code-foundry 0.39.1 → 0.39.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/.github/workflows/opencode-security_self-ci.yml +2 -2
  2. package/.github/workflows/release-pr.yml +16 -6
  3. package/CHANGELOG.md +14 -0
  4. package/package.json +1 -1
package/.github/workflows/opencode-security_self-ci.yml CHANGED
@@ -40,11 +40,11 @@ jobs:
40
40
  name: OpenCode Security / Scan
41
41
  needs: detect
42
42
  if: vars.CI_BILLING_PAUSED != 'true' && needs.detect.outputs.enabled == 'true' && needs.detect.outputs.token == 'true'
43
- uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@b3dce823322672b285fbe99b870ea984c01826cb # main
43
+ uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@6d7ce2fbb2c2a171b4ca2d4193abd82e0fda584b # main
44
44
  with:
45
45
  # This is the scanner checkout ref, not the consumer PR ref. The
46
46
  # reusable workflow already checks out the consumer repository.
47
- source_ref: b3dce823322672b285fbe99b870ea984c01826cb
47
+ source_ref: 6d7ce2fbb2c2a171b4ca2d4193abd82e0fda584b
48
48
  runner: ubuntu-latest
49
49
  model: opencode-go/muse-spark-1.2-contributor
50
50
  mode: standard
package/.github/workflows/release-pr.yml CHANGED
@@ -66,10 +66,16 @@ jobs:
66
66
  # existing-promotion-PR lookup uses authenticated REST (gh api)
67
67
  # rather than gh pr list, which issues a GraphQL query that
68
68
  # NiftyLeague's long-lived fine-grained token policy rejects. The
69
- # REST query keeps the exact base/head/state filter and the per_page=1
70
- # cap (existing is 0 or 1) and fails closed on any API error.
71
- EXISTING=$(gh api \
72
- "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=${PROMOTION_BRANCH}&state=open&per_page=1" \
69
+ # REST query qualifies head as owner:branch; GitHub otherwise ignores
70
+ # the incomplete head filter and can count an unrelated open PR. The
71
+ # exact base/head/state filter and per_page=1 cap keep existing at 0
72
+ # or 1, and the lookup fails closed on any API error.
73
+ EXISTING=$(gh api --method GET \
74
+ "repos/${GITHUB_REPOSITORY}/pulls" \
75
+ --field base=main \
76
+ --field head="${GITHUB_REPOSITORY_OWNER}:${PROMOTION_BRANCH}" \
77
+ --field state=open \
78
+ --field per_page=1 \
73
79
  --jq 'length')
74
80
  MAIN_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/main" --jq '.commit.tree.sha')
75
81
  STAGING_TREE=$(gh api "repos/${GITHUB_REPOSITORY}/commits/staging" --jq '.commit.tree.sha')
@@ -285,8 +291,12 @@ jobs:
285
291
  # the same authenticated REST query as the Check step, always with
286
292
  # the short-lived workflow token; gh pr list issues a GraphQL query
287
293
  # that NiftyLeague's long-lived fine-grained token policy rejects.
288
- EXISTING_NUMBER=$(GH_TOKEN="${{ github.token }}" gh api \
289
- "repos/${GITHUB_REPOSITORY}/pulls?base=main&head=${PROMOTION_BRANCH}&state=open&per_page=1" \
294
+ EXISTING_NUMBER=$(GH_TOKEN="${{ github.token }}" gh api --method GET \
295
+ "repos/${GITHUB_REPOSITORY}/pulls" \
296
+ --field base=main \
297
+ --field head="${GITHUB_REPOSITORY_OWNER}:${PROMOTION_BRANCH}" \
298
+ --field state=open \
299
+ --field per_page=1 \
290
300
  --jq '.[0].number // empty')
291
301
  if [ -z "$EXISTING_NUMBER" ]; then
292
302
  echo 'Pull request creation failed and no existing promotion PR was found.' >&2
package/CHANGELOG.md CHANGED
@@ -1,5 +1,19 @@
1
1
  # Changelog
2
2
 
3
+ ## [0.39.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.39.2...v0.39.3) (2026-08-29)
4
+
5
+
6
+ ### Bug Fixes
7
+
8
+ * **security:** pin scanner target normalization ([f03ddb0](https://github.com/0xPlayerOne/code-foundry/commit/f03ddb07d9bc6c06d9a94962f475ec157e5d194e))
9
+
10
+ ## [0.39.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.39.1...v0.39.2) (2026-08-29)
11
+
12
+
13
+ ### Bug Fixes
14
+
15
+ * **release:** qualify promotion PR head filters ([75a0985](https://github.com/0xPlayerOne/code-foundry/commit/75a09856d764aafc1cd301ae68121e187c43e2d1))
16
+
3
17
  ## [0.39.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.39.0...v0.39.1) (2026-08-29)
4
18
 
5
19
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "code-foundry",
3
- "version": "0.39.1",
3
+ "version": "0.39.3",
4
4
  "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
5
5
  "type": "module",
6
6
  "license": "AGPL-3.0-or-later",