code-foundry 0.37.3 → 0.37.5

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.37.5](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.4...v0.37.5) (2026-08-23)
+
+
+### Bug Fixes
+
+* **sync:** omit Cargo Dependabot outside Rust repos ([#398](https://github.com/0xPlayerOne/code-foundry/issues/398)) ([395c4f3](https://github.com/0xPlayerOne/code-foundry/commit/395c4f34887bbb3e9f67378325b70c21d467adf0))
+
+## [0.37.4](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.3...v0.37.4) (2026-08-23)
+
+
+### Bug Fixes
+
+* release-workspace-state ([#395](https://github.com/0xPlayerOne/code-foundry/issues/395)) ([a708bc0](https://github.com/0xPlayerOne/code-foundry/commit/a708bc07272b9751b22a457771cc386601bbe3d8))
+
 ## [0.37.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.2...v0.37.3) (2026-08-23)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.37.3",
+  "version": "0.37.5",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -146,7 +146,7 @@ export function syncRepository(options) {
       content = Buffer.from(renderWorkflow(content.toString('utf8'), config, runtimeRepository, runtimeRef, rustCodeql))
     }
     if (file === '.github/dependabot.yml') {
-      content = Buffer.from(renderDependabot(content.toString('utf8'), config))
+      content = Buffer.from(renderDependabot(content.toString('utf8'), config, languages))
     }
     if (['AGENTS.md', '.github/CONTRIBUTING.md', '.github/SECURITY.md'].includes(file)) {
       content = Buffer.from(renderContributionDocs(content.toString('utf8'), file, config))
@@ -393,14 +393,23 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
 
 /**
  * Dependabot updates land on the repository's integration branch. Direct
- * repositories have no staging branch, so every update targets main.
+ * repositories have no staging branch, so every update targets main. Cargo
+ * updates are emitted only when Rust is part of the configured language set.
  * @param {string} content
  * @param {Record<string,string>} config
+ * @param {string} languages
  * @returns {string}
  */
-function renderDependabot(content, config) {
-  if (isStagingRelease(config.git_workflow)) return content
-  return content.replaceAll('target-branch: staging', 'target-branch: main')
+function renderDependabot(content, config, languages) {
+  let rendered = content
+  if (!includesValue(languages, 'rust')) {
+    rendered = rendered
+      .split(/(?=^  - package-ecosystem: )/m)
+      .filter((block) => !block.startsWith('  - package-ecosystem: cargo\n'))
+      .join('')
+  }
+  if (isStagingRelease(config.git_workflow)) return rendered
+  return rendered.replaceAll('target-branch: staging', 'target-branch: main')
 }
 
 /**

package/src/lib/release-policy.mjs

@@ -1,7 +1,7 @@
 // @ts-check
 
 import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { isReleasePleaseHead } from './validation-policy.mjs'
 
 const DEFAULT_RELEASE_FILES = new Set([
@@ -71,6 +71,62 @@ export function unexpectedReleasePaths(paths, allowed) {
     .filter((path) => !allowed.has(path))
 }
 
