code-foundry 0.34.12 → 0.34.13

package/.github/CONTRIBUTING.md

@@ -48,7 +48,7 @@ docs/*  test/*  refactor/*         │              │
 | `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
 | `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
 
-The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.
+The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.
 
 ## Before you start
 
@@ -179,7 +179,7 @@ Security checks can be skipped when repository visibility or the GitHub plan doe
 | ----------------- | --------- | ------------------------------------------------------- | --------------------------------------------------------- |
 | Working branch    | `staging` | Squash                                                  | All applicable required checks pass                       |
 | `staging` → `main` promotion | `main` | Rebase (`merge_strategy`)                   | Current staging checks, release review, and rollout notes |
-| Release Please version PR | `main` | Squash (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                  |
+| Release Please version PR | `main` | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                  |
 
 Reviewers focus on correctness, security, maintainability, test coverage, operational impact, and compatibility. Authors remain responsible for responding to feedback and verifying the final commit.
 

package/.github/code-foundry.yml

@@ -17,7 +17,7 @@ npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: staging-release
 merge_strategy: rebase
-release_merge_strategy: squash
+release_merge_strategy: rebase
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto

package/.github/dependabot.yml

@@ -9,6 +9,7 @@ updates:
     open-pull-requests-limit: 99
     groups:
       github-actions:
+        applies-to: version-updates
         patterns: ['*']
   - package-ecosystem: npm
     directory: /
@@ -19,6 +20,7 @@ updates:
     open-pull-requests-limit: 99
     groups:
       npm-dependencies:
+        applies-to: version-updates
         patterns: ['*']
   - package-ecosystem: cargo
     directory: /
@@ -29,6 +31,7 @@ updates:
     open-pull-requests-limit: 99
     groups:
       cargo-dependencies:
+        applies-to: version-updates
         patterns: ['*']
   - package-ecosystem: pip
     directory: /
@@ -39,4 +42,5 @@ updates:
     open-pull-requests-limit: 99
     groups:
       python-dependencies:
+        applies-to: version-updates
         patterns: ['*']

package/.github/workflows/release.yml

@@ -84,17 +84,18 @@ jobs:
             : {}
           let releaseType = config.release_type || 'auto'
           let npmPublish = config.npm_publish || 'false'
-          // The merge audit topology requires squash for Release Please version
-          // pull requests into main. Release automation never defaults to a
-          // merge method: an unset or non-squash release_merge_strategy fails
-          // the release job before any pull request is created or merged.
+          // The merge audit topology requires rebase for Release Please version
+          // pull requests into main, matching the linear-history ruleset.
+          // Release automation never defaults to a merge method: an unset or
+          // non-rebase release_merge_strategy fails the release job before any
+          // pull request is created or merged.
           const releaseMergeStrategy = String(config.release_merge_strategy || '').trim().toLowerCase()
           if (releaseType === 'auto') {
             releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
           }
           if (!['node', 'python', 'rust', 'simple', 'none'].includes(releaseType)) throw new Error(`Unsupported release_type: ${releaseType}`)
-          if (releaseMergeStrategy !== 'squash') {
-            throw new Error(`release_merge_strategy must be "squash" for automated release merges; got ${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}`)
+          if (releaseMergeStrategy !== 'rebase') {
+            throw new Error(`release_merge_strategy must be "rebase" for automated release merges; got ${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}`)
           }
           if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
           let legacyReleaseType = ''

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.34.13](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.12...v0.34.13) (2026-08-03)
+
+
+### Bug Fixes
+
+* **reconcile:** classify patch-equivalent trees consistently ([#360](https://github.com/0xPlayerOne/code-foundry/issues/360)) ([c95f1bd](https://github.com/0xPlayerOne/code-foundry/commit/c95f1bdeaa69fc5fbcd42821bc633edbbd31de49))
+* **release:** use rebase for release PRs ([#358](https://github.com/0xPlayerOne/code-foundry/issues/358)) ([3b2b2f5](https://github.com/0xPlayerOne/code-foundry/commit/3b2b2f5cee15e3f61a1688e5b3ef0847a6eb8c55))
+
 ## [0.34.12](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.11...v0.34.12) (2026-08-02)
 
 

package/README.md

@@ -90,8 +90,8 @@ checks, runners, coverage, caching, and custom workflow extensions.
 
