code-foundry 0.34.14 → 0.36.0

package/.github/licenses/APACHE-2.0.txt

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/.github/workflows/draft-pr.yml

@@ -8,6 +8,11 @@ on:
         required: false
         type: string
         default: ubuntu-slim
+      base:
+        description: Base branch for the draft pull request (staging for the staging-release topology, main for the direct topology).
+        required: false
+        type: string
+        default: staging
     secrets:
       CODE_FOUNDRY_TOKEN:
         required: false
@@ -34,7 +39,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           BRANCH="$HEAD_REF"
-          EXISTING=$(gh pr list --repo "$GITHUB_REPOSITORY" --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
+          EXISTING=$(gh pr list --repo "$GITHUB_REPOSITORY" --limit 1 --base "${{ inputs.base }}" --head "$BRANCH" --state open --json number,title 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
 
       - name: Create
@@ -86,7 +91,7 @@ jobs:
           CREATE_ARGS=(
             "repos/${GITHUB_REPOSITORY}/pulls"
             --method POST
-            --field base=staging
+            --field base="${{ inputs.base }}"
             --field head="$BRANCH"
             --field title="$PR_TITLE"
             --field body="@$BODY_FILE"

package/.github/workflows/draft-pr_self-ci.yml

@@ -21,6 +21,7 @@ jobs:
     uses: ./.github/workflows/draft-pr.yml
     with:
       runner: ubuntu-slim
+      base: staging
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
       RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.36.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.35.0...v0.36.0) (2026-08-07)
+
+
+### Features
+
+* make staging-release opt-in and direct-to-main the default ([#370](https://github.com/0xPlayerOne/code-foundry/issues/370)) ([7c66507](https://github.com/0xPlayerOne/code-foundry/commit/7c665071769f0b0332e2f47929ee0c19bbfd5af3))
+
+## [0.35.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.14...v0.35.0) (2026-08-04)
+
+
+### Features
+
+* support Apache 2.0 license sync ([538e7e4](https://github.com/0xPlayerOne/code-foundry/commit/538e7e4e85f9ee8c0af3e319f0440fc78e14dae9))
+
+
+### Bug Fixes
+
+* validate license policy before sync ([5baffa8](https://github.com/0xPlayerOne/code-foundry/commit/5baffa80c59f907fbf27974b43dfa4e063842d71))
+
 ## [0.34.14](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.13...v0.34.14) (2026-08-03)
 
 

package/README.md

@@ -68,8 +68,8 @@ when present and otherwise uses native language tooling; choose `native` or
 
 The standard workflow triggers are:
 
-- Pushes to `main` and `staging`.
-- Pull requests targeting `staging`.
+- Pushes to `main` (and `staging` when `git_workflow: staging-release` is configured).
+- Pull requests targeting `main` (and `staging` in the staging-release topology).
 - Draft PR automation for supported feature/fix branches.
 
 Jobs are language-aware and skip irrelevant setup while remaining visible as
@@ -88,20 +88,25 @@ GitHub Code Quality or other paid GitHub features.
 See [Workflow and CI conventions](docs/WORKFLOWS.md) for triggers, required
 checks, runners, coverage, caching, and custom workflow extensions.
 
-The contribution policy uses the `staging-release` workflow: feature PRs squash
-into `staging`, the promotion PR rebases into `main` (`merge_strategy: rebase`),
-and Release Please version PRs rebase into `main` (`release_merge_strategy:
-rebase`). Release automation never defaults to a merge method and never merges
-with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on
-any other strategy. GitHub Stacks is not part of this topology and does not
-reduce the required workflow runs.
+The contribution policy defaults to the `direct` workflow: feature PRs squash
+into `main`, and Release Please version PRs rebase into `main`
+(`release_merge_strategy: rebase`). Repositories with a preview/staging
+environment opt into `git_workflow: staging-release`, where feature PRs squash
+into `staging`, the promotion PR rebases into `main` (`merge_strategy:
+rebase`), and Release Please version PRs rebase into `main`. Release automation
+never defaults to a merge method and never merges with `--admin`;
+`code-foundry doctor` and `code-foundry sync` fail closed on any other
+strategy. GitHub Stacks is not part of this topology and does not reduce the
+required workflow runs.
 
 ## Releases and publishing
 
-The standard flow promotes `staging` into `main`, lets Release Please open a
-versioned release PR, and creates a GitHub release after that PR is merged.
-npm publication is opt-in through `npm_publish: true` and supports npm trusted
-publishing or an `NPM_TOKEN` fallback.
+In the default `direct` flow, changes reach `main` through feature pull
+requests and Release Please opens a versioned release PR against `main`. In
+the `staging-release` flow, a promotion PR promotes `staging` into `main`
+first. Either way, Release Please creates a GitHub release after the version
+PR is merged. npm publication is opt-in through `npm_publish: true` and
+supports npm trusted publishing or an `NPM_TOKEN` fallback.
 
