code-foundry 0.37.2 → 0.37.4

package/.github/workflows/codeql.yml

@@ -402,7 +402,7 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           languages: rust
           build-mode: ${{ needs.detect.outputs.rust_build_mode }}
@@ -413,7 +413,7 @@ jobs:
           needs.detect.outputs.enabled == 'true' &&
           needs.detect.outputs.rust_available == 'true' &&
           needs.detect.outputs.rust_changed == 'true'
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           category: /language:rust/${{ steps.scope.outputs.scope_id }}
           upload-database: false

package/.github/workflows/release-pr.yml

@@ -31,7 +31,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0

package/.github/workflows/release.yml

@@ -245,44 +245,14 @@ jobs:
           fi
           node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release validate-prs
           for pr in "${release_prs[@]}"; do
-            echo "Waiting for required checks on release PR #$pr"
-            checks_seen=false
-            for attempt in $(seq 1 60); do
-              : "$attempt"
-              if required_count=$(gh pr checks "$pr" \
-                --repo "$GITHUB_REPOSITORY" \
-                --required \
-                --json name \
-                --jq 'length' 2>/dev/null); then
-                if [ "$required_count" -gt 0 ]; then
-                  checks_seen=true
-                  break
-                fi
-              fi
-              sleep 5
-            done
-            if [ "$checks_seen" != true ]; then
-              echo "Required checks were not registered for release PR #$pr within the readiness window." >&2
-              exit 1
-            fi
-            gh pr checks "$pr" \
-              --repo "$GITHUB_REPOSITORY" \
-              --required \
-              --watch \
-              --fail-fast \
-              --interval 10
-            # gh pr checks --watch only waits for checks registered when the
-            # watch starts; a ruleset may register additional required checks
-            # afterwards (observed: "Validation / Gate" appearing after
-            # "Tauri 2 / Linux" had passed), which leaves the PR blocked by
-            # branch policy at merge time. Poll mergeStateStatus and accept
-            # only states GitHub reports as mergeable: CLEAN, or UNSTABLE with
-            # mergeable MERGEABLE. UNSTABLE is still mergeable when only
-            # non-required checks are failing or still running (observed: Kilo
-            # Code Review running after every required check passed); keep
-            # waiting for BLOCKED/BEHIND/UNKNOWN, fail fast on
-            # DIRTY/CONFLICTING, and fail closed on a bounded timeout so the
-            # workflow never sleeps indefinitely.
+            # GitHub's merge state is the authoritative required-check gate.
+            # `gh pr checks --required` is not reliable for ruleset-backed
+            # required contexts in private repositories: it can return an
+            # empty result even while the required aggregate check is present
+            # and green. Polling mergeStateStatus avoids that discovery race;
+            # GitHub reports MERGEABLE only after branch policy permits the
+            # requested merge strategy. Non-required checks may leave the PR
+            # UNSTABLE, so accept that state only with mergeable MERGEABLE.
             echo "Waiting for release PR #$pr to become mergeable under branch policy"
             merge_state=UNKNOWN
             mergeable=UNKNOWN
@@ -506,12 +476,12 @@ jobs:
           ref: ${{ needs.release.outputs.tag_name }}
       - name: Setup Node (trusted)
         if: env.NPM_TOKEN == ''
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       - name: Setup Node (token)
         if: env.NPM_TOKEN != ''
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org

package/.github/workflows/security.yml

@@ -215,7 +215,7 @@ jobs:
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Install cargo-audit
         if: steps.applicability.outputs.applicable == 'true'
-        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2
+        uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2
         with:
           tool: cargo-audit
       - name: Audit dependencies

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.37.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.3...v0.37.4) (2026-08-23)
+
+
+### Bug Fixes
+
+* release-workspace-state ([#395](https://github.com/0xPlayerOne/code-foundry/issues/395)) ([a708bc0](https://github.com/0xPlayerOne/code-foundry/commit/a708bc07272b9751b22a457771cc386601bbe3d8))
+
+## [0.37.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.2...v0.37.3) (2026-08-23)
+
+
+### Bug Fixes
+
+* release-required-check-discovery ([#392](https://github.com/0xPlayerOne/code-foundry/issues/392)) ([d086cb5](https://github.com/0xPlayerOne/code-foundry/commit/d086cb5b6d1dc25eb28b6551ae56467887637296))
+
 ## [0.37.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.1...v0.37.2) (2026-08-23)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.37.2",
+  "version": "0.37.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/lib/release-policy.mjs

@@ -1,7 +1,7 @@
 // @ts-check
 
 import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { isReleasePleaseHead } from './validation-policy.mjs'
 
 const DEFAULT_RELEASE_FILES = new Set([
@@ -71,6 +71,62 @@ export function unexpectedReleasePaths(paths, allowed) {
     .filter((path) => !allowed.has(path))
 }
 
