code-foundry 0.34.6 → 0.34.8

package/.github/workflows/release-pr.yml

@@ -37,19 +37,30 @@ jobs:
           fetch-depth: 0
           filter: blob:none
 
+      - name: Configure git auth for blob fetch
+        # The partial clone (filter: blob:none) defers blob downloads, so the
+        # merge-base/diff comparison below can trigger a promisor fetch. With
+        # persist-credentials disabled, git has no auth for that fetch; configure
+        # the credential helper with the same token the Check step uses. The token
+        # is scoped to contents: read, so this never enables write credentials.
+        env:
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
+        run: gh auth setup-git
+
       - name: Check
         id: check-pr
         env:
           GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
         run: |
           set -euo pipefail
-          EXISTING=$(gh pr list \
-            --repo "$GITHUB_REPOSITORY" \
-            --limit 1 \
-            --base main \
-            --head staging \
-            --state open \
-            --json number | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
+          # The existing-promotion-PR lookup uses authenticated REST (gh api)
+          # rather than gh pr list, which issues a GraphQL query that
+          # NiftyLeague's long-lived fine-grained token policy rejects. The
+          # REST query keeps the exact base/head/state filter and the per_page=1
+          # cap (existing is 0 or 1) and fails closed on any API error.
+          EXISTING=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
+            --jq 'length')
           MAIN_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/main" --jq '.commit.tree.sha')
           STAGING_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/staging" --jq '.commit.tree.sha')
           TREE_EQUAL=false
@@ -176,26 +187,31 @@ jobs:
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 
-          DRAFT_ARGS=()
+          # Creation uses authenticated REST (gh api POST) rather than
+          # `gh pr create`, which issues a GraphQL mutation that
+          # NiftyLeague's long-lived fine-grained token policy rejects. The
+          # REST payload keeps the exact base/head/title/body fields, adds
+          # draft=true only when no automation token is configured, and stays
+          # fail-closed through the create-race fallback below.
+          CREATE_ARGS=(
+            "repos/${GITHUB_REPOSITORY}/pulls"
+            --method POST
+            --field base=main
+            --field head=staging
+            --field title="Promote staging -> main ($DATE)"
+            --field body=@"$BODY_FILE"
+          )
           if [ "$HAS_AUTOMATION_TOKEN" != true ]; then
-            DRAFT_ARGS+=(--draft)
+            CREATE_ARGS+=(--field draft=true)
             echo "::notice title=Manual PR readiness required::Created draft promotion PR because no automation token is configured. Configure CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN, or mark this PR ready manually to trigger validation."
           fi
 
-          if ! gh pr create \
-            --repo "$GITHUB_REPOSITORY" \
-            --base main \
-            --head staging \
-            "${DRAFT_ARGS[@]}" \
-            --title "Promote staging -> main ($DATE)" \
-            --body-file "$BODY_FILE"; then
-            EXISTING_NUMBER=$(gh pr list \
-              --repo "$GITHUB_REPOSITORY" \
-              --limit 1 \
-              --base main \
-              --head staging \
-              --state open \
-              --json number \
+          if ! gh api "${CREATE_ARGS[@]}"; then
+            # The create-race lookup uses the same authenticated REST query as
+            # the Check step; gh pr list issues a GraphQL query that
+            # NiftyLeague's long-lived fine-grained token policy rejects.
+            EXISTING_NUMBER=$(gh api \
+              "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
               --jq '.[0].number // empty')
             if [ -z "$EXISTING_NUMBER" ]; then
               echo 'Pull request creation failed and no existing promotion PR was found.' >&2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.34.8](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.7...v0.34.8) (2026-08-02)
+
+
+### Bug Fixes
+
+* **ci:** create promotion PRs through REST ([c123e21](https://github.com/0xPlayerOne/code-foundry/commit/c123e21e868de685a91de228ca57cf6614767bb7))
+
+## [0.34.7](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.6...v0.34.7) (2026-08-02)
+
+
+### Bug Fixes
+
+* **release:** authenticate partial clone comparisons ([172dfbe](https://github.com/0xPlayerOne/code-foundry/commit/172dfbef53ab1a9eee44cf68f648889ae99b93b1))
+
 ## [0.34.6](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.5...v0.34.6) (2026-08-02)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.34.6",
+  "version": "0.34.8",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",