 Read [Release management](docs/RELEASES.md) and
 [Publishing packages](docs/PUBLISHING.md) before enabling automated

package/docs/CONFIGURATION.md

@@ -46,15 +46,38 @@ repository manifests and source
 | `runtime_ref` | tag or branch | Reusable workflow version |
 | `release_type` | `node`, `python`, `rust`, `simple`, `none` | Release strategy |
 | `npm_publish` | `true` or `false` | Opt into npm publication |
-| `license` | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3 |
-| `git_workflow` | `staging-release` | Branch/release model; the standard model promotes `staging` into `main` |
-| `merge_strategy` | `rebase` | Promotion merge method for `staging` → `main`; the staging-release topology requires rebase |
+| `license` | `gpl-3.0-or-later`, `agpl-3.0-or-later`, `apache-2.0`, `mit`, `preserve`, `none` | License policy; new repositories default to GPLv3 |
+| `git_workflow` | `direct` (default), `staging-release` | Branch/release model; `direct` opens feature branches into `main`, `staging-release` promotes `staging` into `main` |
+| `merge_strategy` | `rebase` | Promotion merge method for `staging` → `main`; only enforced by the `staging-release` topology |
 | `release_merge_strategy` | `rebase` | Merge method for Release Please version PRs into `main`; release automation fails closed unless rebase |
 | `runner` fields | GitHub runner names | Per-workflow runner policy |
 
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,
 `release-pr`, `release`, and `dependabot`.
 
+## Git workflow
+
+`git_workflow` selects the branch topology:
+
+- `direct` (default): feature branches open pull requests directly into
+  `main`. Validation and security scans run on every PR. No `staging` branch
+  exists, no promotion caller is generated, and `merge_strategy` is not
+  enforced. Dependabot updates target `main`. This is the right choice when a
+  repository has no preview or staging environment.
+- `staging-release` (opt-in): feature branches squash into `staging`, a
+  promotion PR rebases validated changes into `main` (`merge_strategy:
+  rebase`), and Release Please version PRs rebase into `main`
+  (`release_merge_strategy: rebase`). Choose this only when the repository
+  maintains a preview/staging environment that needs validated integration
+  before release.
+
+```yaml
+# A repository with a preview/staging environment
+git_workflow: staging-release
+```
+
+Any other value is rejected by `code-foundry sync` and `code-foundry doctor`.
+
 ## Editing workflow
 