 The contribution policy uses the `staging-release` workflow: feature PRs squash
 into `staging`, the promotion PR rebases into `main` (`merge_strategy: rebase`),
-and Release Please version PRs squash into `main` (`release_merge_strategy:
-squash`). Release automation never defaults to a merge method and never merges
+and Release Please version PRs rebase into `main` (`release_merge_strategy:
+rebase`). Release automation never defaults to a merge method and never merges
 with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on
 any other strategy. GitHub Stacks is not part of this topology and does not
 reduce the required workflow runs.

package/docs/CONFIGURATION.md

@@ -49,7 +49,7 @@ repository manifests and source
 | `license` | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3 |
 | `git_workflow` | `staging-release` | Branch/release model; the standard model promotes `staging` into `main` |
 | `merge_strategy` | `rebase` | Promotion merge method for `staging` → `main`; the staging-release topology requires rebase |
-| `release_merge_strategy` | `squash` | Merge method for Release Please version PRs into `main`; release automation fails closed unless squash |
+| `release_merge_strategy` | `rebase` | Merge method for Release Please version PRs into `main`; release automation fails closed unless rebase |
 | `runner` fields | GitHub runner names | Per-workflow runner policy |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,

package/docs/RELEASES.md

@@ -15,10 +15,10 @@ versions and generate grouped changelog notes.
 The merge audit pins one merge method per transition in this topology. Feature
 and fix branches land on `staging` with **squash** merges, the `staging` → `main`
 promotion PR merges with **rebase** (`merge_strategy: rebase`), and Release
-Please version PRs merge with **squash** (`release_merge_strategy: squash`).
+Please version PRs merge with **rebase** (`release_merge_strategy: rebase`).
 Release automation never defaults to a merge method and never merges with
 `--admin`: the release workflow fails closed unless `release_merge_strategy` is
-exactly `squash`. The current supported `git_workflow` is `staging-release`.
+exactly `rebase`. The current supported `git_workflow` is `staging-release`.
 
