code-foundry 0.38.1 → 0.39.0

package/.github/code-foundry.yml

@@ -15,7 +15,7 @@ runtime_ref: v0.34.4
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
-git_workflow: staging-release
+git_workflow: direct
 merge_strategy: rebase
 release_merge_strategy: rebase
 runner: ubuntu-latest

package/.github/workflows/draft-pr_self-ci.yml

@@ -22,7 +22,7 @@ jobs:
     uses: ./.github/workflows/draft-pr.yml
     with:
       runner: ubuntu-slim
-      base: staging
+      base: main
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
       RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}

package/.github/workflows/opencode-security_self-ci.yml

@@ -46,6 +46,7 @@ jobs:
       # reusable workflow already checks out the consumer repository.
       source_ref: b3dce823322672b285fbe99b870ea984c01826cb
       runner: ubuntu-latest
+      model: opencode-go/muse-spark-1.2-contributor
       mode: standard
       fail_on_severity: high
       max_cost_usd: 1

package/.github/workflows/release-pr.yml

@@ -15,11 +15,12 @@ on:
         required: false
 
 permissions:
-  contents: read
+  contents: write
   pull-requests: write
 
 env:
   HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' || secrets.RELEASE_PLEASE_TOKEN != '' }}
+  PROMOTION_BRANCH: code-foundry/promote/staging-to-main
 
 jobs:
   create-release-pr:
@@ -44,8 +45,11 @@ jobs:
         # persist-credentials disabled, git has no auth for that fetch; configure
         # the credential helper with the short-lived workflow token. NiftyLeague
         # rejects long-lived fine-grained automation tokens with HTTP 403 even
-        # on REST, so all read-only operations use github.token; it is scoped
-        # to contents: read, so this never enables write credentials.
+        # on REST, so all read-only operations use github.token. It is used
+        # only for GitHub operations owned by this workflow. The job's
+        # contents: write permission is required later for the isolated,
+        # deterministic promotion ref; protected main and staging are never
+        # written by this workflow.
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh auth setup-git
@@ -65,7 +69,7 @@ jobs:
           # REST query keeps the exact base/head/state filter and the per_page=1
           # cap (existing is 0 or 1) and fails closed on any API error.
           EXISTING=$(gh api \
-            "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
+            "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=${PROMOTION_BRANCH}&state=open&per_page=1" \
             --jq 'length')
           MAIN_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/main" --jq '.commit.tree.sha')
           STAGING_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/staging" --jq '.commit.tree.sha')
@@ -144,6 +148,51 @@ jobs:
             echo 'staging is already aligned with main; no promotion PR is needed.'
           fi
 
+      - name: Prepare exact-tree promotion head
+        if: steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          MAIN_SHA=$(git rev-parse origin/main)
+          STAGING_SHA=$(git rev-parse origin/staging)
+          STAGING_TREE=$(git rev-parse 'origin/staging^{tree}')
+          STAGING_SUBJECT=$(git log -1 --format=%s origin/staging)
+          COMMIT_FILE="$RUNNER_TEMP/promotion-commit.json"
+          node - "$MAIN_SHA" "$STAGING_SHA" "$STAGING_TREE" "$STAGING_SUBJECT" <<'NODE' > "$COMMIT_FILE"
+          const [main, staging, tree, subject] = process.argv.slice(2)
+          process.stdout.write(JSON.stringify({
+            message: `${subject}\n\nPromoted from staging snapshot ${staging.slice(0, 12)}.`,
+            tree,
+            parents: [main],
+          }))
+          NODE
+          PROMOTION_SHA=$(gh api \
+            --method POST \
+            "repos/${GITHUB_REPOSITORY}/git/commits" \
+            --input "$COMMIT_FILE" \
+            --jq '.sha')
+          REF_ENDPOINT="repos/${GITHUB_REPOSITORY}/git/refs/heads/${PROMOTION_BRANCH}"
+          if gh api "$REF_ENDPOINT" >/dev/null 2>&1; then
+            UPDATED=false
+            if [ "$HAS_AUTOMATION_TOKEN" = true ] && GH_TOKEN="$AUTOMATION_TOKEN" gh api --method PATCH "$REF_ENDPOINT" --field sha="$PROMOTION_SHA" --field force=true >/dev/null; then
+              UPDATED=true
+            fi
+            if [ "$UPDATED" != true ]; then
+              if [ "$HAS_AUTOMATION_TOKEN" = true ]; then
+                echo "::warning title=Promotion token fallback::Automation token could not refresh the promotion ref; using the workflow token. GitHub may require a manual check rerun for an already-open pull request."
+              fi
+              gh api --method PATCH "$REF_ENDPOINT" --field sha="$PROMOTION_SHA" --field force=true >/dev/null
+            fi
+          else
+            gh api --method POST \
+              "repos/${GITHUB_REPOSITORY}/git/refs" \
+              --field ref="refs/heads/${PROMOTION_BRANCH}" \
+              --field sha="$PROMOTION_SHA" >/dev/null
+          fi
+          echo "Prepared ${PROMOTION_BRANCH} at ${PROMOTION_SHA} with parent ${MAIN_SHA} and the exact staging tree ${STAGING_TREE}."
+
       - name: Create
         if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
         env:
@@ -203,7 +252,7 @@ jobs:
             "repos/${GITHUB_REPOSITORY}/pulls"
             --method POST
             --field base=main
-            --field head=staging
+            --field head="$PROMOTION_BRANCH"
             --field title="Promote staging -> main ($DATE)"
             --field body=@"$BODY_FILE"
           )
@@ -237,7 +286,7 @@ jobs:
             # the short-lived workflow token; gh pr list issues a GraphQL query
             # that NiftyLeague's long-lived fine-grained token policy rejects.
             EXISTING_NUMBER=$(GH_TOKEN="${{ github.token }}" gh api \
-              "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=staging&state=open&per_page=1" \
+              "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=${PROMOTION_BRANCH}&state=open&per_page=1" \
               --jq '.[0].number // empty')
             if [ -z "$EXISTING_NUMBER" ]; then
               echo 'Pull request creation failed and no existing promotion PR was found.' >&2