 `init` creates the file and renders the baseline. `sync` reads the file and

package/docs/RELEASES.md

@@ -2,7 +2,14 @@
 
 ## Branch flow
 
-The standard environment flow is:
+The default `direct` flow is:
+
+```text
+topic branch -> main -> versioned release
+```
+
+Repositories that maintain a preview/staging environment opt into the
+`staging-release` flow:
 
 ```text
 topic branch -> staging -> main -> versioned release
@@ -12,13 +19,15 @@ Keep commits Conventional Commit-shaped (`feat:`, `fix:`, `docs:`, `ci:`,
 `chore:`, and so on). Release Please uses them to select patch/minor/major
 versions and generate grouped changelog notes.
 
-The merge audit pins one merge method per transition in this topology. Feature
-and fix branches land on `staging` with **squash** merges, the `staging` → `main`
-promotion PR merges with **rebase** (`merge_strategy: rebase`), and Release
-Please version PRs merge with **rebase** (`release_merge_strategy: rebase`).
-Release automation never defaults to a merge method and never merges with
-`--admin`: the release workflow fails closed unless `release_merge_strategy` is
-exactly `rebase`. The current supported `git_workflow` is `staging-release`.
+The merge audit pins one merge method per transition. In the `staging-release`
+topology, feature and fix branches land on `staging` with **squash** merges,
+the `staging` → `main` promotion PR merges with **rebase** (`merge_strategy:
+rebase`), and Release Please version PRs merge with **rebase**
+(`release_merge_strategy: rebase`). In the `direct` topology, feature and fix
+branches squash straight into `main` and only Release Please version PRs merge
+with **rebase**; `merge_strategy` is not enforced. Release automation never
+defaults to a merge method and never merges with `--admin`: the release
+workflow fails closed unless `release_merge_strategy` is exactly `rebase`.
 
 The release workflow opens or updates a versioned PR after changes reach
 `main`. Merging that PR updates the changelog, creates the Git tag and GitHub
@@ -34,27 +43,32 @@ Set these values in `.github/code-foundry.yml`:
 ```yaml
 release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
-merge_strategy: rebase # required: staging -> main promotion PRs rebase
+git_workflow: direct # direct (default) or staging-release
+merge_strategy: rebase # staging-release only: staging -> main promotion PRs rebase
 release_merge_strategy: rebase # required: Release Please version PRs rebase only
 ```
 
-`merge_strategy` applies to promotion PRs (`staging` into `main`) and
-`release_merge_strategy` to Release Please version PRs; feature PRs into
-`staging` use squash merges. The topology requires `merge_strategy: rebase`
-and `release_merge_strategy: rebase`; `code-foundry doctor` and
-`code-foundry sync` reject any other value, and the release workflow fails
-closed instead of falling back to `merge`. Both keep `main` fully linear,
-which is what makes the post-release reconciliation possible: release-only
-main commits cannot be discarded because they are allowed metadata-only, and
-all non-metadata drift is rejected before mutation.
-
-Patch-equivalent divergence between `main` and `staging` is treated as aligned.
-When `staging` has pending commits that are not yet represented on `main`, the
-release workflow replays those staging-only commits in order onto a detached
-worktree rooted at `main`, and then updates `staging` with an exact
+`git_workflow: staging-release` is opt-in; without it, repositories use the
+`direct` flow and no promotion PR exists. When the staging-release topology is
+selected, `merge_strategy` applies to promotion PRs (`staging` into `main`)
+and `release_merge_strategy` to Release Please version PRs; feature PRs into
+`staging` use squash merges. `code-foundry doctor` and `code-foundry sync`
+reject any non-`rebase` `merge_strategy` only when `staging-release` is
+configured, and always reject a non-`rebase` `release_merge_strategy`; the
+release workflow fails closed instead of falling back to `merge`. Both keep
+`main` fully linear, which is what makes the post-release reconciliation
+possible: release-only main commits cannot be discarded because they are
+allowed metadata-only, and all non-metadata drift is rejected before mutation.
+
+The `staging` → `main` reconciliation exists only in the `staging-release`
+topology. Patch-equivalent divergence between `main` and `staging` is treated
+as aligned. When `staging` has pending commits that are not yet represented on
+`main`, the release workflow replays those staging-only commits in order onto a
+detached worktree rooted at `main`, and then updates `staging` with an exact
 `--force-with-lease` to prevent
 unintended branch rewrites. There is no unconditional mirror force-push and no
-fallback synchronization commit path.
+fallback synchronization commit path. `direct` repositories skip this step
+entirely.
 
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
 repository without a package manifest and `none` for a repository that should
@@ -101,8 +115,8 @@ already passed).
 
 ## Operational checklist
 
-1. Merge tested changes from `staging` into `main`.
+1. Merge tested changes into `main` (direct: feature PRs; staging-release: promote `staging` into `main`).
 2. Review the generated Release Please PR and changelog.
 3. Merge the release PR with the repository's configured `release_merge_strategy` (**rebase**; the release workflow fails closed on any other value).
 4. Confirm the GitHub Release and any package publication.
-5. Synchronize `staging` with the new `main` release commit.
+5. staging-release only: synchronize `staging` with the new `main` release commit.

package/docs/WORKFLOWS.md

@@ -7,18 +7,22 @@ points; it does not run the same suites again on branch pushes:
 
