code-foundry 1.28.2 → 1.28.4

package/.github/code-foundry.yml

@@ -12,7 +12,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v1.9.6
+runtime_ref: v1.28.2
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later

package/.github/workflows/release-pr.yml

@@ -41,9 +41,9 @@ jobs:
         # The partial clone (filter: blob:none) defers blob downloads, so the
         # merge-base/diff comparison below can trigger a promisor fetch. With
         # persist-credentials disabled, git has no auth for that fetch; configure
-        # the credential helper with the short-lived workflow token. NiftyLeague
-        # rejects long-lived fine-grained automation tokens with HTTP 403 even
-        # on REST, so all read-only operations use github.token. It is used
+        # the credential helper with the short-lived workflow token. Some
+        # organizations reject long-lived fine-grained automation tokens with
+        # HTTP 403 even on REST, so all read-only operations use github.token. It is used
         # only for GitHub operations owned by this workflow. The job's
         # contents: write permission is required later for the isolated,
         # deterministic promotion ref; protected main and staging are never
@@ -59,11 +59,11 @@ jobs:
         run: |
           set -euo pipefail
           # Every lookup in this step is read-only and uses the short-lived
-          # workflow token: NiftyLeague rejects long-lived fine-grained
-          # automation tokens with HTTP 403 even on REST. The
+          # workflow token because some organizations reject long-lived
+          # fine-grained automation tokens with HTTP 403 even on REST. The
           # existing-promotion-PR lookup uses authenticated REST (gh api)
-          # rather than gh pr list, which issues a GraphQL query that
-          # NiftyLeague's long-lived fine-grained token policy rejects. The
+          # rather than gh pr list, which issues a GraphQL query that an
+          # organization's long-lived fine-grained token policy rejects. The
           # REST query qualifies head as owner:branch; GitHub otherwise ignores
           # the incomplete head filter and can count an unrelated open PR. The
           # exact base/head/state filter and per_page=1 cap keep existing at 0
@@ -247,8 +247,8 @@ jobs:
           EOF
 
           # Creation uses authenticated REST (gh api POST) rather than
-          # `gh pr create`, which issues a GraphQL mutation that
-          # NiftyLeague's long-lived fine-grained token policy rejects. The
+          # `gh pr create`, which issues a GraphQL mutation that an
+          # organization's long-lived fine-grained token policy rejects. The
           # REST payload keeps the exact base/head/title/body fields, always
           # opens the automated promotion as a draft, and stays fail-closed
           # through the create-race fallback below.
@@ -263,8 +263,8 @@ jobs:
           )
           echo "::notice title=Manual PR readiness required::Created a draft promotion PR. Mark it ready for review to start validation."
 
-          # Prefer the configured automation token for the write, but
-          # NiftyLeague rejects long-lived fine-grained tokens with HTTP 403
+          # Prefer the configured automation token for the write, but some
+          # organizations reject long-lived fine-grained tokens with HTTP 403
           # even on REST, so retry the POST once with the short-lived workflow
           # token before the create-race fallback. With no automation token
           # configured, the first attempt already runs as github.token, so the
@@ -286,7 +286,7 @@ jobs:
             # the first attempt already ran as github.token. The lookup uses
             # the same authenticated REST query as the Check step, always with
             # the short-lived workflow token; gh pr list issues a GraphQL query
-            # that NiftyLeague's long-lived fine-grained token policy rejects.
+            # that an organization's long-lived fine-grained token policy rejects.
             EXISTING_NUMBER=$(GH_TOKEN="${{ github.token }}" gh api --method GET \
               "repos/${GITHUB_REPOSITORY}/pulls" \
               --field base=main \

