code-foundry 1.28.4 → 1.28.6

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.28.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.5...v1.28.6) (2026-09-10)
+
+
+### Bug Fixes
+
+* **sync:** preserve non-CodeQL workflow triggers ([#605](https://github.com/0xPlayerOne/code-foundry/issues/605)) ([e215207](https://github.com/0xPlayerOne/code-foundry/commit/e215207d596361f283072d4f43f8ab58676e13c8))
+
+## [1.28.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.4...v1.28.5) (2026-09-10)
+
+
+### Bug Fixes
+
+* **fleet:** require explicit inventory manifest ([#603](https://github.com/0xPlayerOne/code-foundry/issues/603)) ([1345331](https://github.com/0xPlayerOne/code-foundry/commit/13453318ba4fb21e6df6d978f1d51119148300ba))
+
 ## [1.28.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.3...v1.28.4) (2026-09-10)
 
 

package/docs/fleet-rollouts.md

@@ -1,9 +1,9 @@
 # Declarative fleet inventory and staged rollouts
 
-Place `code-foundry-fleet.json` in the directory passed to `--root`. Its presence
-opts that fleet into inventory-based discovery and controlled upgrades. The
-runtime has no organization-specific fleet inventory; legacy discovery is limited
-to the explicitly supplied root and its immediate children.
+Place `code-foundry-fleet.json` in the directory passed to `--root`. Fleet
+discovery and controlled upgrades require this explicit inventory. The runtime
+has no organization-specific fleet inventory and never scans arbitrary
+repositories from the filesystem.
 
 ```json
 {
@@ -107,8 +107,8 @@ branches or commits with mismatched tree markers are preserved and blocked for
 manual review. Local managed refs preserve committed work after a failed push.
 The marker is an ownership/recovery guard, not a cryptographic signature.
 
-PR creation is draft-first in both manifest and legacy discovery modes. A PR that
-a human has already made ready is not silently converted back or modified.
+PR creation is draft-first in manifest mode. A PR that a human has already made
+ready is not silently converted back or modified.
 
 An entry may include a reviewed time-limited exception:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.28.4",
+  "version": "1.28.6",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/fleet-core.mjs

@@ -1,9 +1,5 @@
 // @ts-check
 
-import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import { spawnSync } from 'node:child_process'
 import { readPackageVersion, syncRepository } from './sync.mjs'
 import {
   discoverManifestRepositories,
@@ -13,31 +9,19 @@ import {
 
 /** @typedef {{ path: string, repository: string, runtimeRef: string, dirty: boolean, configured: boolean, gitWorkflow: string }} FleetRepository */
 
+/** @param {string} root */
+function requireFleetManifest(root) {
+  if (!hasFleetManifest(root)) {
+    throw new Error(
+      'Missing code-foundry-fleet.json; fleet discovery requires an explicit manifest.'
+    )
+  }
+}
+
 /** @param {string} root @returns {FleetRepository[]} */
 export function discoverRepositories(root) {
-  if (hasFleetManifest(root)) return discoverManifestRepositories(root)
-  /** @type {FleetRepository[]} */
-  const result = []
-  // Legacy discovery is intentionally limited to the explicitly supplied root
-  // and its immediate children. Consumer-fleet inventories belong in an
-  // explicit code-foundry-fleet.json manifest; the runtime must not know about
-  // any organization's repositories or directory names.
