code-foundry 0.37.1 → 0.37.3

package/.github/workflows/codeql.yml

@@ -402,7 +402,7 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           languages: rust
           build-mode: ${{ needs.detect.outputs.rust_build_mode }}
@@ -413,7 +413,7 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           category: /language:rust/${{ steps.scope.outputs.scope_id }}
           upload-database: false

package/.github/workflows/release-pr.yml

@@ -31,7 +31,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0

package/.github/workflows/release.yml

@@ -245,44 +245,14 @@ jobs:
           fi
           node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release validate-prs
           for pr in "${release_prs[@]}"; do
-            echo "Waiting for required checks on release PR #$pr"
-            checks_seen=false
-            for attempt in $(seq 1 60); do
-              : "$attempt"
-              if required_count=$(gh pr checks "$pr" \
-                --repo "$GITHUB_REPOSITORY" \
-                --required \
-                --json name \
-                --jq 'length' 2>/dev/null); then
-                if [ "$required_count" -gt 0 ]; then
-                  checks_seen=true
-                  break
-                fi
-              fi
-              sleep 5
-            done
-            if [ "$checks_seen" != true ]; then
-              echo "Required checks were not registered for release PR #$pr within the readiness window." >&2
-              exit 1
-            fi
-            gh pr checks "$pr" \
-              --repo "$GITHUB_REPOSITORY" \
-              --required \
-              --watch \
-              --fail-fast \
-              --interval 10
-            # gh pr checks --watch only waits for checks registered when the
-            # watch starts; a ruleset may register additional required checks
-            # afterwards (observed: "Validation / Gate" appearing after
-            # "Tauri 2 / Linux" had passed), which leaves the PR blocked by
-            # branch policy at merge time. Poll mergeStateStatus and accept
-            # only states GitHub reports as mergeable: CLEAN, or UNSTABLE with
-            # mergeable MERGEABLE. UNSTABLE is still mergeable when only
-            # non-required checks are failing or still running (observed: Kilo
-            # Code Review running after every required check passed); keep
-            # waiting for BLOCKED/BEHIND/UNKNOWN, fail fast on
-            # DIRTY/CONFLICTING, and fail closed on a bounded timeout so the
-            # workflow never sleeps indefinitely.
+            # GitHub's merge state is the authoritative required-check gate.
+            # `gh pr checks --required` is not reliable for ruleset-backed
+            # required contexts in private repositories: it can return an
+            # empty result even while the required aggregate check is present
+            # and green. Polling mergeStateStatus avoids that discovery race;
+            # GitHub reports MERGEABLE only after branch policy permits the
+            # requested merge strategy. Non-required checks may leave the PR
+            # UNSTABLE, so accept that state only with mergeable MERGEABLE.
             echo "Waiting for release PR #$pr to become mergeable under branch policy"
             merge_state=UNKNOWN
             mergeable=UNKNOWN
@@ -506,12 +476,12 @@ jobs:
           ref: ${{ needs.release.outputs.tag_name }}
       - name: Setup Node (trusted)
         if: env.NPM_TOKEN == ''
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       - name: Setup Node (token)
         if: env.NPM_TOKEN != ''
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org

package/.github/workflows/security.yml

@@ -215,7 +215,7 @@ jobs:
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Install cargo-audit
         if: steps.applicability.outputs.applicable == 'true'
-        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2
+        uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2
         with:
           tool: cargo-audit
       - name: Audit dependencies

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.37.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.2...v0.37.3) (2026-08-23)
+
+
+### Bug Fixes
+
+* release-required-check-discovery ([#392](https://github.com/0xPlayerOne/code-foundry/issues/392)) ([d086cb5](https://github.com/0xPlayerOne/code-foundry/commit/d086cb5b6d1dc25eb28b6551ae56467887637296))
+
+## [0.37.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.1...v0.37.2) (2026-08-23)
+
+
+### Bug Fixes
+
+* **ci:** stabilize runners and release reconciliation ([#387](https://github.com/0xPlayerOne/code-foundry/issues/387)) ([ea2c503](https://github.com/0xPlayerOne/code-foundry/commit/ea2c503cb6ea9b944ffa5b70ff7fbfc3d56d3a10))
+
 ## [0.37.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.0...v0.37.1) (2026-08-08)
 
 

package/docs/RELEASES.md

@@ -57,8 +57,9 @@ reject any non-`rebase` `merge_strategy` only when `staging-release` is
 configured, and always reject a non-`rebase` `release_merge_strategy`; the
 release workflow fails closed instead of falling back to `merge`. Both keep
 `main` fully linear, which is what makes the post-release reconciliation
-possible: release-only main commits cannot be discarded because they are
-allowed metadata-only, and all non-metadata drift is rejected before mutation.
+possible. The final branch trees are inspected before mutation; validated
+main-only changes are inherited by `staging`, while unpromoted staging work is
+replayed on top of `main`.
 
