code-foundry 0.34.7 → 0.34.9

package/.github/workflows/release-pr.yml

@@ -41,25 +41,31 @@ jobs:
         # The partial clone (filter: blob:none) defers blob downloads, so the
         # merge-base/diff comparison below can trigger a promisor fetch. With
         # persist-credentials disabled, git has no auth for that fetch; configure
-        # the credential helper with the same token the Check step uses. The token
-        # is scoped to contents: read, so this never enables write credentials.
+        # the credential helper with the short-lived workflow token. NiftyLeague
+        # rejects long-lived fine-grained automation tokens with HTTP 403 even
+        # on REST, so all read-only operations use github.token; it is scoped
+        # to contents: read, so this never enables write credentials.
         env:
-          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          GH_TOKEN: ${{ github.token }}
         run: gh auth setup-git
 
       - name: Check
         id: check-pr
         env:
-          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          EXISTING=$(gh pr list \
-            --repo "$GITHUB_REPOSITORY" \
-            --limit 1 \
-            --base main \
-            --head staging \
-            --state open \
-            --json number | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
+          # Every lookup in this step is read-only and uses the short-lived
+          # workflow token: NiftyLeague rejects long-lived fine-grained
+          # automation tokens with HTTP 403 even on REST. The
+          # existing-promotion-PR lookup uses authenticated REST (gh api)
+          # rather than gh pr list, which issues a GraphQL query that
+          # NiftyLeague's long-lived fine-grained token policy rejects. The
+          # REST query keeps the exact base/head/state filter and the per_page=1
+          # cap (existing is 0 or 1) and fails closed on any API error.
+          EXISTING=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
+            --jq 'length')
           MAIN_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/main" --jq '.commit.tree.sha')
           STAGING_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/staging" --jq '.commit.tree.sha')
           TREE_EQUAL=false
@@ -186,26 +192,51 @@ jobs:
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 
-          DRAFT_ARGS=()
+          # Creation uses authenticated REST (gh api POST) rather than
+          # `gh pr create`, which issues a GraphQL mutation that
+          # NiftyLeague's long-lived fine-grained token policy rejects. The
+          # REST payload keeps the exact base/head/title/body fields, adds
+          # draft=true only when no automation token is configured, and stays
+          # fail-closed through the create-race fallback below.
+          CREATE_ARGS=(
+            "repos/${GITHUB_REPOSITORY}/pulls"
+            --method POST
+            --field base=main
+            --field head=staging
+            --field title="Promote staging -> main ($DATE)"
+            --field body=@"$BODY_FILE"
+          )
           if [ "$HAS_AUTOMATION_TOKEN" != true ]; then
-            DRAFT_ARGS+=(--draft)
+            CREATE_ARGS+=(--field draft=true)
             echo "::notice title=Manual PR readiness required::Created draft promotion PR because no automation token is configured. Configure CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN, or mark this PR ready manually to trigger validation."
           fi
 
-          if ! gh pr create \
-            --repo "$GITHUB_REPOSITORY" \
-            --base main \
-            --head staging \
-            "${DRAFT_ARGS[@]}" \
-            --title "Promote staging -> main ($DATE)" \
-            --body-file "$BODY_FILE"; then
-            EXISTING_NUMBER=$(gh pr list \
-              --repo "$GITHUB_REPOSITORY" \
-              --limit 1 \
-              --base main \
-              --head staging \
-              --state open \
-              --json number \
+          # Prefer the configured automation token for the write, but
+          # NiftyLeague rejects long-lived fine-grained tokens with HTTP 403
+          # even on REST, so retry the POST once with the short-lived workflow
+          # token before the create-race fallback. With no automation token
+          # configured, the first attempt already runs as github.token, so the
+          # retry only applies when an automation token was configured.
+          CREATED=false
+          if gh api "${CREATE_ARGS[@]}"; then
+            CREATED=true
+          elif [ "$HAS_AUTOMATION_TOKEN" = true ]; then
+            echo "::warning title=Token fallback::Automation token PR creation failed; retrying with the short-lived workflow token."
+            if GH_TOKEN="${{ github.token }}" gh api "${CREATE_ARGS[@]}"; then
+              CREATED=true
+            fi
+          fi
+
+          if [ "$CREATED" != true ]; then
+            # The create-race lookup runs only after creation failed: with a
+            # configured automation token that was rejected (its github.token
+            # retry also failed), or with no automation token configured, when
+            # the first attempt already ran as github.token. The lookup uses
+            # the same authenticated REST query as the Check step, always with
+            # the short-lived workflow token; gh pr list issues a GraphQL query
+            # that NiftyLeague's long-lived fine-grained token policy rejects.
+            EXISTING_NUMBER=$(GH_TOKEN="${{ github.token }}" gh api \
+              "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
               --jq '.[0].number // empty')
             if [ -z "$EXISTING_NUMBER" ]; then
               echo 'Pull request creation failed and no existing promotion PR was found.' >&2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.34.9](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.8...v0.34.9) (2026-08-02)
+
+
+### Bug Fixes
+
+* **ci:** fall back to github token for promotion ([37ff019](https://github.com/0xPlayerOne/code-foundry/commit/37ff019e95a9024338c05fec7579476bd5cf0b3f))
+
+## [0.34.8](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.7...v0.34.8) (2026-08-02)
+
+
+### Bug Fixes
+
+* **ci:** create promotion PRs through REST ([c123e21](https://github.com/0xPlayerOne/code-foundry/commit/c123e21e868de685a91de228ca57cf6614767bb7))
+
 ## [0.34.7](https://github.com/0xPlayerOne/code-foundry/compare/v0.34.6...v0.34.7) (2026-08-02)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.34.7",
+  "version": "0.34.9",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",