code-foundry 0.34.10 → 0.34.12

package/.github/workflows/draft-pr.yml

@@ -18,9 +18,6 @@ permissions:
   contents: read
   pull-requests: write
 
-env:
-  HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' || secrets.RELEASE_PLEASE_TOKEN != '' }}
-
 jobs:
   create-draft-pr:
     name: Create
@@ -34,7 +31,7 @@ jobs:
         id: check-pr
         env:
           HEAD_REF: ${{ github.ref_name }}
-          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           BRANCH="$HEAD_REF"
           EXISTING=$(gh pr list --repo "$GITHUB_REPOSITORY" --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
@@ -43,9 +40,11 @@ jobs:
       - name: Create
         if: steps.check-pr.outputs.existing == '0'
         env:
+          AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           HEAD_REF: ${{ github.ref_name }}
-          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
         run: |
+          set -euo pipefail
           BRANCH="$HEAD_REF"
           PREFIX="${BRANCH%%/*}"
           SUFFIX="${BRANCH#*/}"
@@ -71,19 +70,42 @@ jobs:
             PR_TITLE="$BRANCH"
           fi
 
-          DRAFT_ARGS=()
-          if [ "$HAS_AUTOMATION_TOKEN" = true ]; then
-            BODY_NOTICE="This PR is ready for review and merging once required validation passes."
-          else
-            DRAFT_ARGS+=(--draft)
-            BODY_NOTICE="This PR was created automatically and is currently in draft mode."
-            echo "::notice title=Manual PR readiness required::No automation token is configured; this PR may remain draft until manually marked ready for validation and merge."
+          BODY_FILE=$(mktemp)
+          ERROR_FILE=$(mktemp)
+          trap 'rm -f -- "$BODY_FILE" "$ERROR_FILE"' EXIT
+          cat > "$BODY_FILE" <<EOF
+          CI PR created automatically by this workflow.
+
+          This PR is ready for review once required validation passes. If the
+          configured automation token is rejected, it is intentionally opened
+          as a draft for manual readiness.
+
+          **CI Status:** Pending — this workflow triggered on push to $BRANCH.
+          EOF
+
+          CREATE_ARGS=(
+            "repos/${GITHUB_REPOSITORY}/pulls"
+            --method POST
+            --field base=staging
+            --field head="$BRANCH"
+            --field title="$PR_TITLE"
+            --field body="@$BODY_FILE"
+          )
+
+          CREATED=false
+          if [ -n "$AUTOMATION_TOKEN" ] && GH_TOKEN="$AUTOMATION_TOKEN" gh api "${CREATE_ARGS[@]}" > /dev/null 2> "$ERROR_FILE"; then
+            CREATED=true
+          fi
+
+          if [ "$CREATED" != true ]; then
+            DRAFT_ARGS=("${CREATE_ARGS[@]}" --field draft=true)
+            if GH_TOKEN="$GITHUB_TOKEN" gh api "${DRAFT_ARGS[@]}" > /dev/null 2> "$ERROR_FILE"; then
+              echo "::notice title=Manual PR readiness required::The configured automation token was absent or rejected; this PR was opened as a draft with the short-lived workflow token."
+              CREATED=true
+            fi
           fi
 
-          gh pr create \
-            --repo "$GITHUB_REPOSITORY" \
-            --base staging \
-            --head "$BRANCH" \
-            "${DRAFT_ARGS[@]}" \
-            --title "$PR_TITLE" \
-            --body "CI PR created automatically by this workflow.\n\n            $BODY_NOTICE\n\n            **CI Status:** Pending \u2014 this workflow triggered on push to \`$BRANCH\`."
+          if [ "$CREATED" != true ]; then
+            echo "::error title=Draft PR creation failed::Both the configured automation token and the workflow token failed to create the pull request."
+            exit 1
+          fi

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.34.12](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.11...v0.34.12) (2026-08-02)
+
+
+### Bug Fixes
+
+* **reconcile:** classify final tree deltas ([#353](https://github.com/0xPlayerOne/code-foundry/issues/353)) ([18d23e4](https://github.com/0xPlayerOne/code-foundry/commit/18d23e4847ffbcfc274bc11c80244ecac64395ed))
+
+## [0.34.11](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.10...v0.34.11) (2026-08-02)
+
+
+### Bug Fixes
+
+* **draft-pr:** fall back to workflow token ([#350](https://github.com/0xPlayerOne/code-foundry/issues/350)) ([aef07db](https://github.com/0xPlayerOne/code-foundry/commit/aef07db6945badd7d7b3526b5490b1512ac1a468))
+
 ## [0.34.10](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.9...v0.34.10) (2026-08-02)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.34.10",
+  "version": "0.34.12",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/release.mjs

