code-foundry 0.40.2 → 1.0.0

package/.github/dependabot.yml

@@ -28,6 +28,14 @@ updates:
       npm-dependencies:
         applies-to: version-updates
         patterns: ['*']
+    ignore:
+      # TypeScript 7 cannot resolve node: builtins in this toolchain
+      # (verified); revisit when the TS/eslint toolchain supports TS 7.
+      - dependency-name: 'typescript'
+        versions: ['>=7.0.0']
+      # Held with TypeScript 5.9 above.
+      - dependency-name: '@types/node'
+        versions: ['>=23']
   - package-ecosystem: cargo
     directory: /
     target-branch: staging

package/.github/workflows/draft-pr.yml

@@ -16,8 +16,6 @@ on:
     secrets:
       CODE_FOUNDRY_TOKEN:
         required: false
-      RELEASE_PLEASE_TOKEN:
-        required: false
 
 permissions:
   contents: read
@@ -46,7 +44,7 @@ jobs:
       - name: Create
         if: steps.check-pr.outputs.existing == '0'
         env:
-          AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN }}
+          AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
           GITHUB_TOKEN: ${{ github.token }}
           HEAD_REF: ${{ github.ref_name }}
         run: |

package/.github/workflows/draft-pr_self-ci.yml

@@ -25,4 +25,3 @@ jobs:
       base: main
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
-      RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}

package/.github/workflows/release-pr.yml

@@ -11,15 +11,13 @@ on:
     secrets:
       CODE_FOUNDRY_TOKEN:
         required: false
-      RELEASE_PLEASE_TOKEN:
-        required: false
 
 permissions:
   contents: write
   pull-requests: write
 
 env:
-  HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' || secrets.RELEASE_PLEASE_TOKEN != '' }}
+  HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' }}
   PROMOTION_BRANCH: code-foundry/promote/staging-to-main
 
 jobs:
@@ -158,7 +156,7 @@ jobs:
         if: steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
-          AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN }}
+          AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
         run: |
           set -euo pipefail
           MAIN_SHA=$(git rev-parse origin/main)
@@ -202,7 +200,7 @@ jobs:
       - name: Create
         if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0' && steps.check-pr.outputs.tree_equal != 'true' && steps.check-pr.outputs.release_only != 'true'
         env:
-          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || github.token }}
         run: |
           DATE=$(date +%Y-%m-%d)
           BODY_FILE="$RUNNER_TEMP/release-pr.md"
@@ -264,7 +262,7 @@ jobs:
           )
           if [ "$HAS_AUTOMATION_TOKEN" != true ]; then
             CREATE_ARGS+=(--field draft=true)
-            echo "::notice title=Manual PR readiness required::Created draft promotion PR because no automation token is configured. Configure CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN, or mark this PR ready manually to trigger validation."
+            echo "::notice title=Manual PR readiness required::Created draft promotion PR because no automation token is configured. Configure CODE_FOUNDRY_TOKEN, or mark this PR ready manually to trigger validation."
           fi
 
           # Prefer the configured automation token for the write, but

package/.github/workflows/release-pr_self-ci.yml

@@ -18,4 +18,3 @@ jobs:
       runner: ubuntu-slim
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
-      RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}

