code-foundry 0.34.0 → 0.34.1

package/.github/workflows/release.yml

@@ -218,6 +218,56 @@ jobs:
               --watch \
               --fail-fast \
               --interval 10
+            # gh pr checks --watch only waits for checks registered when the
+            # watch starts; a ruleset may register additional required checks
+            # afterwards (observed: "Validation / Gate" appearing after
+            # "Tauri 2 / Linux" had passed), which leaves the PR blocked by
+            # branch policy at merge time. Poll mergeStateStatus and accept
+            # only states GitHub reports as mergeable: CLEAN, or UNSTABLE with
+            # mergeable MERGEABLE. UNSTABLE is still mergeable when only
+            # non-required checks are failing or still running (observed: Kilo
+            # Code Review running after every required check passed); keep
+            # waiting for BLOCKED/BEHIND/UNKNOWN, fail fast on
+            # DIRTY/CONFLICTING, and fail closed on a bounded timeout so the
+            # workflow never sleeps indefinitely.
+            echo "Waiting for release PR #$pr to become mergeable under branch policy"
+            merge_state=UNKNOWN
+            mergeable=UNKNOWN
+            for attempt in $(seq 1 30); do
+              : "$attempt"
+              if read -r merge_state mergeable < <(
+                gh pr view "$pr" \
+                  --repo "$GITHUB_REPOSITORY" \
+                  --json mergeStateStatus,mergeable \
+                  --jq -r '[.mergeStateStatus, .mergeable] | @tsv' 2>/dev/null
+              ); then
+                case "$merge_state" in
+                  CLEAN|UNSTABLE)
+                    if [ "$mergeable" = MERGEABLE ]; then
+                      break
+                    fi
+                    ;;
+                  DIRTY)
+                    echo "Release PR #$pr is not mergeable (mergeStateStatus=$merge_state); resolve conflicts before retrying the release." >&2
+                    exit 1
+                    ;;
+                esac
+                if [ "$mergeable" = CONFLICTING ]; then
+                  echo "Release PR #$pr is not mergeable (mergeable=$mergeable); resolve conflicts before retrying the release." >&2
+                  exit 1
+                fi
+              else
+                # gh API failure: read leaves the variables empty on EOF;
+                # treat the state as unknown and keep polling.
+                merge_state=UNKNOWN
+                mergeable=UNKNOWN
+              fi
+              sleep 10
+            done
+            if { [ "$merge_state" != CLEAN ] && [ "$merge_state" != UNSTABLE ]; } || [ "$mergeable" != MERGEABLE ]; then
+              echo "Release PR #$pr did not become mergeable within the mergeability window (last mergeStateStatus=$merge_state, mergeable=$mergeable). Required checks may still be pending or branch policy blocks the merge; review the pull request before retrying." >&2
+              exit 1
+            fi
             release_head=$(gh pr view "$pr" \
               --repo "$GITHUB_REPOSITORY" \
               --json headRefOid \

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.34.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.0...v0.34.1) (2026-08-01)
+
+
+### Bug Fixes
+
+* **release:** wait for PR mergeability before guarded auto-merge ([#311](https://github.com/0xPlayerOne/code-foundry/issues/311)) ([e9be192](https://github.com/0xPlayerOne/code-foundry/commit/e9be192e6b42020f327d42d928f2c6a835358e59))
+
 ## [0.34.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.33.0...v0.34.0) (2026-08-01)
 
 

package/docs/RELEASES.md

@@ -80,7 +80,15 @@ Configure a narrowly scoped `RELEASE_PLEASE_TOKEN` repository or organization
 secret to enable guarded automatic merging and downstream workflows triggered
 by the resulting release. The token needs `contents`, `issues`, and
 `pull-requests` write permissions. Code Foundry validates every changed path in
-the generated version pull request before using the token to merge it.
+the generated version pull request before using the token to merge it, waits
+for the required checks to finish, and then polls the pull request's
+`mergeStateStatus` until it is `CLEAN`, or `UNSTABLE` with `mergeable`
+`MERGEABLE`, before merging. Non-required checks that branch policy does not
+require (for example external code review still running after every required
+check passed) do not block the merge; conflicts fail immediately and a bounded
+polling window fails closed if branch or ruleset policy still blocks the merge
+(a ruleset may register additional required checks after earlier ones have
+already passed).
 
 ## Operational checklist
 

package/docs/WORKFLOWS.md

@@ -50,6 +50,15 @@ workflow refuses to run unless its strategy is exactly `squash`.
 | `staging` → `main` promotion PR | Rebase (`merge_strategy: rebase`) | `merge_strategy` must be `rebase`; merge commits are rejected |
 | Release Please version PR into `main` | Squash (`release_merge_strategy: squash`) | Release automation fails closed unless `squash`; never defaults to `merge`, never uses `--admin` |
 
+Release auto-merge waits for required checks and then polls `mergeStateStatus`
+until it is `CLEAN`, or `UNSTABLE` with `mergeable` `MERGEABLE`, before
+merging. Non-required checks that branch policy does not require (for example
+external code review) never block the merge, so a ruleset that registers
+additional required checks after earlier ones have passed (for example
+`Validation / Gate` appearing after a platform-specific check) cannot leave the
+merge policy-blocked. The mergeability poll is bounded and fails closed on
+conflicts or timeout; releases without an automation token remain manual.
+
 Keeping `main` linear — rebase promotions and squash release PRs — is what
 lets the post-release reconciliation fast-forward or replay `staging` safely.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",