 ```yaml
 pull_request:
-  branches: [main, staging]
+  branches: [main, staging]   # staging-release topology
+  # direct topology: branches: [main]
 schedule:
   - cron: '31 6 * * 1'
 workflow_dispatch:
 ```
 
-Pull requests into `staging` run the fast tier, ordinary pull requests into
-`main` run the full audit tier, and exact Release Please pull requests into
-`main` run only release policy. Scheduled and manual runs select the audit
-tier. Draft PR automation separately listens to supported topic-branch pushes,
-promotion automation listens to `staging` pushes, and release automation
-listens to `main` pushes.
+In the `staging-release` topology, pull requests into `staging` run the fast
+tier, ordinary pull requests into `main` run the full audit tier, and exact
+Release Please pull requests into `main` run only release policy. In the
+`direct` topology (the default) every pull request targets `main` and runs the
+full audit tier, because there is no integration branch for a fast pass.
+Scheduled and manual runs select the audit tier in both topologies. Draft PR
+automation separately listens to supported topic-branch pushes, promotion
+automation listens to `staging` pushes (staging-release only), and release
+automation listens to `main` pushes.
 Custom deployment, indexing, search, Slither, or other workflows are
 repository-owned extensions and should keep their own triggers and permissions.
 
@@ -31,7 +35,7 @@ repository-owned extensions and should keep their own triggers and permissions.
 | Security | Profile, audits, and public-only Dependency Review |
 | CodeQL | GitHub-native code scanning, kept separate from CI |
 | Draft PR | Create/update development pull requests |
-| Release PR | Promote `staging` into `main` |
+| Release PR | Promote `staging` into `main` (staging-release topology only) |
 | Release | Release Please, GitHub release, and optional npm publication |
 
 Use concise job names such as `CI / Format`, `Test / Unit`, and
@@ -46,10 +50,15 @@ workflow refuses to run unless its strategy is exactly `rebase`.
 
 | Transition | Merge method | Enforcement |
 | --- | --- | --- |
-| Feature/fix PR into `staging` | Squash | Contribution policy; see `CONTRIBUTING.md` |
-| `staging` → `main` promotion PR | Rebase (`merge_strategy: rebase`) | `merge_strategy` must be `rebase`; merge commits are rejected |
+| Feature/fix PR into `main` (direct topology) | Squash | Contribution policy; see `CONTRIBUTING.md` |
+| Feature/fix PR into `staging` (staging-release topology) | Squash | Contribution policy; see `CONTRIBUTING.md` |
+| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`) | `merge_strategy` must be `rebase` when `git_workflow: staging-release`; merge commits are rejected |
 | Release Please version PR into `main` | Rebase (`release_merge_strategy: rebase`) | Release automation fails closed unless `rebase`; never defaults to `merge`, never uses `--admin` |
 
+The promotion rows above apply only to `staging-release`; `direct`
+repositories never generate a promotion caller and `merge_strategy` is not
+enforced for them.
+
 Release auto-merge waits for required checks and then polls `mergeStateStatus`
 until it is `CLEAN`, or `UNSTABLE` with `mergeable` `MERGEABLE`, before
 merging. Non-required checks that branch policy does not require (for example
@@ -60,10 +69,13 @@ merge policy-blocked. The mergeability poll is bounded and fails closed on
 conflicts or timeout; releases without an automation token remain manual.
 
 Keeping `main` linear — rebase promotions and rebase release PRs — is what
-lets the post-release reconciliation fast-forward or replay `staging` safely.
+lets the post-release reconciliation fast-forward or replay `staging` safely
+in the `staging-release` topology. `direct` repositories have no reconciliation
+step: releases merge straight into `main` with `release_merge_strategy: rebase`.
 
-Protect `staging` with the aggregate `Validation / Gate`, squash-only pull
-requests, and a single GitHub Actions integration path. That path uses the
+Protect `main` with the aggregate `Validation / Gate` and squash-only pull
+requests. In the `staging-release` topology, protect `staging` the same way
+with a single GitHub Actions integration path. That path uses the
 GitHub Actions integration token by default, and optionally an SSH deploy key
 when `STAGING_DEPLOY_KEY` is configured. The deploy key is required only when
 a personal-repository ruleset for `staging` enforces a Deploy Key bypass for
@@ -99,8 +111,8 @@ GitHub Stacks (stacked pull requests) is not part of this topology and does
 not reduce required workflow runs. Every pull request in a stack still
 triggers its own validation run, and each branch keeps its own required
 checks; stacking never collapses or skips a required check in the tiered
-validation gate. Land changes through the standard `staging-release` flow
-instead.
+validation gate. Land changes through the standard `direct` or
+`staging-release` flow instead.
 
 ## Language defaults
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.34.14",
+  "version": "0.36.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/doctor.mjs

@@ -70,16 +70,21 @@ export function doctor(root, options = {}) {
   }
 
   const features = config.features ?? 'all'
+  const workflow = config.git_workflow ?? 'direct'
+  if (!['direct', 'staging-release'].includes(workflow)) {