package/.github/workflows/release.yml

@@ -26,8 +26,6 @@ on:
     secrets:
       CODE_FOUNDRY_TOKEN:
         required: false
-      RELEASE_PLEASE_TOKEN:
-        required: false
       STAGING_DEPLOY_KEY:
         required: false
       NPM_TOKEN:
@@ -123,8 +121,8 @@ jobs:
       - name: Detect release credentials
         id: credentials
         env:
-          HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' || secrets.RELEASE_PLEASE_TOKEN != '' }}
-          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN }}
+          HAS_AUTOMATION_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN != '' }}
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
         run: |
           set -euo pipefail
           # NiftyLeague rejects long-lived fine-grained automation tokens with
@@ -141,7 +139,7 @@ jobs:
             echo "auto_merge=false" >> "$GITHUB_OUTPUT"
             echo "token_source=fallback" >> "$GITHUB_OUTPUT"
             if [ "$HAS_AUTOMATION_TOKEN" = true ]; then
-              echo "::warning title=Release token fallback::The configured CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN was rejected by GitHub; failing over to the short-lived workflow token. The version pull request will be left for manual merge."
+              echo "::warning title=Release token fallback::The configured CODE_FOUNDRY_TOKEN was rejected by GitHub; failing over to the short-lived workflow token. The version pull request will be left for manual merge."
             fi
           fi
       - name: Release Please (automation token)
@@ -149,7 +147,7 @@ jobs:
         if: steps.profile.outputs.release_type != 'none' && steps.credentials.outputs.token_source == 'configured'
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         with:
-          token: ${{ secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN }}
+          token: ${{ secrets.CODE_FOUNDRY_TOKEN }}
           config-file: release-please-config.json
           release-type: ${{ steps.profile.outputs.legacy_release_type }}
       - name: Release Please (workflow token)
@@ -197,7 +195,7 @@ jobs:
           # when it validated, github.token after fallback. The token value
           # lives only in this masked env expression, never in step outputs.
           AUTO_MERGE: ${{ steps.credentials.outputs.auto_merge }}
-          GH_TOKEN: ${{ steps.credentials.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN) || github.token }}
+          GH_TOKEN: ${{ steps.credentials.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
         run: |
           set -euo pipefail
           mapfile -t release_prs < <(
@@ -229,12 +227,12 @@ jobs:
       - name: Leave release pull request for manual merge
         if: steps.release.outputs.prs_created == 'true' && steps.credentials.outputs.auto_merge != 'true'
         run: |
-          echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. Configure a valid CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN to enable guarded auto-merge when downstream release workflows require it."
+          echo "::notice title=Manual release merge required::Release Please created or updated a version pull request. Configure a valid CODE_FOUNDRY_TOKEN to enable guarded auto-merge when downstream release workflows require it."
 
       - name: Merge generated version pull requests
         if: steps.credentials.outputs.auto_merge == 'true'
         env:
-          GH_TOKEN: ${{ steps.credentials.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN) || github.token }}
+          GH_TOKEN: ${{ steps.credentials.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
         run: |
           set -euo pipefail
           mapfile -t release_prs < <(
@@ -420,8 +418,8 @@ jobs:
       # The release job validates the configured automation token and exposes
       # the selection; the post hook reuses the same selected credential so a
       # rejected long-lived token is never used after fallback.
-      RELEASE_PLEASE_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN) || github.token }}
-      GH_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN || secrets.RELEASE_PLEASE_TOKEN) || github.token }}
+      CODE_FOUNDRY_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
+      GH_TOKEN: ${{ needs.release.outputs.token_source == 'configured' && (secrets.CODE_FOUNDRY_TOKEN) || github.token }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

package/.github/workflows/release_self-ci.yml

@@ -30,6 +30,5 @@ jobs:
       runtime-ref: ${{ github.sha }}
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
-      RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
       STAGING_DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [1.0.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.3...v1.0.0) (2026-09-05)
+
+
+### ⚠ BREAKING CHANGES
+
+* automation now reads CODE_FOUNDRY_TOKEN only. Repos still carrying just RELEASE_PLEASE_TOKEN fall back to the short-lived workflow token (manual merges) until they set CODE_FOUNDRY_TOKEN.
+
+### Features
+
+* remove RELEASE_PLEASE_TOKEN fallback in favor of CODE_FOUNDRY_TOKEN ([3f6ba1c](https://github.com/0xPlayerOne/code-foundry/commit/3f6ba1c3cb0db698a7c75485b9e4201720e930d7))
+
+## [0.40.3](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.2...v0.40.3) (2026-09-05)
+
+
+### Bug Fixes
+
+* **sync:** hold TypeScript toolchain below v7 in consumer dependabot config ([e3c91e1](https://github.com/0xPlayerOne/code-foundry/commit/e3c91e1079bfcd69d174d3ede6d20674eb8fd37b))
+
 ## [0.40.2](https://github.com/0xPlayerOne/code-foundry/compare/v0.40.1...v0.40.2) (2026-09-05)
 