package/.github/workflows/release.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: string
         default: v1.0.5
+      git-workflow:
+        description: Repository topology; staging reconciliation is opt-in for staging-release.
+        required: false
+        type: string
+        default: direct
       billing-pause-bypass:
         description: Allow this explicitly dispatched release to run while other CI remains paused.
         required: false
@@ -73,7 +78,7 @@ jobs:
     name: Version
     if: vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
+    timeout-minutes: 45
     concurrency:
       group: code-foundry-release-${{ github.repository }}-${{ github.ref }}
       cancel-in-progress: false
@@ -172,11 +177,11 @@ jobs:
           GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
         run: |
           set -euo pipefail
-          # NiftyLeague rejects long-lived fine-grained automation tokens with
-          # HTTP 403 even on REST (observed in the release-pr promotion flow),
-          # so the configured automation token is validated against the current
-          # repository before any write. gh api authenticates through the
-          # GH_TOKEN environment variable and never prints the token; the
+          # Some organizations reject long-lived fine-grained automation tokens
+          # with HTTP 403 even on REST, so the configured automation token is
+          # validated against the current repository before any write. gh api
+          # authenticates through the GH_TOKEN environment variable and never
+          # prints the token; the
           # response body is discarded and only the exit status selects the
           # credential for the rest of the job.
           if [ "$HAS_AUTOMATION_TOKEN" = true ] && gh api "repos/${GITHUB_REPOSITORY}" --jq '.full_name' >/dev/null 2>&1; then
@@ -315,7 +320,7 @@ jobs:
             echo "Waiting for release PR #$pr to become mergeable under branch policy"
             merge_state=UNKNOWN
             mergeable=UNKNOWN
-            for attempt in $(seq 1 30); do
+            for attempt in $(seq 1 90); do
               : "$attempt"
               if read -r merge_state mergeable < <(
                 gh pr view "$pr" \
@@ -372,16 +377,18 @@ jobs:
     # creating a release. Reconciliation is only meaningful after a release
     # commit/tag is actually created; otherwise the promotion's source changes
     # are incorrectly rejected as non-metadata commits.
-    if: inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
+    if: inputs['git-workflow'] == 'staging-release' && inputs['defer-publication'] != true && (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true) && needs.release.result == 'success' && needs.release.outputs.release_created == 'true'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
     env:
-      # Reconciliation is the sole staging-ruleset bypass. Keep GH_TOKEN scoped to
-      # the repository's own GitHub Actions integration token; deploy key use is
-      # optional and only activated when STAGING_DEPLOY_KEY is provided.
+      # Reconciliation is the sole staging-ruleset bypass and is enabled only
+      # for repositories that explicitly opt into the staging-release topology.
+      # Keep GH_TOKEN scoped to the repository's own GitHub Actions integration
+      # token; deploy key use is optional and only activated when
+      # STAGING_DEPLOY_KEY is provided.
       GH_TOKEN: ${{ github.token }}
       STAGING_DEPLOY_KEY_PRESENT: ${{ secrets.STAGING_DEPLOY_KEY != '' }}
     steps:

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.28.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.3...v1.28.4) (2026-09-10)
+
+
+### Bug Fixes
+
+* **release:** scope reconciliation to staging topology ([bfba0c1](https://github.com/0xPlayerOne/code-foundry/commit/bfba0c147ea6281c47754938d6711d3e5e0335a2))
+
+## [1.28.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.2...v1.28.3) (2026-09-10)
+
+
+### Maintenance
+
+* **config:** pin Code Foundry runtime to v1.28.2 ([#599](https://github.com/0xPlayerOne/code-foundry/issues/599)) ([ed61358](https://github.com/0xPlayerOne/code-foundry/commit/ed6135813e12e1f5410066a92183f2f2d18dcc8c))
+
 ## [1.28.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.1...v1.28.2) (2026-09-10)
 
 

package/docs/CONFIGURATION.md

@@ -165,7 +165,9 @@ release_merge_strategy: rebase
 Use `simple` with `version.txt` when no package manifest exists. Use `none` to
 skip automated releases. `npm_publish` affects generated consumer release
 callers; Code Foundry's own repository uses the qualified publication path
-described in [Qualified publication](qualified-publication.md).
+described in [Qualified publication](qualified-publication.md). A self-sync of
+the Code Foundry source does not advance its own `runtime_ref`; this prevents a
+self-referencing runtime pin from creating a release loop.
 
 ## Synchronization and extensions
 

package/docs/RELEASES.md

@@ -74,8 +74,11 @@ The generated commit preserves the staged tip's conventional subject so
 Release Please still detects the appropriate release type after promotion.
 