+    error(`unsupported git_workflow: ${workflow}; use direct or staging-release`)
+  }
   const mergeStrategy = config.merge_strategy ?? 'rebase'
-  if (mergeStrategy !== 'rebase') {
+  if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
     error(`merge_strategy must be "rebase" for the staging-release promotion topology; got "${mergeStrategy}".`)
   }
   const releaseMergeStrategy = config.release_merge_strategy ?? ''
   if (includesValue(features, 'release') && releaseMergeStrategy !== 'rebase') {
     error(`release_merge_strategy must be "rebase" for automated release merges; got "${releaseMergeStrategy || '(unset; release automation never defaults to merge)'}".`)
   }
-  for (const workflow of ['validation', 'draft-pr', 'release-pr', 'release']) {
-    if (includesValue(features, workflow) && !existsSync(join(target, `.github/workflows/${workflow}.yml`))) error(`missing enabled workflow: ${workflow}.yml`)
+  for (const name of ['validation', 'draft-pr', 'release-pr', 'release']) {
+    if (name === 'release-pr' && workflow !== 'staging-release') continue
+    if (includesValue(features, name) && !existsSync(join(target, `.github/workflows/${name}.yml`))) error(`missing enabled workflow: ${name}.yml`)
   }
   const validationEnabled = includesValue(features, 'validation') || ['ci', 'test', 'security', 'codeql'].some((legacy) => includesValue(features, legacy))
   const validationCaller = ['validation.yml', 'validation_self-ci.yml']

package/src/commands/fleet.mjs

@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os'
 import { spawnSync } from 'node:child_process'
 import { syncRepository } from './sync.mjs'
 
-/** @typedef {{ path: string, repository: string, runtimeRef: string, dirty: boolean, configured: boolean }} FleetRepository */
+/** @typedef {{ path: string, repository: string, runtimeRef: string, dirty: boolean, configured: boolean, gitWorkflow: string }} FleetRepository */
 
 /** @param {string} root @returns {FleetRepository[]} */
 export function discoverRepositories(root) {
@@ -24,6 +24,7 @@ export function discoverRepositories(root) {
       runtimeRef: config.runtime_ref ?? '',
       dirty: Boolean(git(candidate, ['status', '--porcelain'])),
       configured,
+      gitWorkflow: config.git_workflow ?? 'direct',
     })
   }
   return result.sort((a, b) => a.path.localeCompare(b.path))
@@ -64,12 +65,13 @@ export function upgradeFleet(root, source, options) {
 /** @param {FleetRepository} repository @param {string} source @param {string} version */
 function upgradeRepository(repository, source, version) {
   const branch = `codex/code-foundry-upgrade-${version.replace(/^v/, '')}`
+  const base = repository.gitWorkflow === 'staging-release' ? 'staging' : 'main'
   const temporary = mkdtempSync(join(tmpdir(), 'code-foundry-fleet-'))
   try {
-    const fetch = spawnSync('git', ['-C', repository.path, 'fetch', 'origin', 'staging', '--quiet'], { encoding: 'utf8' })
-    if (fetch.status !== 0) return { path: repository.path, status: 'skipped', reason: fetch.stderr.trim() || 'unable to refresh staging baseline' }
-    const baseline = spawnSync('git', ['-C', repository.path, 'rev-parse', 'origin/staging'], { encoding: 'utf8' })
-    if (baseline.status !== 0) return { path: repository.path, status: 'skipped', reason: 'remote staging branch is unavailable' }
+    const fetch = spawnSync('git', ['-C', repository.path, 'fetch', 'origin', base, '--quiet'], { encoding: 'utf8' })
+    if (fetch.status !== 0) return { path: repository.path, status: 'skipped', reason: fetch.stderr.trim() || `unable to refresh ${base} baseline` }
+    const baseline = spawnSync('git', ['-C', repository.path, 'rev-parse', `origin/${base}`], { encoding: 'utf8' })
+    if (baseline.status !== 0) return { path: repository.path, status: 'skipped', reason: `remote ${base} branch is unavailable` }
     const add = spawnSync('git', ['-C', repository.path, 'worktree', 'add', '-b', branch, temporary, baseline.stdout.trim()], { encoding: 'utf8' })
     if (add.status !== 0) return { path: repository.path, status: 'skipped', reason: add.stderr.trim() || 'unable to create isolated worktree' }
     const result = syncRepository({ target: temporary, source, force: false })
@@ -90,7 +92,7 @@ function upgradeRepository(repository, source, version) {
     if (commit.status !== 0) return { path: repository.path, status: 'failed', reason: commit.stderr.trim() || 'commit failed' }
     const push = spawnSync('git', ['-C', temporary, 'push', '-u', 'origin', branch], { encoding: 'utf8' })
     if (push.status !== 0) return { path: repository.path, status: 'failed', reason: push.stderr.trim() || 'push failed' }
-    const pr = spawnSync('gh', ['pr', 'create', '--repo', repository.repository, '--base', 'staging', '--head', branch, '--title', `chore(code-foundry): upgrade to ${version}`, '--body', `Automated isolated Code Foundry runtime upgrade to ${version}.\n\nThe sync preserved protected repository-owned documents and custom workflows.`], { encoding: 'utf8' })
+    const pr = spawnSync('gh', ['pr', 'create', '--repo', repository.repository, '--base', base, '--head', branch, '--title', `chore(code-foundry): upgrade to ${version}`, '--body', `Automated isolated Code Foundry runtime upgrade to ${version}.\n\nThe sync preserved protected repository-owned documents and custom workflows.`], { encoding: 'utf8' })
     return pr.status === 0