-  const candidates = [root, ...children(root)]
-  for (const candidate of new Set(candidates)) {
-    if (!existsSync(join(candidate, '.git'))) continue
-    const configured = existsSync(join(candidate, '.github/code-foundry.yml'))
-    const config = readConfig(join(candidate, '.github/code-foundry.yml'))
-    const remote = git(candidate, ['remote', 'get-url', 'origin'])
-    result.push({
-      path: candidate,
-      repository: normalizeRemote(remote),
-      runtimeRef: config.runtime_ref ?? '',
-      dirty: Boolean(git(candidate, ['status', '--porcelain'])),
-      configured,
-      gitWorkflow: config.git_workflow ?? 'direct',
-    })
-  }
-  return result.toSorted((a, b) => a.path.localeCompare(b.path))
+  requireFleetManifest(root)
+  return discoverManifestRepositories(root)
 }
 
 /** @param {string} root @param {string} source @param {{ createPr?: boolean, dryRun?: boolean, force?: boolean, version: string, exclude?: string[] }} options */
@@ -49,523 +33,6 @@ export function upgradeFleet(root, source, options) {
       `fleet upgrade target ${options.version} does not match the runtime source checkout (${sourceVersion}); refresh the code-foundry checkout to ${options.version} before upgrading so the rendered callers and the declared runtime agree.`
     )
   }
-  if (hasFleetManifest(root))
-    return upgradeManifestFleet(root, source, { ...options, version }, syncRepository)
-  const repositories = discoverRepositories(root)
-  const report = []
-  for (const repository of repositories) {
-    if (
-      (options.exclude ?? []).some(
-        (value) =>
-          repository.path === value ||
-          repository.repository === value ||
-          repository.path.endsWith(`/${value}`)
-      )
-    ) {
-      report.push({ path: repository.path, status: 'skipped', reason: 'excluded by fleet policy' })
-      continue
-    }
-    if (!repository.configured) {
-      report.push({
-        path: repository.path,
-        status: 'skipped',
-        reason: 'missing .github/code-foundry.yml',
-      })
-      continue
-    }
-    if (repository.dirty && !options.force) {
-      report.push({ path: repository.path, status: 'skipped', reason: 'working tree is dirty' })
-      continue
-    }
-    if (!options.createPr || options.dryRun) {
-      const result = syncRepository({
-        target: repository.path,
-        source,
-        dryRun: options.dryRun,
-        force: false,
-      })
-      report.push({
-        path: repository.path,
-        status: options.dryRun ? 'preview' : 'synced',
-        changed: result.changed,
-      })
-      continue
-    }
-    if (!repository.repository) {
-      report.push({
-        path: repository.path,
-        status: 'skipped',
-        reason: 'origin is not a GitHub remote',
-      })
-      continue
-    }
-    report.push(upgradeRepository(repository, source, version))
-  }
-  console.log(JSON.stringify(report, null, 2))
-  return report
-}
-
-/** @param {FleetRepository} repository @param {string} source @param {string} version */
-function upgradeRepository(repository, source, version) {
-  const branch = `codex/code-foundry-upgrade-${version.replace(/^v/, '')}`
-  const base = repository.gitWorkflow === 'staging-release' ? 'staging' : 'main'
-  const temporary = mkdtempSync(join(tmpdir(), 'code-foundry-fleet-'))
-  let attached = false
-  try {
-    const fetch = spawnSync('git', ['-C', repository.path, 'fetch', 'origin', base, '--quiet'], {
-      encoding: 'utf8',
-    })
-    if (fetch.status !== 0)
-      return {
-        path: repository.path,
-        status: 'skipped',
-        reason: fetch.stderr.trim() || `unable to refresh ${base} baseline`,
-      }
-    const marker = `<!-- code-foundry-legacy-rollout:${repository.repository}:${version}:${base} -->`
-    const commitMarker = `Code-Foundry-Legacy-Rollout: ${repository.repository}:${version}:${base}`
-    const remoteBranch = spawnSync(
-      'git',
-      ['-C', repository.path, 'ls-remote', '--heads', 'origin', `refs/heads/${branch}`],
-      { encoding: 'utf8' }
-    )
-    if (remoteBranch.status !== 0)
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: remoteBranch.stderr.trim() || 'unable to inspect existing upgrade branch',
-      }
-    const remote = remoteBranch.stdout.trim().split(/\s/)[0] ?? ''
