" \
               --json headRefOid \
@@ -300,8 +350,8 @@ jobs:
           if (!lines) process.exit(1)
           process.stdout.write(`${lines}\n`)
           NODE
-          git remote set-url origin "git@github.com:${GITHUB_REPOSITORY}.git"
-          echo "ssh_command=-F /dev/null -i $STAGING_KEY -o IdentitiesOnly=yes -o UserKnownHostsFile=$STAGING_HOSTS -o StrictHostKeyChecking=yes" >> "$GITHUB_OUTPUT"
+          git remote set-url --push origin "git@github.com:${GITHUB_REPOSITORY}.git"
+          echo "ssh_command=ssh -F /dev/null -i $STAGING_KEY -o IdentitiesOnly=yes -o UserKnownHostsFile=$STAGING_HOSTS -o StrictHostKeyChecking=yes" >> "$GITHUB_OUTPUT"
       - name: Configure git for trusted reconcile
         if: steps.staging.outputs.exists == 'true' && env.STAGING_DEPLOY_KEY_PRESENT != 'true'
         run: gh auth setup-git

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.34.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.0...v0.34.1) (2026-08-01)
+
+
+### Bug Fixes
+
+* **release:** wait for PR mergeability before guarded auto-merge ([#311](https://github.com/0xPlayerOne/code-foundry/issues/311)) ([e9be192](https://github.com/0xPlayerOne/code-foundry/commit/e9be192e6b42020f327d42d928f2c6a835358e59))
+
+## [0.34.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.33.0...v0.34.0) (2026-08-01)
+
+
+### Features
+
+* **release:** classify reconcile push failures and log sanitized details ([#307](https://github.com/0xPlayerOne/code-foundry/issues/307)) ([0651fca](https://github.com/0xPlayerOne/code-foundry/commit/0651fca3eb4f11eeb21b91462397eef865eee7cc))
+
+
+### Bug Fixes
+
+* **release:** include ssh executable in reconcile transport ([#308](https://github.com/0xPlayerOne/code-foundry/issues/308)) ([49713ed](https://github.com/0xPlayerOne/code-foundry/commit/49713edeaf5262a0ed872aa6d3fdf55927b6e1c5))
+* **release:** keep reconcile fetch over HTTPS ([#305](https://github.com/0xPlayerOne/code-foundry/issues/305)) ([022afad](https://github.com/0xPlayerOne/code-foundry/commit/022afade430a00b9656dcfa50af3056bb27a54e3))
+
 ## [0.33.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.4...v0.33.0) (2026-08-01)
 
 

package/docs/RELEASES.md

@@ -80,7 +80,15 @@ Configure a narrowly scoped `RELEASE_PLEASE_TOKEN` repository or organization
 secret to enable guarded automatic merging and downstream workflows triggered
 by the resulting release. The token needs `contents`, `issues`, and
 `pull-requests` write permissions. Code Foundry validates every changed path in
-the generated version pull request before using the token to merge it.
+the generated version pull request before using the token to merge it, waits
+for the required checks to finish, and then polls the pull request's
+`mergeStateStatus` until it is `CLEAN`, or `UNSTABLE` with `mergeable`
+`MERGEABLE`, before merging. Non-required checks that branch policy does not
+require (for example external code review still running after every required
+check passed) do not block the merge; conflicts fail immediately and a bounded
+polling window fails closed if branch or ruleset policy still blocks the merge
+(a ruleset may register additional required checks after earlier ones have
+already passed).
 
 ## Operational checklist
 

package/docs/WORKFLOWS.md

@@ -50,6 +50,15 @@ workflow refuses to run unless its strategy is exactly `squash`.
 | `staging` → `main` promotion PR | Rebase (`merge_strategy: rebase`) | `merge_strategy` must be `rebase`; merge commits are rejected |
 | Release Please version PR into `main` | Squash (`release_merge_strategy: squash`) | Release automation fails closed unless `squash`; never defaults to `merge`, never uses `--admin` |
 
+Release auto-merge waits for required checks and then polls `mergeStateStatus`
+until it is `CLEAN`, or `UNSTABLE` with `mergeable` `MERGEABLE`, before
+merging. Non-required checks that branch policy does not require (for example
+external code review) never block the merge, so a ruleset that registers
+additional required checks after earlier ones have passed (for example
+`Validation / Gate` appearing after a platform-specific check) cannot leave the
+merge policy-blocked. The mergeability poll is bounded and fails closed on
+conflicts or timeout; releases without an automation token remain manual.
+
 Keeping `main` linear — rebase promotions and squash release PRs — is what
 lets the post-release reconciliation fast-forward or replay `staging` safely.
 
@@ -62,8 +71,10 @@ a personal-repository ruleset for `staging` enforces a Deploy Key bypass for
 checkout + GitHub API calls.
 
 When used, the optional `STAGING_DEPLOY_KEY` is written at runtime only for
-reconcile, used to set `GIT_SSH_COMMAND` and trusted host settings for the
-`release reconcile` transport, then scrubbed after the step.
+reconcile, then used to set `GIT_SSH_COMMAND` and trusted host settings for
+`release reconcile` over SSH push operations only; regular `git fetch` reads still
+use HTTPS from the checked-out origin configuration. The key material is scrubbed
+after the step.
 