package/.github/workflows/release-pr_self-ci.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
   pull-requests: write
 
 jobs:

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.39.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.38.2...v0.39.0) (2026-08-29)
+
+
+### Features
+
+* code-foundry 0.38.3 — direct workflow default, muse spark model, opencode_security_model override ([436da59](https://github.com/0xPlayerOne/code-foundry/commit/436da5947098039642cb961987e962cd88960db8))
+
+
+### Bug Fixes
+
+* draft-pr base main for direct workflow (staging deleted) ([b1c063f](https://github.com/0xPlayerOne/code-foundry/commit/b1c063fa8e967800b85ffb9ae42df5d62e9a4e1e))
+
+## [0.38.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.38.1...v0.38.2) (2026-08-29)
+
+
+### Bug Fixes
+
+* **release:** preserve promotion release semantics ([#418](https://github.com/0xPlayerOne/code-foundry/issues/418)) ([b1702a7](https://github.com/0xPlayerOne/code-foundry/commit/b1702a756cc6d7297f98b529b0bca178a1cdc3d1))
+
 ## [0.38.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.38.0...v0.38.1) (2026-08-29)
 
 

package/docs/RELEASES.md

@@ -61,6 +61,14 @@ possible. The final branch trees are inspected before mutation; validated
 main-only changes are inherited by `staging`, while unpromoted staging work is
 replayed on top of `main`.
 
+Promotion never opens a pull request directly from a divergent `staging`
+history. The workflow creates or refreshes a deterministic promotion branch
+whose single commit has the current `main` tip as its parent and the exact
+validated `staging` tree. This keeps the review diff limited to the actual
+environment delta even after squash or rebase merges have changed ancestry.
+The generated commit preserves the staged tip's conventional subject so
+Release Please still detects the appropriate release type after promotion.
+
 The `staging` → `main` reconciliation exists only in the `staging-release`
 topology. Patch-equivalent divergence between `main` and `staging` is treated
 as aligned. When `staging` has pending commits that are not yet represented on

package/docs/WORKFLOWS.md

@@ -95,7 +95,7 @@ workflow refuses to run unless its strategy is exactly `rebase`.
 | --- | --- | --- |
 | Feature/fix PR into `main` (direct topology) | Squash | Contribution policy; see `CONTRIBUTING.md` |
 | Feature/fix PR into `staging` (staging-release topology) | Squash | Contribution policy; see `CONTRIBUTING.md` |
-| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`) | `merge_strategy` must be `rebase` when `git_workflow: staging-release`; merge commits are rejected |
+| `staging` → `main` promotion PR (staging-release topology) | Rebase (`merge_strategy: rebase`) | Code Foundry creates a one-commit head with `main` as its parent and the exact validated `staging` tree; `merge_strategy` must be `rebase`, and merge commits are rejected |
 | Release Please version PR into `main` | Rebase (`release_merge_strategy: rebase`) | Release automation fails closed unless `rebase`; never defaults to `merge`, never uses `--admin` |
 
 The promotion rows above apply only to `staging-release`; `direct`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.38.1",
+  "version": "0.39.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -388,6 +388,10 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
     rendered = rendered.replace(/^(\s+rust-threads:)\s+.*$/m, `$1 '${rustCodeql.threads}'`)
     rendered = rendered.replace(/^(\s+rust-max-parallel:)\s+.*$/m, `$1 ${rustCodeql.maxParallel}`)
   }
+  if (workflow === 'opencode-security') {
+    const model = configured(config.opencode_security_model, '').trim()
+    if (model) rendered = rendered.replace(/^(\s+model:)\s+.*$/m, `$1 ${model}`)
+  }
   return rendered
 }
 
@@ -645,7 +649,7 @@ function createDefaultConfig(root, source) {
     prune_standard: 'false', cache_packages: 'auto', cache_build: 'auto', coverage_minimum: '80', turbo_remote: 'auto',
     release_type: detectPackageManager(root) === 'none' ? 'auto' : 'node', npm_publish: 'false',
     post_release: 'false', post_release_workflow: '', post_release_mode: 'auto',
-    opencode_security: 'false',
+    opencode_security: 'false', opencode_security_model: '',
     sync_mode: 'overlay', custom_workflows: 'preserve',
     license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later', git_workflow: 'direct', merge_strategy: 'rebase', release_merge_strategy: 'rebase',
   }