code-foundry 1.0.4 → 1.0.6

package/.github/code-foundry.yml

@@ -11,7 +11,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v1.0.0
+runtime_ref: v1.0.5
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
@@ -37,3 +37,5 @@ post_release_mode: auto
 opencode_security: false
 sync_mode: overlay
 custom_workflows: preserve
+staging_validation_mode: fast
+opencode_security_model:

package/.github/workflows/ci.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.31.12
+        default: v1.0.5
       runner:
         description: Runner used by CI jobs.
         required: false

package/.github/workflows/codeql.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.31.12
+        default: v1.0.5
       runner:
         description: Runner used by CodeQL jobs.
         required: false

package/.github/workflows/opencode-security_self-ci.yml

@@ -46,7 +46,7 @@ jobs:
       # reusable workflow already checks out the consumer repository.
       source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
       runner: ubuntu-latest
-      model: opencode-go/muse-spark-1.2-contributor
+      model: opencode-go/muse-spark-1.3-contributor
       mode: standard
       fail_on_severity: high
       max_cost_usd: 1

package/.github/workflows/release.yml

@@ -17,7 +17,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.31.12
+        default: v1.0.5
       billing-pause-bypass:
         description: Allow this explicitly dispatched release to run while other CI remains paused.
         required: false

package/.github/workflows/security.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.31.12
+        default: v1.0.5
       runner:
         description: Runner used by Security jobs.
         required: false

package/.github/workflows/test.yml

@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.31.12
+        default: v1.0.5
       runner:
         description: Runner used by non-unit test jobs.
         required: false

package/.github/workflows/validation.yml

@@ -16,7 +16,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.32.4
+        default: v1.0.5
       ci-runner:
         description: Runner used by CI jobs.
         required: false

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.0.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.5...v1.0.6) (2026-09-06)
+
+
+### Bug Fixes
+
+* scope dependabot ecosystems to configured languages ([#457](https://github.com/0xPlayerOne/code-foundry/issues/457)) ([2bb9121](https://github.com/0xPlayerOne/code-foundry/commit/2bb91215de662dfa7a38d0c13cc7af1b5b07d798))
+
+## [1.0.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.4...v1.0.5) (2026-09-06)
+
+
+### Bug Fixes
+
+* default runtime-ref inputs to the current runtime release ([#454](https://github.com/0xPlayerOne/code-foundry/issues/454)) ([6d77025](https://github.com/0xPlayerOne/code-foundry/commit/6d77025511ca641e98a17c4eed63a24285a48169))
+
 ## [1.0.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.0.3...v1.0.4) (2026-09-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/sync.mjs

@@ -405,8 +405,11 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
 
 /**
  * Dependabot updates land on the repository's integration branch. Direct
- * repositories have no staging branch, so every update targets main. Cargo
- * updates are emitted only when Rust is part of the configured language set.
+ * repositories have no staging branch, so every update targets main. Cargo,
+ * npm, and pip updates are emitted only when Rust, TypeScript, or Python is
+ * part of the configured language set, respectively; weekly updater runs
+ * fail when an ecosystem has no manifests to read, so unconfigured
+ * ecosystems are dropped instead of left to error.
  * @param {string} content
  * @param {Record<string,string>} config
  * @param {string} languages
@@ -415,15 +418,33 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
 function renderDependabot(content, config, languages) {
   let rendered = content
   if (!includesValue(languages, 'rust')) {
-    rendered = rendered
-      .split(/(?=^  - package-ecosystem: )/m)
-      .filter((block) => !block.startsWith('  - package-ecosystem: cargo\n'))
-      .join('')
+    rendered = stripDependabotEcosystem(rendered, 'cargo')
+  }
+  if (!includesValue(languages, 'typescript')) {
+    rendered = stripDependabotEcosystem(rendered, 'npm')
+  }
+  if (!includesValue(languages, 'python')) {
+    rendered = stripDependabotEcosystem(rendered, 'pip')
   }
   if (isStagingRelease(config.git_workflow)) return rendered
   return rendered.replaceAll('target-branch: staging', 'target-branch: main')
 }
 
+/**
+ * Remove one package-ecosystem update block from a dependabot template.
+ * Blocks are split on their leading list marker so removal never disturbs
+ * neighboring ecosystems or the file header.
+ * @param {string} content
+ * @param {string} ecosystem
+ * @returns {string}
+ */
+function stripDependabotEcosystem(content, ecosystem) {
+  return content
+    .split(/(?=^  - package-ecosystem: )/m)
+    .filter((block) => !block.startsWith(`  - package-ecosystem: ${ecosystem}\n`))
+    .join('')
+}
+
 /**
  * Contribution policy documents describe the repository's branch flow. The
  * canonical templates describe the staging-release topology (this runtime