code-foundry 0.38.0 → 0.38.1

package/.github/actions/setup/action.yml

@@ -473,7 +473,7 @@ runs:
         steps.profile.outputs.javascript_package_manager == 'bun'
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: 1.3.14
+        bun-version: 1.4.0
 
     - name: Enable Corepack
       if: >-

package/.mise.toml

@@ -1,6 +1,6 @@
 [tools]
 node = "24.18.0"
-bun = "1.3.14"
+bun = "1.4.0"
 
 [settings]
 experimental = true

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.38.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.38.0...v0.38.1) (2026-08-29)
+
+
+### Bug Fixes
+
+* **release:** avoid unsafe history-only reconciliation PRs ([#412](https://github.com/0xPlayerOne/code-foundry/issues/412)) ([941f08b](https://github.com/0xPlayerOne/code-foundry/commit/941f08ba7e830ec3ab0ae9c6b937e488c621b95e))
+
 ## [0.38.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.37.5...v0.38.0) (2026-08-24)
 
 

package/docs/WORKFLOWS.md

@@ -136,7 +136,9 @@ so repositories without a Deploy Key ruleset bypass still reconcile successfully
 
 When the protected `staging` branch rejects the exact-lease reconcile push with
 a branch-policy/ruleset/required-PR error, the reconcile job does not fail:
-it opens (or reuses) a generated `code-foundry/reconcile/main-to-staging`
+if the branch trees are already identical, it reports a content-aligned no-op
+because a normal pull request cannot safely represent a history-only ref move.
+Otherwise, it opens (or reuses) a generated `code-foundry/reconcile/main-to-staging`
 pull request whose head contains the exact target tip (the `main` tip for a
 fast-forward, the replay tip when staging-only commits are replayed) and whose
 body documents the reconciliation. Reruns reuse the open pull request instead
@@ -146,6 +148,11 @@ history, replay conflicts, authentication errors, and ambiguous or stale pull
 request state still fail the job closed, and exact-lease protection stays in
 place for every direct push.
 
+Repositories using the generated pull request fallback must enable
+**Settings > Actions > General > Workflow permissions > Allow GitHub Actions
+to create and approve pull requests**. Code Foundry reports this exact setting
+when GitHub rejects pull request creation through the Actions integration.
+
 For this reconciliation path, maintainer PATs and administrator roles are not
 authorized bypasses; the job deliberately authenticates with `github.token`,
 not `CODE_FOUNDRY_TOKEN` or `RELEASE_PLEASE_TOKEN`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",
@@ -12,7 +12,7 @@
   "bugs": {
     "url": "https://github.com/0xPlayerOne/code-foundry/issues"
   },
-  "packageManager": "bun@1.3.14",
+  "packageManager": "bun@1.4.0",
   "bin": {
     "code-foundry": "src/cli.mjs"
   },

package/src/commands/release.mjs

@@ -197,6 +197,14 @@ function executeReconciliationMutation(target, base, head, state) {
     }
   }
   if (classification.category === 'policy') {
+    // A normal pull request cannot faithfully represent a history-only ref
+    // alignment. GitHub compares the divergent ancestry and can render a
+    // large, misleading content diff even though both branch trees are
+    // already identical. Preserve the protected branch and report the
+    // content-aligned state instead of opening an unsafe synchronization PR.
+    if (state.plan.action === 'aligned') {
+      return { success: true, result: { synchronization: 'content-aligned' } }
+    }
     return deliverReconciliationPullRequest(target, base, head, state, targetSha, {}, classification.message)
   }
   return { success: false, retry: true, error: `${head} synchronization failed with lease: ${classification.message}` }
@@ -282,7 +290,7 @@ function deliverReconciliationPullRequest(target, base, head, state, targetSha,
     selection = selectReconciliationPullRequest(prs, expected)
     if (selection.error) return failResult(selection.error)
     if (selection.create) {
-      return failResult(`gh pr create failed for ${branch}: ${sanitizeReconcileOutput(created.stderr) || 'unknown error'}`)
+      return failResult(reconciliationPullRequestCreateError(branch, created.stderr))
     }
     if (!selection.reuse) return failResult(`No reusable reconciliation pull request for ${branch} after gh pr create failed.`)
     return reuseReconciliationPullRequest(target, repository, selection.reuse, targetSha, body)
@@ -300,6 +308,15 @@ function deliverReconciliationPullRequest(target, base, head, state, targetSha,
   }
 }
 
+/** @param {string} branch @param {string} stderr */
+function reconciliationPullRequestCreateError(branch, stderr) {
+  const detail = sanitizeReconcileOutput(stderr) || 'unknown error'
+  const permissionHint = /github actions is not permitted to create or approve pull requests|resource not accessible by integration/i.test(detail)
+    ? ' Enable Settings > Actions > General > Workflow permissions > Allow GitHub Actions to create and approve pull requests, then rerun the workflow.'
+    : ''
+  return `gh pr create failed for ${branch}: ${detail}${permissionHint}`
+}
+
 /**
  * Refresh an existing reconciliation pull request to the exact target tip and
  * body. The head branch is pushed under an exact lease when its tip is stale,