 

package/docs/RELEASES.md

@@ -104,7 +104,7 @@ its manifest.
 ## Pull request permissions
 
 The release job validates the configured automation token
-(`CODE_FOUNDRY_TOKEN`, falling back to `RELEASE_PLEASE_TOKEN`) against the
+(`CODE_FOUNDRY_TOKEN`) against the
 current repository with an authenticated REST probe before any write. When no
 automation token is configured, or the configured token is rejected by GitHub
 (observed with long-lived fine-grained tokens that GitHub rejects with HTTP
@@ -116,8 +116,8 @@ successfully. The token value is never printed or written to step outputs.
 Guarded automatic merging and the downstream workflows triggered by the
 resulting release are enabled only when the configured automation token was
 validated successfully; a rejected token never falls through to any write.
-Configure a valid, narrowly scoped `CODE_FOUNDRY_TOKEN` or
-`RELEASE_PLEASE_TOKEN` repository or organization secret to enable guarded
+Configure a valid, narrowly scoped `CODE_FOUNDRY_TOKEN`
+repository or organization secret to enable guarded
 automatic merging and downstream workflows triggered by the resulting
 release. The token needs `contents`, `issues`, and `pull-requests` write
 permissions. Code Foundry validates every changed path in the generated

package/docs/WORKFLOWS.md

@@ -158,7 +158,7 @@ when GitHub rejects pull request creation through the Actions integration.
 
 For this reconciliation path, maintainer PATs and administrator roles are not
 authorized bypasses; the job deliberately authenticates with `github.token`,
-not `CODE_FOUNDRY_TOKEN` or `RELEASE_PLEASE_TOKEN`.
+not `CODE_FOUNDRY_TOKEN`.
 
 ## GitHub Stacks
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.40.2",
+  "version": "1.0.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/doctor.mjs

@@ -120,16 +120,15 @@ export function doctor(root, options = {}) {
   console.log('Remote CI, Test, Security, CodeQL, and release runtimes are loaded by the tiered validation orchestrator.')
   if (options.github) {
     const github = doctorGithub(target)
-    /** @type {{ codeFoundryTokenPresent?: boolean, releasePleaseTokenPresent?: boolean, stagingDeployKeyPresent?: boolean }} */
+    /** @type {{ codeFoundryTokenPresent?: boolean, stagingDeployKeyPresent?: boolean }} */
     const secrets = github.details.secrets ?? {}
     for (const message of github.warnings) warn(`GitHub: ${message}`)
     for (const message of github.errors) error(`GitHub: ${message}`)
     console.log(`GitHub doctor inspected ${github.details.repository}.`)
     const codeFoundryToken = secrets.codeFoundryTokenPresent ? 'present' : 'absent'
-    const releasePleaseToken = secrets.releasePleaseTokenPresent ? 'present' : 'absent'
     const stagingDeployKey = secrets.stagingDeployKeyPresent ? 'present' : 'absent'
-    console.log(`GitHub secrets: CODE_FOUNDRY_TOKEN=${codeFoundryToken}, RELEASE_PLEASE_TOKEN=${releasePleaseToken}, STAGING_DEPLOY_KEY=${stagingDeployKey}`)
-    if (!secrets.codeFoundryTokenPresent && !secrets.releasePleaseTokenPresent) {
+    console.log(`GitHub secrets: CODE_FOUNDRY_TOKEN=${codeFoundryToken}, STAGING_DEPLOY_KEY=${stagingDeployKey}`)
+    if (!secrets.codeFoundryTokenPresent) {
       warn('GitHub token routing fallback: PR creation will remain draft and requires manual ready-for-review to trigger validation.')
     }
   }