 The `staging` → `main` reconciliation exists only in the `staging-release`
-topology. Patch-equivalent divergence between `main` and `staging` is treated
-as aligned. When `staging` has pending commits that are not yet represented on
+topology. The reusable release workflow defaults to `direct` and requires its
+caller to opt into `staging-release`, so a stale remote `staging` branch cannot
+activate reconciliation in a direct repository. Patch-equivalent divergence
+between `main` and `staging` is treated as aligned. When `staging` has pending
+commits that are not yet represented on
 `main`, the release workflow replays those staging-only commits in order onto a
 detached worktree rooted at `main`, and then updates `staging` with an exact
 `--force-with-lease` to prevent
@@ -144,6 +147,8 @@ already passed).
    topology method: squash for `direct`, rebase for `staging-release`.
 3. For a generated consumer caller, confirm the GitHub Release and any package
    publication.
-4. For Code Foundry itself, confirm qualification, draft staging, immutable
+4. For Code Foundry itself, do not advance the self-referencing runtime pin as
+   part of a release; self-sync preserves that compatibility pin and avoids a
+   self-update release loop. Confirm qualification, draft staging, immutable
    publication, and the retained identity receipts.
 5. In `staging-release`, synchronize `staging` with the new `main` release commit.

package/docs/fleet-rollouts.md

@@ -1,8 +1,9 @@
 # Declarative fleet inventory and staged rollouts
 
 Place `code-foundry-fleet.json` in the directory passed to `--root`. Its presence
-opts that fleet into inventory-based discovery and controlled upgrades, without
-changing legacy directory discovery for existing users.
+opts that fleet into inventory-based discovery and controlled upgrades. The
+runtime has no organization-specific fleet inventory; legacy discovery is limited
+to the explicitly supplied root and its immediate children.
 
 ```json
 {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.2",
+  "version": "1.28.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/fleet-core.mjs

@@ -18,7 +18,11 @@ export function discoverRepositories(root) {
   if (hasFleetManifest(root)) return discoverManifestRepositories(root)
   /** @type {FleetRepository[]} */
   const result = []
-  const candidates = [root, ...children(root), ...children(join(root, 'NiftyLeague'))]
+  // Legacy discovery is intentionally limited to the explicitly supplied root
+  // and its immediate children. Consumer-fleet inventories belong in an
+  // explicit code-foundry-fleet.json manifest; the runtime must not know about
+  // any organization's repositories or directory names.
+  const candidates = [root, ...children(root)]
   for (const candidate of new Set(candidates)) {
     if (!existsSync(join(candidate, '.git'))) continue
     const configured = existsSync(join(candidate, '.github/code-foundry.yml'))

package/src/commands/sync.mjs

@@ -119,6 +119,7 @@ const legacyFiles = [
 function synchronize(options) {
   const target = resolve(options.target)
   const source = resolve(options.source)
+  const selfRepository = target === source
   const dryRun = options.dryRun ?? false
   const force = options.force ?? false
   const configPath = join(target, '.github/code-foundry.yml')
@@ -212,14 +213,17 @@ function synchronize(options) {
       )
     }
   }
-  // Keep normal semver pins current during sync while preserving intentional
-  // refs such as `main`, `staging`, or a custom immutable SHA. An explicit
-  // runtime ref (fleet upgrade) is authoritative and overrides even those so
-  // the rendered callers and the config pin land on the same runtime.
+  // Keep normal semver pins current during consumer syncs while preserving
+  // intentional refs such as `main`, `staging`, or a custom immutable SHA. An
+  // explicit runtime ref (fleet upgrade) is authoritative and overrides even
+  // those so the rendered callers and the config pin land on the same runtime.
+  // The runtime source itself is excluded from automatic pin advancement so a
+  // self-referencing config cannot create a release loop.
   if (
     existingConfig.runtime_ref &&
     existingConfig.runtime_ref !== targetRuntimeRef &&
-    (options.runtimeRef !== undefined || /^v\d+\.\d+\.\d+$/.test(existingConfig.runtime_ref))
+    (options.runtimeRef !== undefined ||
+      (!selfRepository && /^v\d+\.\d+\.\d+$/.test(existingConfig.runtime_ref)))
   ) {
     runtimeRef = targetRuntimeRef
     const current = readFileSync(configPath, 'utf8')
@@ -260,7 +264,7 @@ function synchronize(options) {
           runtimeRef,
           rustCodeql,
           file,
-          target === source
+          selfRepository
         )
       )
     }
@@ -636,6 +640,12 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
     release: config.release_runner ?? config.runner,
   }
   const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
+  if (workflow === 'release' && !selfRepository) {
+    rendered = rendered.replace(
+      /^(\s+runtime-ref:)\s+.*$/m,
+      `$1 ${ref}\n      git-workflow: ${isStagingRelease(config.git_workflow) ? 'staging-release' : 'direct'}`
+    )
+  }
   // Generated PR callers protect drafts by default. Consumers that intentionally
   // run gates while a PR is still draft can opt out in code-foundry.yml.
   if (configured(config.draft_protection, 'true') === 'false') {