+/**
+ * Verify Cargo package versions remain reproducible after Release Please
+ * updates a manifest. Release Please's Node updater can change Cargo.toml
+ * while leaving a configured generic Cargo.lock extra-file untouched.
+ * @param {string} root
+ * @param {Record<string, unknown>} config
+ * @returns {string[]}
+ */
+export function validateCargoLockVersions(root, config = {}) {
+  const paths = new Set(['Cargo.lock'])
+  /** @param {unknown} entries @param {string} [prefix] */
+  const addEntries = (entries, prefix = '') => {
+    if (!Array.isArray(entries)) return
+    for (const entry of entries) {
+      const value = typeof entry === 'string' ? entry : entry && typeof entry === 'object' && 'path' in entry ? entry.path : ''
+      if (typeof value !== 'string' || !value.endsWith('Cargo.lock')) continue
+      const clean = value.replace(/^\.\//, '').replace(/\\/g, '/')
+      paths.add(prefix ? `${prefix}/${clean}` : clean)
+    }
+  }
+  addEntries(config['extra-files'])
+  const packages = config.packages
+  if (packages && typeof packages === 'object' && !Array.isArray(packages)) {
+    for (const [directory, value] of Object.entries(packages)) {
+      if (value && typeof value === 'object' && !Array.isArray(value)) {
+        addEntries(value['extra-files'], directory === '.' ? '' : directory.replace(/\/$/, ''))
+      }
+    }
+  }
+
+  /** @type {string[]} */
+  const errors = []
+  for (const relativeLockPath of paths) {
+    const lockPath = join(root, relativeLockPath)
+    const manifestPath = join(root, dirname(relativeLockPath), 'Cargo.toml')
+    if (!existsSync(lockPath) || !existsSync(manifestPath)) continue
+    const manifestLines = readFileSync(manifestPath, 'utf8').split(/\r?\n/)
+    const packageStart = manifestLines.findIndex((line) => line.trim() === '[package]')
+    if (packageStart < 0) continue
+    const nextSection = manifestLines.findIndex((line, index) => index > packageStart && /^\s*\[/.test(line))
+    const packageSection = manifestLines.slice(packageStart + 1, nextSection < 0 ? manifestLines.length : nextSection).join('\n')
+    const packageName = packageSection.match(/^name\s*=\s*"([^"]+)"\s*$/m)?.[1]
+    const packageVersion = packageSection.match(/^version\s*=\s*"([^"]+)"\s*$/m)?.[1]
+    if (!packageName || !packageVersion) continue
+    const lock = readFileSync(lockPath, 'utf8')
+    const lockPackage = [...lock.matchAll(/\[\[package\]\]\s+name\s*=\s*"([^"]+)"\s+version\s*=\s*"([^"]+)"/g)]
+      .find((match) => match[1] === packageName)
+    if (!lockPackage) {
+      errors.push(`${relativeLockPath} is missing the ${packageName} package entry.`)
+    } else if (lockPackage[2] !== packageVersion) {
+      errors.push(`${relativeLockPath} version ${lockPackage[2]} does not match ${relativeLockPath.replace(/Cargo\.lock$/, 'Cargo.toml')} version ${packageVersion}.`)
+    }
+  }
+  return errors
+}
+
 /**
  * Detect release-only divergence after a rebased staging promotion. A normal
  * main-ancestor relationship must always remain promotable, even when the new
@@ -140,11 +196,11 @@ const VERSION_METADATA_FILES = new Set([
  * must carry the exact approved Release Please prefix, come from the same
  * repository, change at least one path, change no unexpected paths, and bump
  * at least one version-metadata file (or a declared extra file).
- * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown> }} input
+ * @param {{ headRef?: string, headRepo?: string, repository?: string, changedPaths?: string[], config?: Record<string, unknown>, root?: string }} input
  * @returns {{ valid: boolean, errors: string[], changedPaths: string[] }}
  */
 export function validateGeneratedReleaseDiff(input) {
-  const { headRef = '', headRepo = '', repository = '', changedPaths = [], config = {} } = input
+  const { headRef = '', headRepo = '', repository = '', changedPaths = [], config = {}, root = process.cwd() } = input
   /** @type {string[]} */
   const errors = []
   if (!isReleasePleaseHead(headRef)) {
@@ -173,6 +229,7 @@ export function validateGeneratedReleaseDiff(input) {
   if (!paths.some((path) => versionMetadata.has(path))) {
     errors.push('Generated release pull request changes no version metadata.')
   }
+  errors.push(...validateCargoLockVersions(root, config))
   return { valid: errors.length === 0, errors, changedPaths: paths }
 }
 

package/src/runtime.mjs

@@ -85,6 +85,7 @@ function validation(task) {
       repository: process.env.FOUNDRY_REPOSITORY ?? '',
       changedPaths,
       config: readReleaseConfig(root),
+      root,
     })
     if (!result.valid) {
       for (const error of result.errors) console.error(`::error::${error}`)