package/src/commands/release.mjs

@@ -533,7 +533,7 @@ export function dispatchPostReleaseHook(root, options) {
   const repository = process.env.GITHUB_REPOSITORY
   if (!repository) throw new Error('GITHUB_REPOSITORY is required for post-release hooks.')
   if (!options.tag) throw new Error('--tag is required for post-release hooks.')
-  const decision = selectHookDelivery({ mode: options.mode, tokenPresent: Boolean(process.env.RELEASE_PLEASE_TOKEN) })
+  const decision = selectHookDelivery({ mode: options.mode, tokenPresent: Boolean(process.env.CODE_FOUNDRY_TOKEN) })
   console.log(JSON.stringify({ repository, tag: options.tag, workflow: options.workflow, ...decision }, null, 2))
   if (decision.delivery === 'disabled' || decision.delivery === 'release-event') return decision
   if (decision.delivery === 'unavailable') throw new Error(decision.reason)
@@ -551,7 +551,7 @@ export function dispatchPostReleaseHook(root, options) {
     '--ref', options.tag,
     '--field', `release-tag=${options.tag}`,
     '--field', `delivery-key=${key}`,
-  ], { cwd: resolve(root), stdio: 'inherit', env: { ...process.env, GH_TOKEN: process.env.RELEASE_PLEASE_TOKEN } })
+  ], { cwd: resolve(root), stdio: 'inherit', env: { ...process.env, GH_TOKEN: process.env.CODE_FOUNDRY_TOKEN } })
   if (result.status !== 0) throw new Error(`Failed to dispatch post-release workflow ${options.workflow}.`)
   return { ...decision, deliveryKey: key, dispatched: true }
 }
@@ -648,7 +648,7 @@ function treeChangedPaths(root, from, to) {
 
 /** @param {string} root @param {string[]} args @returns {{ status: number | null, stdout: string, stderr: string }} */
 function ghSpawn(root, args) {
-  const token = process.env.RELEASE_PLEASE_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN
+  const token = process.env.CODE_FOUNDRY_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN
   return spawnSync('gh', args, { cwd: resolve(root), encoding: 'utf8', env: { ...process.env, ...(token ? { GH_TOKEN: token } : {}) } })
 }
 

package/src/lib/github-doctor.mjs

@@ -43,16 +43,15 @@ export function doctorGithub(root) {
   const secretNames = Array.isArray(secrets) ? secrets.map(/** @param {any} secret */ (secret) => secret.name) : []
   details.secrets = {
     codeFoundryTokenPresent: secretNames.includes('CODE_FOUNDRY_TOKEN'),
-    releasePleaseTokenPresent: secretNames.includes('RELEASE_PLEASE_TOKEN'),
     stagingDeployKeyPresent: secretNames.includes('STAGING_DEPLOY_KEY'),
   }
-  if (!details.secrets.codeFoundryTokenPresent && !details.secrets.releasePleaseTokenPresent) {
-    warnings.push('CODE_FOUNDRY_TOKEN and RELEASE_PLEASE_TOKEN are both absent. PR workflow triggers and automation may require manual readiness.')
+  if (!details.secrets.codeFoundryTokenPresent) {
+    warnings.push('CODE_FOUNDRY_TOKEN is absent. PR workflow triggers and automation may require manual readiness.')
   }
 
   const config = readConfig(root)
   if (['workflow-dispatch', 'dispatch'].includes(config.post_release_mode) && config.post_release !== 'false' && !details.secrets.codeFoundryTokenPresent && !details.secrets.releasePleaseTokenPresent) {
-    errors.push('post-release workflow-dispatch mode requires CODE_FOUNDRY_TOKEN or RELEASE_PLEASE_TOKEN to be present.')
+    errors.push('post-release workflow-dispatch mode requires CODE_FOUNDRY_TOKEN to be present.')
   }
   const credentialChecks = {
     npmTokenPresent: secretNames.includes('NPM_TOKEN'),