 When absent, the job keeps `GH_TOKEN = github.token` and runs `gh auth setup-git`
 so repositories without a Deploy Key ruleset bypass still reconcile successfully.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/release.mjs

@@ -44,7 +44,8 @@ export function reconcileRelease(root, options) {
     const remoteSha = remoteRefSha(target, head)
     if (remoteSha === state.stagingSha) {
       throw new Error(`${head} synchronization was rejected by an exact lease while remote ${head} tip remained ${state.stagingSha}. ` +
-        'Update branch protection or remote policy to permit this mutation, then retry.')
+        'Update branch protection or remote policy to permit this mutation, then retry. ' +
+        `Last failure detail: ${mutation.error}`)
     }
   }
   throw new Error(`Reconciliation of ${head} was retried but failed while the branch moved concurrently.`)
@@ -150,15 +151,55 @@ function remoteRefSha(target, branch) {
 function executeReconciliationMutation(target, head, state) {
   if (!state.plan.targetSha) return { success: false, retry: false, error: `No target SHA for ${head} reconciliation.` }
   if (state.plan.action === 'rebase-staging') {
-    const replaySha = replayOntoMain(target, state.mainSha, state.stagingOnlyCommits)
+    let replaySha
+    try {
+      replaySha = replayOntoMain(target, state.mainSha, state.stagingOnlyCommits)
+    } catch (error) {
+      return {
+        success: false,
+        retry: false,
+        error: `Replay conflict while applying staging-only commits before replay: ${String(error instanceof Error ? error.message : error)}`,
+      }
+    }
+
     const push = pushWithLease(target, head, state.stagingSha, replaySha)
     if (push.status === 0) return { success: true, result: { synchronization: 'replay', replaySha } }
-    return { success: false, retry: true, error: `Git push of replayed ${head} history failed: ${push.message}` }
+    const classification = classifyPushFailure(head, push.message)
+    if (classification.category === 'authentication') {
+      return {
+        success: false,
+        retry: false,
+        error: `${head} authentication failed during replay push: ${classification.message}`,
+      }
+    }
+    if (classification.category === 'policy') {
+      return {
+        success: false,
+        retry: false,
+        error: `${head} reconciliation was blocked by branch policy: ${classification.message}`,
+      }
+    }
+    return { success: false, retry: true, error: `${head} synchronization failed with lease: ${classification.message}` }
   }
   const targetSha = /** @type {string} */ (state.plan.targetSha)
   const leased = pushWithLease(target, head, state.stagingSha, targetSha)
   if (leased.status === 0) return { success: true, result: { synchronization: state.plan.action === 'aligned' ? 'synced' : 'leased' } }
-  return { success: false, retry: true, error: `${head} synchronization failed with lease: ${leased.message}` }
+  const classification = classifyPushFailure(head, leased.message)
+  if (classification.category === 'authentication') {
+    return {
+      success: false,
+      retry: false,
+      error: `${head} authentication failed during push: ${classification.message}`,
+    }
+  }
+  if (classification.category === 'policy') {
+    return {
+      success: false,
+      retry: false,
+      error: `${head} reconciliation was blocked by branch policy: ${classification.message}`,
+    }
+  }
+  return { success: false, retry: true, error: `${head} synchronization failed with lease: ${classification.message}` }
 }
 
 /** @param {string} target @param {string} head @param {string} expectedSha @param {string} tipSha */
@@ -169,10 +210,38 @@ function pushWithLease(target, head, expectedSha, tipSha) {
     `--force-with-lease=refs/heads/${head}:${expectedSha}`,
     `${tipSha}:refs/heads/${head}`,
   ], { cwd: target, encoding: 'utf8' })
+  const message = `${result.stdout?.trim() || ''}\n${result.stderr?.trim() || ''}`.trim() || `push with lease failed for ${head}.`
   return {
     status: result.status,
-    message: result.stdout?.trim() || result.stderr?.trim() || `push with lease failed for ${head}.`,
+    message: sanitizeReconcileOutput(message),
+  }
+}
+
+/**
+ * Classify a push failure to avoid leaking sensitive details and provide useful
+ * diagnostics while preserving exact-lease behavior.
+ * @param {string} branch
+ * @param {string} raw
+ */
+function classifyPushFailure(branch, raw) {
+  const message = sanitizeReconcileOutput(raw)
+  if (!message) return { category: 'other', message: `push with lease failed for ${branch}.` }
+  const lower = message.toLowerCase()
+  if (/permission denied|authentication failed|could not read from remote repository|publickey|not authorized|bad credentials/.test(lower)) {
+    return { category: 'authentication', message }
+  }
+  if (/remote:\s*error|protected branch|required status checks|pre-receive hook|branch policy|ruleset|gh006|gh007|gh008/.test(lower)) {
+    return { category: 'policy', message }
   }
+  return { category: 'other', message }
+}
+
+/** @param {string} value */
+function sanitizeReconcileOutput(value) {
+  return value
+    .replace(/https?:\/\/[^\s@]+:[^\s@]*@/g, 'https://***:***@')
+    .replace(/https?:\/\/[^\s@]+@/g, 'https://***@')
+    .trim()
 }
 
 /**
@@ -198,7 +267,8 @@ function replayOntoMain(target, mainSha, commits) {
       const cherryPick = spawnSync('git', [...identityArgs, 'cherry-pick', sha], { cwd: workspace, encoding: 'utf8' })
       if (cherryPick.status !== 0) {
         spawnSync('git', ['cherry-pick', '--abort'], { cwd: workspace, encoding: 'utf8' })
-        throw new Error(`Cherry-pick of ${sha} failed while replaying staging commits.`)
+        const details = [cherryPick.stdout?.trim(), cherryPick.stderr?.trim()].filter(Boolean).join('\n')
+        throw new Error(`Cherry-pick of ${sha} failed while replaying staging commits: ${sanitizeReconcileOutput(details)}`)
       }
     }
     const replayTip = git(workspace, ['rev-parse', 'HEAD'])