+/**
+ * Verify Cargo package versions remain reproducible after Release Please
+ * updates a manifest. Release Please's Node updater can change Cargo.toml
+ * while leaving a configured generic Cargo.lock extra-file untouched.
+ * @param {string} root
+ * @param {Record<string, unknown>} config
+ * @returns {string[]}
+ */
+export function validateCargoLockVersions(root, config = {}) {
+  const paths = new Set(['Cargo.lock'])
+  /** @param {unknown} entries @param {string} [prefix] */
+  const addEntries = (entries, prefix = '') => {
+    if (!Array.isArray(entries)) return
+    for (const entry of entries) {
+      const value = typeof entry === 'string' ? entry : entry && typeof entry === 'object' && 'path' in entry ? entry.path : ''
+      if (typeof value !== 'string' || !value.endsWith('Cargo.lock')) continue
+      const clean = value.replace(/^\.\//, '').replace(/\\/g, '/')
+      paths.add(prefix ? `${prefix}/${clean}` : clean)
+    }
+  }
+  addEntries(config['extra-files'])
+  const packages = config.packages
+  if (packages && typeof packages === 'object' && !Array.isArray(packages)) {
+    for (const [directory, value] of Object.entries(packages)) {
+      if (value && typeof value === 'object' && !Array.isArray(value)) {
+        addEntries(value['extra-files'], directory === '.' ? '' : directory.replace(/\/$/, ''))
+      }
+    }
+  }
+
+  /** @type {string[]} */
+  const errors = []
+  for (const relativeLockPath of paths) {
+    const lockPath = join(root, relativeLockPath)
+    const manifestPath = join(root, dirname(relativeLockPath), 'Cargo.toml')
+    if (!existsSync(lockPath) || !existsSync(manifestPath)) continue
+    const manifestLines = readFileSync(manifestPath, 'utf8').split(/\r?\n/)
+    const packageStart = manifestLines.findIndex((line) => line.trim() === '[package]')
+    if (packageStart < 0) continue
+    const nextSection = manifestLines.findIndex((line, index) => index > packageStart && /^\s*\[/.test(line))
+    const packageSection = manifestLines.slice(packageStart + 1, nextSection < 0 ? manifestLines.length : nextSection).join('\n')
+    const packageName = packageSection.match(/^name\s*=\s*"([^"]+)"\s*$/m)?.[1]
+    const packageVersion = packageSection.match(/^version\s*=\s*"([^"]+)"\s*$/m)?.[1]
+    if (!packageName || !packageVersion) continue
+    const lock = readFileSync(lockPath, 'utf8')
+    const lockPackage = [...lock.matchAll(/\[\[package\]\]\s+name\s*=\s*"([^"]+)"\s+version\s*=\s*"([^"]+)"/g)]
+      .find((match) => match[1] === packageName)
+    if (!lockPackage) {
+      errors.push(`${relativeLockPath} is missing the ${packageName} package entry.`)
+    } else if (lockPackage[2] !== packageVersion) {
+      errors.push(`${relativeLockPath} version ${lockPackage[2]} does not match ${relativeLockPath.replace(/Cargo\.lock$/, 'Cargo.toml')} version ${packageVersion}.`)
+    }
+  }
+  return errors
+}
+
 /**
  * Detect release-only divergence after a rebased staging promotion. A normal
  * main-ancestor relationship must always remain promotable, even when the new
@@ -140,11 +196,11 @@ const VERSION_METADATA_FILES = new Set([
  * must carry the exact approved Release Please prefix, come from the same
  * repository, change at least one path, change no unexpected paths, and bump
  * at least one version-metadata file (or a declared extra file).
- * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown> }} input
+ * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown>, root?: string }} input
  * @returns {{ valid: boolean, errors: string[], changedPaths: string[] }}
  */
 export function validateGeneratedReleaseDiff(input) {
-  const { headRef = '', headRepo = '', repository = '', changedPaths = [], config = {} } = input
+  const { headRef = '', headRepo = '', repository = '', changedPaths = [], config = {}, root = process.cwd() } = input
   /** @type {string[]} */
   const errors = []
   if (!isReleasePleaseHead(headRef)) {
@@ -173,6 +229,7 @@ export function validateGeneratedReleaseDiff(input) {
   if (!paths.some((path) => versionMetadata.has(path))) {
     errors.push('Generated release pull request changes no version metadata.')
   }
+  errors.push(...validateCargoLockVersions(root, config))
   return { valid: errors.length === 0, errors, changedPaths: paths }
 }
 

package/src/runtime.mjs

@@ -85,6 +85,7 @@ function validation(task) {
       repository: process.env.FOUNDRY_REPOSITORY ?? '',
       changedPaths,
       config: readReleaseConfig(root),
+      root,
     })
     if (!result.valid) {
       for (const error of result.errors) console.error(`::error::${error}`)