 The `staging` → `main` reconciliation exists only in the `staging-release`
 topology. Patch-equivalent divergence between `main` and `staging` is treated
@@ -67,8 +68,8 @@ as aligned. When `staging` has pending commits that are not yet represented on
 detached worktree rooted at `main`, and then updates `staging` with an exact
 `--force-with-lease` to prevent
 unintended branch rewrites. There is no unconditional mirror force-push and no
-fallback synchronization commit path. `direct` repositories skip this step
-entirely.
+fallback synchronization commit path. Indeterminate history, replay conflicts,
+and stale leases fail closed. `direct` repositories skip this step entirely.
 
 `auto` selects a supported manifest. Use `simple` with `version.txt` for a
 repository without a package manifest and `none` for a repository that should

package/docs/WORKFLOWS.md

@@ -97,9 +97,11 @@ it opens (or reuses) a generated `code-foundry/reconcile/main-to-staging`
 pull request whose head contains the exact target tip (the `main` tip for a
 fast-forward, the replay tip when staging-only commits are replayed) and whose
 body documents the reconciliation. Reruns reuse the open pull request instead
-of duplicating it; unexpected code divergence, replay conflicts, authentication
-errors, and ambiguous or stale pull request state still fail the job closed,
-and exact-lease protection stays in place for every direct push.
+of duplicating it. Validated changes that landed directly on `main` are synced
+back into `staging`; unpromoted staging commits are replayed on top. Indeterminate
+history, replay conflicts, authentication errors, and ambiguous or stale pull
+request state still fail the job closed, and exact-lease protection stays in
+place for every direct push.
 
 For this reconciliation path, maintainer PATs and administrator roles are not
 authorized bypasses; the job deliberately authenticates with `github.token`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.37.1",
+  "version": "0.37.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -361,6 +361,12 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
     rendered = rendered.replace(/^(\s+unit-runner:)\s+.*$/m, `$1 ${config.unit_runner}`)
   }
   if (workflow === 'validation') {
+    // The mode classifier is a normal runner job in the caller rather than a
+    // reusable-workflow input. Keep it on the configured default runner so
+    // consumers that cannot use ubuntu-slim do not fail before validation.
+    if (config.runner) {
+      rendered = rendered.replace(/^  mode:\n    name: Mode\n    runs-on:\s+.*$/m, `  mode:\n    name: Mode\n    runs-on: ${config.runner}`)
+    }
     /** @type {Record<string, string|undefined>} */
     const runnerInputs = {
       'ci-runner': config.ci_runner ?? config.runner,

package/src/lib/release-policy.mjs

@@ -220,7 +220,7 @@ function compareVersions(a, b) {
  * Classify the relationship between main and staging using the final tree delta
  * when available. Historical commit paths can include equivalent workflow or
  * configuration changes that are no longer present in the branch delta, so the
- * final trees are the source of truth for release-only reconciliation. When
+ * final trees are the source of truth for reconciliation. When
  * directChangedPaths is supplied, unexpected paths in historical main-only
  * commits are ignored only when they are absent from the final tree delta
  * (their content is already identical in both branches); unexpected main-only
@@ -281,9 +281,9 @@ export function classifyReconciliation(input) {
     }
     if (!stagingOnlyCommits.length) {
       return {
-        action: 'fail',
-        reason: 'branch content differs outside release metadata.',
-        unexpected,
+        action: 'fast-forward',
+        targetSha: mainSha,
+        reason: 'main contains validated changes that staging must inherit.',
       }
     }
   }
@@ -300,7 +300,11 @@ export function classifyReconciliation(input) {
     [...new Set(mainOnlyCommits.flatMap((commit) => commit.changedPaths || []))],
     allowed,
   ).filter((path) => directTreePaths === null || directTreePaths.has(path))
-  if (unexpectedMain.length) {
+  // Without a final-tree comparison, retain the historical fail-closed
+  // behavior. When the final delta is known, main is the validated release
+  // source of truth: replay any staging-only work on top instead of deadlocking
+  // every later release because a hotfix landed directly on main.
+  if (unexpectedMain.length && directTreePaths === null) {
     return {
       action: 'fail',
       reason: 'main contains commits that are not release metadata.',
@@ -373,7 +377,7 @@ export function buildReconciliationPullRequestBody(input) {
     '',
     `Merging this pull request synchronizes \`${targetHead}\` with the exact target tip above; no other commits are introduced.`,
     '',
-    'Code Foundry reconciles only release metadata. Unexpected code divergence, replay conflicts, authentication failures, and ambiguous or stale state fail the release job closed and are never pushed around branch protection. Later releases retry the direct push first; when branch policy still rejects it, this pull request is updated instead of duplicated.',
+    `Code Foundry treats validated \`${sourceBase}\` as the shipped source of truth and preserves unpromoted \`${targetHead}\` work by replaying it on top. Indeterminate history, replay conflicts, authentication failures, and ambiguous or stale state fail the release job closed and are never pushed around branch protection. Later releases retry the direct push first; when branch policy still rejects it, this pull request is updated instead of duplicated.`,
   )
   return lines.join('\n')
 }