       ? { path: repository.path, status: 'pr-created', branch, pullRequest: pr.stdout.trim() }
       : { path: repository.path, status: 'failed', branch, reason: pr.stderr.trim() || 'pull request creation failed' }

package/src/commands/sync.mjs

@@ -4,7 +4,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync }
 import { dirname, join, resolve } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { detectLanguages, detectPackageManager, detectProfile, recommendRunners } from '../lib/profile.mjs'
-import { configured, includesValue, readConfig } from '../lib/config.mjs'
+import { configured, gitWorkflow, includesValue, isStagingRelease, readConfig } from '../lib/config.mjs'
 import { buildReleaseConfig, buildReleaseManifest } from '../lib/release-manifest.mjs'
 import { customWorkflowFiles, overlayPolicy } from '../lib/overlay.mjs'
 
@@ -33,6 +33,14 @@ const protectedFiles = new Set([
   '.github/PULL_REQUEST_TEMPLATE.md', '.github/SECURITY.md', 'NOTICE',
 ])
 
+/** @type {Record<string, string>} */
+const licenseFiles = {
+  'gpl-3.0-or-later': 'GPL-3.0-or-later.txt',
+  'agpl-3.0-or-later': 'AGPL-3.0-or-later.txt',
+  'apache-2.0': 'APACHE-2.0.txt',
+  'mit': 'MIT.txt',
+}
+
 const legacyFiles = [
   '.github/code-foundry.yml.example', '.github/template.yml', '.github/template.yml.example',
   '.github/scripts/bootstrap.sh', '.github/scripts/changed-files.sh', '.github/scripts/ci.sh',
@@ -57,6 +65,15 @@ export function syncRepository(options) {
   if (!Object.keys(existingConfig).length && !options.init) throw new Error('Missing .github/code-foundry.yml; run init first.')
   const defaults = createDefaultConfig(target, source)
   let config = { ...defaults, ...existingConfig }
+  // Resolve and validate the license policy before any sync writes occur
+  // (including config/default additions) so an unsupported policy fails
+  // fast without leaving partially generated files behind.
+  const license = configured(config.license, existsSync(join(target, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later')
+  const licenseFile = licenseFiles[license]
+  if (license !== 'preserve' && license !== 'none' && !licenseFile) {
+    const supported = [...Object.keys(licenseFiles), 'preserve', 'none'].join(', ')
+    throw new Error(`Unsupported license: ${license}; use ${supported}.`)
+  }
   if (!Object.keys(existingConfig).length) {
     writeOrReport(configPath, renderConfig(config), dryRun)
   } else {
@@ -79,15 +96,18 @@ export function syncRepository(options) {
   if (!['auto', 'native', 'mise'].includes(toolchain)) {
     throw new Error(`Unsupported toolchain: ${toolchain}; use auto, native, or mise.`)
   }
+  const workflow = gitWorkflow(config.git_workflow)
+  if (!['direct', 'staging-release'].includes(workflow)) {
+    throw new Error(`Unsupported git_workflow: ${workflow}; use direct or staging-release.`)
+  }
   const mergeStrategy = configured(config.merge_strategy, 'rebase')
-  if (mergeStrategy !== 'rebase') {
+  if (workflow === 'staging-release' && mergeStrategy !== 'rebase') {
     throw new Error(`Unsupported merge_strategy: ${mergeStrategy}; the staging-release topology requires rebase for staging to main promotions.`)
   }
   const releaseMergeStrategy = configured(config.release_merge_strategy, '')
   if (includesValue(features, 'release') && releaseMergeStrategy !== 'rebase') {
     throw new Error(`Unsupported release_merge_strategy: ${releaseMergeStrategy || '(unset)'}; release automation requires rebase for Release Please version pull requests and never defaults to merge.`)
   }
-  const license = configured(config.license, existsSync(join(target, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later')
   const changed = []
 
   // Keep normal semver pins current during sync while preserving intentional
@@ -125,6 +145,12 @@ export function syncRepository(options) {
     if (file.endsWith('.yml') && file.startsWith('.github/workflows/')) {
       content = Buffer.from(renderWorkflow(content.toString('utf8'), config, runtimeRepository, runtimeRef, rustCodeql))
     }
+    if (file === '.github/dependabot.yml') {
+      content = Buffer.from(renderDependabot(content.toString('utf8'), config))
+    }
+    if (['AGENTS.md', '.github/CONTRIBUTING.md', '.github/SECURITY.md'].includes(file)) {
+      content = Buffer.from(renderContributionDocs(content.toString('utf8'), file, config))
+    }
     if (file === '.gitignore' && existsSync(destination)) {
       content = Buffer.from(mergeGitignore(content.toString('utf8'), readFileSync(destination, 'utf8')))
     }
@@ -149,6 +175,18 @@ export function syncRepository(options) {
     }
   }
 
+  // A repository that no longer opts into the staging-release topology must
+  // not keep a generated staging promotion caller that would otherwise
+  // linger dormant (it triggers on pushes to a branch that does not exist).
+  if (!isStagingRelease(config.git_workflow)) {
+    const promotion = join(target, '.github/workflows/release-pr.yml')
+    if (existsSync(promotion) && isGeneratedEventCaller(readFileSync(promotion, 'utf8'), 'release-pr', runtimeRepository)) {
+      changed.push('.github/workflows/release-pr.yml')
+      if (dryRun) console.log('Would remove generated release-pr caller; the direct topology targets pull requests at main.')
+      else rmSync(promotion, { force: true })
+    }
+  }
+
   const releaseManifest = buildReleaseManifest(target, mergeReleaseConfig(target, sourcePath(source, 'release-please-config.json')))