-    const local = spawnSync(
-      'git',
-      ['-C', repository.path, 'rev-parse', '--verify', '--quiet', `refs/heads/${branch}`],
-      { encoding: 'utf8' }
-    )
-    if (local.status !== 0 && local.status !== 1)
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: 'unable to inspect existing local upgrade branch',
-      }
-    const existing = remote || (local.status === 0 ? local.stdout.trim() : '')
-    if (remote) {
-      const branchFetch = spawnSync(
-        'git',
-        ['-C', repository.path, 'fetch', 'origin', branch, '--quiet'],
-        { encoding: 'utf8' }
-      )
-      if (branchFetch.status !== 0)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: branchFetch.stderr.trim() || 'unable to fetch existing upgrade branch',
-        }
-    }
-    const baseline = spawnSync('git', ['-C', repository.path, 'rev-parse', `origin/${base}`], {
-      encoding: 'utf8',
-    })
-    if (baseline.status !== 0)
-      return {
-        path: repository.path,
-        status: 'skipped',
-        reason: `remote ${base} branch is unavailable`,
-      }
-    if (existing) {
-      const message = spawnSync(
-        'git',
-        ['-C', repository.path, 'show', '-s', '--format=%B', existing],
-        { encoding: 'utf8' }
-      )
-      const tree = spawnSync('git', ['-C', repository.path, 'rev-parse', `${existing}^{tree}`], {
-        encoding: 'utf8',
-      })
-      const parent = spawnSync('git', ['-C', repository.path, 'rev-parse', `${existing}^`], {
-        encoding: 'utf8',
-      })
-      const subject = message.stdout.split(/\r?\n/, 1)[0]
-      const managed =
-        message.status === 0 &&
-        tree.status === 0 &&
-        message.stdout.includes(commitMarker) &&
-        message.stdout.includes(`Code-Foundry-Tree: ${tree.stdout.trim()}`)
-      const legacyManaged =
-        subject === `chore(code-foundry): upgrade runtime to ${version}` &&
-        parent.status === 0 &&
-        parent.stdout.trim() === baseline.stdout.trim()
-      if (!managed && !legacyManaged)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: 'Existing upgrade branch is not a managed rollout; reconcile it manually',
-        }
-    }
-    const add = spawnSync(
-      'git',
-      [
-        '-C',
-        repository.path,
-        'worktree',
-        'add',
-        '--detach',
-        temporary,
-        existing || baseline.stdout.trim(),
-      ],
-      { encoding: 'utf8' }
-    )
-    if (add.status !== 0)
-      return {
-        path: repository.path,
-        status: 'skipped',
-        reason: add.stderr.trim() || 'unable to create isolated worktree',
-      }
-    attached = true
-    let validatedHead = existing
-    if (!existing) {
-      const result = syncRepository({
-        target: temporary,
-        source,
-        force: false,
-        runtimeRef: version,
-      })
-      const configFile = join(temporary, '.github/code-foundry.yml')
-      if (existsSync(configFile)) {
-        const current = readFileSync(configFile, 'utf8')
-        const updated = current.match(/^runtime_ref:\s*.*$/m)
-          ? current.replace(/^runtime_ref:\s*.*$/m, `runtime_ref: ${version}`)
-          : `${current.trimEnd()}\nruntime_ref: ${version}\n`
-        if (updated !== current) {
-          writeFileSync(configFile, updated)
-          if (!result.changed.includes('.github/code-foundry.yml'))
-            result.changed.push('.github/code-foundry.yml')
-        }
-      }
-      if (!result.changed.length) return { path: repository.path, status: 'unchanged', branch }
-      const stage = spawnSync('git', ['-C', temporary, 'add', '--', ...result.changed], {
-        encoding: 'utf8',
-      })
-      if (stage.status !== 0)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: stage.stderr.trim() || 'unable to stage generated upgrade files',
-        }
-      const staged = spawnSync('git', ['-C', temporary, 'diff', '--cached', '--name-only'], {
-        encoding: 'utf8',
-      })
-      if (staged.status !== 0 || !staged.stdout.trim())
-        return { path: repository.path, status: 'unchanged', branch }
-      const tree = spawnSync('git', ['-C', temporary, 'write-tree'], { encoding: 'utf8' })
-      if (tree.status !== 0)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: tree.stderr.trim() || 'unable to record generated upgrade tree',