@@ -83,14 +83,16 @@ function resolveReconciliationState(target, base, head, allowed, requireRemote)
   try {
     const mainOnlyCommits = divergentCommits(target, stagingSha, mainSha)
     const stagingOnlyCommits = divergentCommits(target, mainSha, stagingSha)
+    const directChangedPaths = treeChangedPaths(target, stagingSha, mainSha)
     const plan = classifyReconciliation({
       mainSha,
       stagingSha,
       mainOnlyCommits,
       stagingOnlyCommits,
+      directChangedPaths,
       allowed,
     })
-    return { plan, mainSha, stagingSha, mainOnlyCommits, stagingOnlyCommits }
+    return { plan, mainSha, stagingSha, mainOnlyCommits, stagingOnlyCommits, directChangedPaths }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error)
     return {
@@ -102,6 +104,7 @@ function resolveReconciliationState(target, base, head, allowed, requireRemote)
       stagingSha,
       mainOnlyCommits: [],
       stagingOnlyCommits: [],
+      directChangedPaths: [],
     }
   }
 }
@@ -570,6 +573,15 @@ function commitChangedPaths(root, commitSha) {
   return result.stdout.split(/\r?\n/).filter(Boolean)
 }
 
+/** @param {string} root @param {string} from @param {string} to @returns {string[]} */
+function treeChangedPaths(root, from, to) {
+  const result = spawnSync('git', ['diff', '--name-only', from, to], { cwd: root, encoding: 'utf8' })
+  if (result.status !== 0) {
+    throw new Error(`Failed to compare branch trees between ${from} and ${to}. ${result.stderr?.trim() || result.stdout?.trim()}`)
+  }
+  return result.stdout.split(/\r?\n/).filter(Boolean)
+}
+
 /** @param {string} root @param {string[]} args @returns {{ status: number | null, stdout: string, stderr: string }} */
 function ghSpawn(root, args) {
   const token = process.env.RELEASE_PLEASE_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN

package/src/lib/release-policy.mjs

@@ -217,12 +217,16 @@ function compareVersions(a, b) {
 }
 
 /**
- * Classify the relationship between main and staging using commit-level divergence.
- * Any non-release main-only commit fails. Any staging-only commit triggers a replay
- * path so no staging-only work can be silently discarded.
+ * Classify the relationship between main and staging using the final tree delta
+ * when available. Historical commit paths can include equivalent workflow or
+ * configuration changes that are no longer present in the branch delta, so the
+ * final trees are the source of truth for release-only reconciliation. Any
+ * staging-only commit still triggers a replay path so no staging-only work can
+ * be silently discarded.
  * @param {{
  *   mainSha: string,
  *   stagingSha: string,
+ *   directChangedPaths?: string[],
  *   mainOnlyCommits?: Array<{ sha?: string, changedPaths?: string[] }>,
  *   stagingOnlyCommits?: Array<{ sha?: string, changedPaths?: string[] }>,
  *   allowed?: Set<string>,
@@ -232,6 +236,7 @@ export function classifyReconciliation(input) {
   const {
     mainSha,
     stagingSha,
+    directChangedPaths,
     mainOnlyCommits = [],
     stagingOnlyCommits = [],
     allowed = approvedReleaseFiles(),
@@ -248,6 +253,29 @@ export function classifyReconciliation(input) {
     action: 'fail',
     reason: 'Unable to inspect staging-only commit metadata.',
   }
+  if (Array.isArray(directChangedPaths)) {
+    const paths = [...new Set(directChangedPaths.map((path) => path.trim()).filter(Boolean))]
+    const unexpected = unexpectedReleasePaths(paths, allowed)
+    const stagingOnlyReleaseOnly = stagingOnlyCommits.length > 0 && stagingOnlyCommits.every((commit) =>
+      Array.isArray(commit.changedPaths) && commit.changedPaths.length > 0 && unexpectedReleasePaths(commit.changedPaths, allowed).length === 0,
+    )
+    if (!unexpected.length && !stagingOnlyReleaseOnly) {
+      return {
+        action: 'fast-forward',
+        targetSha: mainSha,
+        reason: paths.length
+          ? 'Branches differ only by approved release metadata.'
+          : 'Branches have different history but identical content.',
+      }
+    }
+    if (!stagingOnlyCommits.length) {
+      return {
+        action: 'fail',
+        reason: 'branch content differs outside release metadata.',
+        unexpected,
+      }
+    }
+  }
   const unexpectedMain = unexpectedReleasePaths(
     [...new Set(mainOnlyCommits.flatMap((commit) => commit.changedPaths || []))],
     allowed,