   if (releaseManifest) {
     const manifestPath = join(target, '.release-please-manifest.json')
@@ -171,7 +209,6 @@ export function syncRepository(options) {
   }
 
   if (license !== 'preserve' && license !== 'none') {
-    const licenseFile = license === 'mit' ? 'MIT.txt' : license === 'agpl-3.0-or-later' ? 'AGPL-3.0-or-later.txt' : 'GPL-3.0-or-later.txt'
     const sourceLicense = join(source, '.github/licenses', licenseFile)
     if (!existsSync(sourceLicense)) throw new Error(`License template missing: ${sourceLicense}`)
     const licenseContent = readFileSync(sourceLicense)
@@ -252,6 +289,9 @@ function shouldInclude(file, languages, features, config) {
   if (file === '.github/dependabot.yml') return includesValue(features, 'dependabot')
   if (file === '.github/workflows/opencode-security.yml') return ['true', 'auto'].includes(config.opencode_security ?? 'false')
   const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
+  // The staging promotion caller only exists in the staging-release topology;
+  // direct repositories open feature branches into main and need no promotion.
+  if (workflow === 'release-pr' && !isStagingRelease(config.git_workflow)) return false
   // The tiered validation caller supersedes the legacy ci/test/security/codeql
   // event callers, so legacy feature names keep selecting it.
   if (workflow === 'validation') {
@@ -303,6 +343,18 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
     release: config.release_runner ?? config.runner,
   }
   const workflow = content.match(/\.github\/workflows\/([^/]+)\.yml/)?.[1]
+  // The staging-release topology validates and scans pull requests against
+  // both main and the integration branch; direct repositories only ever
+  // target main, so their callers trigger on main alone.
+  if (!isStagingRelease(config.git_workflow)) {
+    rendered = rendered.replace(/^(\s+branches:)\s*\[main,\s*staging\]\s*$/gm, `$1 [main]`)
+  }
+  if (workflow === 'draft-pr') {
+    // The draft PR caller states the PR base explicitly so the shared
+    // reusable workflow creates pull requests against the repository's
+    // configured integration branch (staging) or main (direct).
+    rendered = rendered.replace(/^(\s+base:)\s+.*$/m, `$1 ${isStagingRelease(config.git_workflow) ? 'staging' : 'main'}`)
+  }
   const runner = workflow ? runners[workflow] : undefined
   if (runner) rendered = rendered.replace(/^(\s+runner:)\s+.*$/m, `$1 ${runner}`)
   if (workflow === 'test' && config.unit_runner) {
@@ -333,6 +385,142 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   return rendered
 }
 
+/**
+ * Dependabot updates land on the repository's integration branch. Direct
+ * repositories have no staging branch, so every update targets main.
+ * @param {string} content
+ * @param {Record<string,string>} config
+ * @returns {string}
+ */
+function renderDependabot(content, config) {
+  if (isStagingRelease(config.git_workflow)) return content
+  return content.replaceAll('target-branch: staging', 'target-branch: main')
+}
+
+/**
+ * Contribution policy documents describe the repository's branch flow. The
+ * canonical templates describe the staging-release topology (this runtime
+ * itself uses it); direct repositories render the equivalent main-targeting
+ * policy. The transformation is exact-string based so any template drift
+ * fails loudly (a missed replacement leaves staging prose intact) instead of
+ * producing a partial hybrid.
+ * @param {string} content
+ * @param {string} file
+ * @param {Record<string,string>} config
+ * @returns {string}
+ */
+export function renderContributionDocs(content, file, config) {
+  if (isStagingRelease(config.git_workflow)) return content
+  const replacements = DIRECT_DOC_REPLACEMENTS[file]
+  if (!replacements) return content
+  let rendered = content
+  for (const [from, to] of replacements) {
+    if (!rendered.includes(from)) {
+      throw new Error(`Missing direct-workflow template marker in ${file}: ${JSON.stringify(from)}`)
+    }
+    rendered = rendered.replace(from, to)
+  }
+  return rendered
+}
+
+/** @type {Record<string, Array<[string, string]>>} */
+const DIRECT_DOC_REPLACEMENTS = {
+  'AGENTS.md': [
+    [
+      'For normal feature work, branch from `staging` and target pull requests at `staging`. Treat `main` as the protected release branch.',
+      'For normal feature work, branch from `main` and target pull requests at `main`. Treat `main` as the protected release branch.',
+    ],
+    [
+      'Use `push` for `main, staging` and `pull_request` for `staging` unless a workflow has a documented event-specific reason.',
+      'Use `push` for `main` and `pull_request` for `main` unless a workflow has a documented event-specific reason.',
+    ],
+  ],
+  '.github/CONTRIBUTING.md': [
+    [
+      '4. Branch from `staging` and target pull requests at `staging`; do not work directly on `main`.',
+      '4. Branch from `main` and target pull requests at `main`; do not push directly to `main`.',
+    ],
+    [
+      '```text\n                                      release PR\n                                   ┌──────────────┐\n                                   │              ▼\nfeat/*  fix/*  chore/*  ──PR──▶  staging  ──PR──▶  main\ndocs/*  test/*  refactor/*         │              │\n                                   │              └── protected release branch\n                                   └── integration branch\n```',