-        }
-      const commit = spawnSync(
-        'git',
-        [
-          '-C',
-          temporary,
-          '-c',
-          'core.hooksPath=.githooks',
-          'commit',
-          '-m',
-          `chore(code-foundry): upgrade runtime to ${version}`,
-          '-m',
-          `${commitMarker}\nCode-Foundry-Tree: ${tree.stdout.trim()}`,
-        ],
-        { encoding: 'utf8' }
-      )
-      if (commit.status !== 0)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: commit.stderr.trim() || 'commit failed',
-        }
-      const committedTree = spawnSync('git', ['-C', temporary, 'rev-parse', 'HEAD^{tree}'], {
-        encoding: 'utf8',
-      })
-      if (committedTree.status !== 0 || committedTree.stdout.trim() !== tree.stdout.trim())
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: 'Commit hook changed the generated upgrade tree',
-        }
-      const sha = spawnSync('git', ['-C', temporary, 'rev-parse', 'HEAD'], { encoding: 'utf8' })
-      if (sha.status !== 0)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: 'unable to inspect generated upgrade commit',
-        }
-      const update = spawnSync(
-        'git',
-        [
-          '-C',
-          repository.path,
-          'update-ref',
-          `refs/heads/${branch}`,
-          sha.stdout.trim(),
-          '0'.repeat(40),
-        ],
-        { encoding: 'utf8' }
-      )
-      if (update.status !== 0)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: update.stderr.trim() || 'unable to retain generated upgrade commit',
-        }
-      validatedHead = sha.stdout.trim()
-    }
-    if (remote && remote !== validatedHead)
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: 'Upgrade branch changed during validation; refusing to create a pull request',
-      }
-    if (!remote) {
-      const push = spawnSync(
-        'git',
-        ['-C', temporary, 'push', '-u', 'origin', `HEAD:refs/heads/${branch}`],
-        { encoding: 'utf8' }
-      )
-      if (push.status !== 0)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: push.stderr.trim() || 'push failed',
-        }
-      const pushed = spawnSync(
-        'git',
-        ['-C', repository.path, 'ls-remote', '--heads', 'origin', `refs/heads/${branch}`],
-        { encoding: 'utf8' }
-      )
-      if (pushed.status !== 0 || pushed.stdout.trim().split(/\s/)[0] !== validatedHead)
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: 'Upgrade branch did not retain the validated commit',
-        }
-    }
-    const listed = spawnSync(
-      'gh',
-      [
-        'pr',
-        'list',
-        '--repo',
-        repository.repository,
-        '--head',
-        branch,
-        '--base',
-        base,
-        '--state',
-        'all',
-        '--limit',
-        '100',
-        '--json',
-        'url,body,state,headRefName,headRefOid,baseRefName,isCrossRepository,isDraft',
-      ],
-      { encoding: 'utf8' }
-    )
-    if (listed.status !== 0)
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: listed.stderr.trim() || 'unable to inspect upgrade pull requests',
-      }
-    let pullRequests
-    try {
-      pullRequests = JSON.parse(listed.stdout)
-    } catch {
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: 'invalid pull request list',
-      }
-    }
-    if (!Array.isArray(pullRequests) || pullRequests.length > 1)
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: 'Ambiguous upgrade pull requests',
-      }
-    const existingPr = pullRequests[0]
-    if (existingPr) {
-      if (
-        !existingPr.body?.includes(marker) ||
-        existingPr.headRefName !== branch ||
-        existingPr.baseRefName !== base ||
-        existingPr.headRefOid !== validatedHead ||
-        existingPr.isCrossRepository !== false
-      )
-        return {
-          path: repository.path,
-          status: 'failed',
-          branch,
-          reason: 'Existing pull request does not match this rollout policy',
-        }
-      return {
-        path: repository.path,
-        status: 'pr-existing',
-        branch,
-        pullRequest: existingPr.url,
-        draft: existingPr.isDraft,
-      }
-    }
-    const pr = spawnSync(
-      'gh',
-      [
-        'pr',
-        'create',
-        '--draft',
-        '--repo',
-        repository.repository,
-        '--base',
