code-foundry 0.40.1 → 0.40.3

package/.github/dependabot.yml

@@ -28,6 +28,14 @@ updates:
       npm-dependencies:
         applies-to: version-updates
         patterns: ['*']
+    ignore:
+      # TypeScript 7 cannot resolve node: builtins in this toolchain
+      # (verified); revisit when the TS/eslint toolchain supports TS 7.
+      - dependency-name: 'typescript'
+        versions: ['>=7.0.0']
+      # Held with TypeScript 5.9 above.
+      - dependency-name: '@types/node'
+        versions: ['>=23']
   - package-ecosystem: cargo
     directory: /
     target-branch: staging

package/.prettierignore

@@ -1,5 +1,9 @@
 # Generated release metadata is intentionally managed by Release Please.
 CHANGELOG.md
 
-# Runtime files are checked out under .github during CI.
+# Runtime files are checked out under .github during CI. Composite actions
+# are copied to .github/actions for the workflow run and must not be policed
+# by consumer formatters (their style follows the runtime baseline, not the
+# consumer .prettierrc).
 .github/.code-foundry
+.github/actions/

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.40.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.2...v0.40.3) (2026-09-05)
+
+
+### Bug Fixes
+
+* **sync:** hold TypeScript toolchain below v7 in consumer dependabot config ([e3c91e1](https://github.com/0xPlayerOne/code-foundry/commit/e3c91e1079bfcd69d174d3ede6d20674eb8fd37b))
+
+## [0.40.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.1...v0.40.2) (2026-09-05)
+
+
+### Bug Fixes
+
+* **validation:** skip eslint fallback without repo setup and ignore overlaid actions ([bb4756c](https://github.com/0xPlayerOne/code-foundry/commit/bb4756cb8a40199f4d0b6bdb47020f0bc7283de1))
+
 ## [0.40.1](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.0...v0.40.1) (2026-08-31)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.40.1",
+  "version": "0.40.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -243,8 +243,10 @@ export function syncRepository(options) {
   }
   if (includesValue(languages, 'typescript') && existsSync(join(target, '.prettierignore'))) {
     const prettierIgnore = readFileSync(join(target, '.prettierignore'), 'utf8')
-    if (!prettierIgnore.split(/\r?\n/).includes('.github/.code-foundry')) {
-      writeOrReport(join(target, '.prettierignore'), `${prettierIgnore.trimEnd()}\n.github/.code-foundry\n`, dryRun)
+    const present = new Set(prettierIgnore.split(/\r?\n/).map((line) => line.trim()))
+    const missing = ['.github/.code-foundry', '.github/actions/'].filter((entry) => !present.has(entry))
+    if (missing.length) {
+      writeOrReport(join(target, '.prettierignore'), `${prettierIgnore.trimEnd()}\n${missing.join('\n')}\n`, dryRun)
       changed.push('.prettierignore')
     }
   }

package/src/runtime.mjs

@@ -254,6 +254,28 @@ function hasDependencyManifest(ecosystem) {
   return false
 }
 
+/**
+ * Detect repository-owned ESLint setup: a lint script, an eslint dependency
+ * (or script reference), or a tracked flat/legacy config file. Repositories
+ * without any of these have nothing for the fallback runner to enforce, so
+ * lint skips instead of forcing a network fetch of ESLint in CI.
+ * @returns {boolean}
+ */
+function hasEslintSetup() {
+  const pkg = readPackage() ?? {}
+  const scripts = pkg.scripts ?? {}
+  if (scripts.lint) return true
+  const dependencies = {
+    ...(pkg.dependencies ?? {}),
+    ...(pkg.devDependencies ?? {}),
+    ...(pkg.optionalDependencies ?? {}),
+    ...(pkg.peerDependencies ?? {}),
+  }
+  if (dependencies.eslint) return true
+  if (Object.values(scripts).some((value) => /\beslint\b/.test(String(value)))) return true
+  return repositoryTestFiles().some((file) => /(^|\/)(\.eslintrc[^/]*|eslint\.config\.[^/]*)$/.test(file))
+}
+
 /** @param {string} task */
 function ci(task) {
   if (task === 'install') return install()
@@ -274,7 +296,7 @@ function ci(task) {
   }
   if (task === 'lint') {
     const scripted = runScript(['lint'])
-    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript')) && hasRootJavascriptProject()) runTool('eslint', ['.'])
+    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript')) && hasRootJavascriptProject() && hasEslintSetup()) runTool('eslint', ['.'])
     if (hasLanguage('python') && hasRootPythonProject()) runTool('ruff', ['check', '.'])
     if (hasLanguage('rust') && hasRootRustProject()) run('cargo', ['clippy', '--all-targets', '--', '-D', 'warnings'])
     return