+      '```text\n                              release PR\n                           ┌──────────────┐\n                           │              ▼\nfeat/*  fix/*  chore/*  ──PR──▶  main\ndocs/*  test/*  refactor/*         │\n                                   └── protected release branch\n```',
+    ],
+    [
+      '| `main`                                                         | Protected release branch | Merge through the `staging` → `main` release PR. No direct pushes.        |',
+      '| `main`                                                         | Protected release branch | Merge through pull requests only. No direct pushes.                        |',
+    ],
+    [
+      '| `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |\n',
+      '',
+    ],
+    [
+      '| `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |',
+      '| `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `main`; keep changes small and reviewable.                   |',
+    ],
+    [
+      'The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.',
+      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. Feature branches never touch `staging`; repositories with a preview/staging environment opt into `git_workflow: staging-release` explicitly.',
+    ],
+    [
+      'git switch staging\ngit pull --ff-only origin staging',
+      'git switch main\ngit pull --ff-only origin main',
+    ],
+    [
+      '1. Start from an up-to-date `staging` branch.',
+      '1. Start from an up-to-date `main` branch.',
+    ],
+    [
+      '8. Push the branch and open a pull request into `staging`.',
+      '8. Push the branch and open a pull request into `main`.',
+    ],
+    [
+      '10. Merge with a squash after required checks pass and the change is ready; feature PRs land on `staging` with squash merges.',
+      '10. Merge with a squash after required checks pass and the change is ready; feature PRs land on `main` with squash merges.',
+    ],
+    [
+      '3. Branch from the upstream `staging` branch.',
+      '3. Branch from the upstream `main` branch.',
+    ],
+    [
+      '7. Push to the fork and open a pull request targeting `staging`.',
+      '7. Push to the fork and open a pull request targeting `main`.',
+    ],
+    [
+      '| Pull request targeting `staging` | Fast validation: CI plus unit tests, ending in `Validation / Gate` |\n',
+      '',
+    ],
+    [
+      '| Ordinary pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |',
+      '| Pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |',
+    ],
+    [
+      '| Push to `staging` | Promotion PR workflow; canonical validation waits for the PR event |\n',
+      '',
+    ],
+    [
+      '| Working branch    | `staging` | Squash                                                  | All applicable required checks pass                       |',
+      '| Working branch    | `main`    | Squash                                                  | All applicable required checks pass                       |',
+    ],
+    [
+      '| `staging` → `main` promotion | `main` | Rebase (`merge_strategy`)                   | Current staging checks, release review, and rollout notes |\n',
+      '',
+    ],
+    [
+      '1. Create a focused branch from `staging`.',
+      '1. Create a focused branch from `main`.',
+    ],
+  ],
+  '.github/SECURITY.md': [
+    [
+      'The latest commit on `staging` receives security patches. Patches are promoted to `main` through the next release cycle.',
+      'The latest commit on `main` receives security patches.',
+    ],
+    [
+      '| `staging`        | ✅        |\n',
+      '',
+    ],
+  ],
+}
+
 /** @param {Record<string,string>} config */
 function validateRustCodeqlConfig(config) {
   const threads = configured(config.codeql_rust_threads, '1')
@@ -460,7 +648,7 @@ function createDefaultConfig(root, source) {
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
     opencode_security: 'false',
     sync_mode: 'overlay', custom_workflows: 'preserve',
-    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'staging-release', merge_strategy: 'rebase', release_merge_strategy: 'rebase',
+    license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'direct', merge_strategy: 'rebase', release_merge_strategy: 'rebase',
   }
 }
 

package/src/lib/config.mjs

@@ -22,7 +22,7 @@ export function readConfig(file) {
   return config
 }
 
-/** @param {string} value @param {string} fallback */
+/** @param {string | undefined} value @param {string} fallback */
 export function configured(value, fallback) {
   return value === undefined || value === '' ? fallback : value
 }
@@ -36,3 +36,20 @@ export function listValue(value) {
 export function includesValue(value, item) {
   return value === 'all' || listValue(value).includes(item)
 }
+
+/**
+ * Supported Git workflows. `direct` (the default) opens feature branches
+ * directly into `main`; `staging-release` is opt-in for repositories that
+ * maintain a preview/staging integration branch.
+ */
+export const GIT_WORKFLOWS = ['direct', 'staging-release']
+
+/** @param {string|undefined} value @returns {string} */
+export function gitWorkflow(value) {
+  return configured(value, 'direct')
+}
+
+/** @param {string|undefined} value @returns {boolean} */
+export function isStagingRelease(value) {
+  return gitWorkflow(value) === 'staging-release'
+}