-        base,
-        '--head',
-        branch,
-        '--title',
-        `chore(code-foundry): upgrade to ${version}`,
-        '--body',
-        `${marker}\n\nAutomated isolated Code Foundry runtime upgrade to ${version}.\n\nThe sync preserved protected repository-owned documents and custom workflows.`,
-      ],
-      { encoding: 'utf8' }
-    )
-    if (pr.status !== 0)
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: pr.stderr.trim() || 'pull request creation failed',
-      }
-    const created = spawnSync(
-      'gh',
-      [
-        'pr',
-        'view',
-        pr.stdout.trim(),
-        '--repo',
-        repository.repository,
-        '--json',
-        'headRefOid,headRefName,baseRefName,isCrossRepository,isDraft',
-      ],
-      { encoding: 'utf8' }
-    )
-    if (created.status !== 0)
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: created.stderr.trim() || 'unable to verify created pull request',
-      }
-    let createdPr
-    try {
-      createdPr = JSON.parse(created.stdout)
-    } catch {
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: 'invalid created pull request',
-      }
-    }
-    if (
-      createdPr.headRefOid !== validatedHead ||
-      createdPr.headRefName !== branch ||
-      createdPr.baseRefName !== base ||
-      createdPr.isCrossRepository !== false ||
-      createdPr.isDraft !== true
-    )
-      return {
-        path: repository.path,
-        status: 'failed',
-        branch,
-        reason: 'Created pull request does not reference the validated draft rollout branch',
-      }
-    return {
-      path: repository.path,
-      status: existing ? 'pr-resumed' : 'pr-created',
-      branch,
-      pullRequest: pr.stdout.trim(),
-    }
-  } finally {
-    if (attached) {
-      const cleanup = spawnSync(
-        'git',
-        ['-C', repository.path, 'worktree', 'remove', '--force', temporary],
-        { encoding: 'utf8' }
-      )
-      if (cleanup.status !== 0)
-        console.error(`Preserved isolated worktree after cleanup failure: ${temporary}`)
-      else rmSync(temporary, { recursive: true, force: true })
-    } else rmSync(temporary, { recursive: true, force: true })
-  }
-}
-
-/** @param {string} root @returns {string[]} */
-function children(root) {
-  try {
-    return readdirSync(root, { withFileTypes: true })
-      .filter(
-        (entry) =>
-          entry.isDirectory() &&
-          !entry.name.startsWith('.') &&
-          !['node_modules', 'target'].includes(entry.name)
-      )
-      .map((entry) => join(root, entry.name))
-  } catch {
-    return []
-  }
-}
-
-/** @param {string} file @returns {Record<string, string>} */
-function readConfig(file) {
-  try {
-    return Object.fromEntries(
-      requireText(file)
-        .split(/\r?\n/)
-        .flatMap((line) => {
-          const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*?)\s*$/)
-          return match
-            ? [[match[1], match[2].replace(/\s+#.*$/, '').replace(/^['"]|['"]$/g, '')]]
-            : []
-        })
-    )
-  } catch {
-    return {}
-  }
-}
-
-/** @param {string} file */
-function requireText(file) {
-  return readFileSync(file, 'utf8')
-}
-
-/** @param {string} root @param {string[]} args */
-function git(root, args) {
-  return spawnSync('git', args, { cwd: root, encoding: 'utf8' }).stdout?.trim() ?? ''
-}
-
-/** @param {string} remote */
-function normalizeRemote(remote) {
-  return remote
-    .replace(/^git@github\.com:/, '')
-    .replace(/^https?:\/\/github\.com\//, '')
-    .replace(/\.git$/, '')
+  requireFleetManifest(root)
+  return upgradeManifestFleet(root, source, { ...options, version }, syncRepository)
 }

package/src/commands/sync.mjs

@@ -613,7 +613,10 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       `${remotePrefix}validation-no-codeql.yml`
     )
     rendered = removeWorkflowBlock(rendered, 'default-branch-codeql')
-    rendered = removeWorkflowBlock(rendered, 'push')
+    // Only the validation caller's default-branch trigger is tied to CodeQL.
+    // Draft-PR, release, and other callers still need their own push triggers.
+    if (file === '.github/workflows/validation.yml')
+      rendered = removeWorkflowBlock(rendered, 'push')
   }
   rendered = rendered.replace(
     new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'),