 The release workflow opens or updates a versioned PR after changes reach
 `main`. Merging that PR updates the changelog, creates the Git tag and GitHub
@@ -35,13 +35,13 @@ Set these values in `.github/code-foundry.yml`:
 release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
 merge_strategy: rebase # required: staging -> main promotion PRs rebase
-release_merge_strategy: squash # required: Release Please version PRs squash only
+release_merge_strategy: rebase # required: Release Please version PRs rebase only
 ```
 
 `merge_strategy` applies to promotion PRs (`staging` into `main`) and
 `release_merge_strategy` to Release Please version PRs; feature PRs into
 `staging` use squash merges. The topology requires `merge_strategy: rebase`
-and `release_merge_strategy: squash`; `code-foundry doctor` and
+and `release_merge_strategy: rebase`; `code-foundry doctor` and
 `code-foundry sync` reject any other value, and the release workflow fails
 closed instead of falling back to `merge`. Both keep `main` fully linear,
 which is what makes the post-release reconciliation possible: release-only
@@ -103,6 +103,6 @@ already passed).
 
 1. Merge tested changes from `staging` into `main`.
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's configured `release_merge_strategy` (**squash**; the release workflow fails closed on any other value).
+3. Merge the release PR with the repository's configured `release_merge_strategy` (**rebase**; the release workflow fails closed on any other value).
 4. Confirm the GitHub Release and any package publication.
 5. Synchronize `staging` with the new `main` release commit.

package/docs/WORKFLOWS.md

@@ -42,13 +42,13 @@ enabled for the repository profile.
 
 The merge audit pins one merge method per transition. `code-foundry doctor`
 and `code-foundry sync` fail closed on any other strategy, and the release
-workflow refuses to run unless its strategy is exactly `squash`.
+workflow refuses to run unless its strategy is exactly `rebase`.
 
 | Transition | Merge method | Enforcement |
 | --- | --- | --- |
 | Feature/fix PR into `staging` | Squash | Contribution policy; see `CONTRIBUTING.md` |
 | `staging` → `main` promotion PR | Rebase (`merge_strategy: rebase`) | `merge_strategy` must be `rebase`; merge commits are rejected |
-| Release Please version PR into `main` | Squash (`release_merge_strategy: squash`) | Release automation fails closed unless `squash`; never defaults to `merge`, never uses `--admin` |
+| Release Please version PR into `main` | Rebase (`release_merge_strategy: rebase`) | Release automation fails closed unless `rebase`; never defaults to `merge`, never uses `--admin` |
 
 Release auto-merge waits for required checks and then polls `mergeStateStatus`
 until it is `CLEAN`, or `UNSTABLE` with `mergeable` `MERGEABLE`, before
@@ -59,7 +59,7 @@ additional required checks after earlier ones have passed (for example
 merge policy-blocked. The mergeability poll is bounded and fails closed on
 conflicts or timeout; releases without an automation token remain manual.
 
-Keeping `main` linear — rebase promotions and squash release PRs — is what
+Keeping `main` linear — rebase promotions and rebase release PRs — is what
 lets the post-release reconciliation fast-forward or replay `staging` safely.
 
 Protect `staging` with the aggregate `Validation / Gate`, squash-only pull

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.34.12",
+  "version": "0.34.13",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/doctor.mjs

@@ -75,8 +75,8 @@ export function doctor(root, options = {}) {
     error(`merge_strategy must be "rebase" for the staging-release promotion topology; got "${mergeStrategy}".`)
   }
   const releaseMergeStrategy = config.release_merge_strategy ?? ''
-  if (includesValue(features, 'release') && releaseMergeStrategy !== 'squash') {
-    error(`release_merge_strategy must be "squash" for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`)
+  if (includesValue(features, 'release') && releaseMergeStrategy !== 'rebase') {
+    error(`release_merge_strategy must be "rebase" for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`)
   }
   for (const workflow of ['validation', 'draft-pr', 'release-pr', 'release']) {
     if (includesValue(features, workflow) && !existsSync(join(target, `.github/workflows/${workflow}.yml`))) error(`missing enabled workflow: ${workflow}.yml`)

package/src/commands/sync.mjs

@@ -84,8 +84,8 @@ export function syncRepository(options) {
     throw new Error(`Unsupported merge_strategy: ${mergeStrategy}; the staging-release topology requires rebase for staging to main promotions.`)
   }
   const releaseMergeStrategy = configured(config.release_merge_strategy, '')
-  if (includesValue(features, 'release') && releaseMergeStrategy !== 'squash') {
-    throw new Error(`Unsupported release_merge_strategy: ${releaseMergeStrategy || '(unset)'}; release automation requires squash for Release Please version pull requests and never defaults to merge.`)
+  if (includesValue(features, 'release') && releaseMergeStrategy !== 'rebase') {
+    throw new Error(`Unsupported release_merge_strategy: ${releaseMergeStrategy || '(unset)'}; release automation requires rebase for Release Please version pull requests and never defaults to merge.`)
   }
   const license = configured(config.license, existsSync(join(target, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later')
   const changed = []
@@ -460,7 +460,7 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase', release_merge_strategy: 'squash',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase', release_merge_strategy: 'rebase',
   }
 }
 

package/src/lib/release-policy.mjs

@@ -256,6 +256,12 @@ export function classifyReconciliation(input) {
   if (Array.isArray(directChangedPaths)) {
     const paths = [...new Set(directChangedPaths.map((path) => path.trim()).filter(Boolean))]
     const unexpected = unexpectedReleasePaths(paths, allowed)
+    // Git may hide patch-equivalent commits when divergentCommits uses
+    // --cherry-pick. If the final trees are identical and no non-equivalent
+    // commits remain, classify the branches consistently as aligned.
+    if (!paths.length && !mainOnlyCommits.length && !stagingOnlyCommits.length) {
+      return { action: 'aligned', targetSha: mainSha, reason: 'Branches have different history but identical content.' }
+    }
     const stagingOnlyReleaseOnly = stagingOnlyCommits.length > 0 && stagingOnlyCommits.every((commit) =>
       Array.isArray(commit.changedPaths) && commit.changedPaths.length > 0 && unexpectedReleasePaths(commit.changedPaths, allowed).length === 0,
     )