code-foundry 1.3.0 → 1.3.1

package/.github/workflows/opencode-security_self-ci.yml

@@ -9,17 +9,16 @@ permissions:
   contents: read
 
 jobs:
-  # One job: the release-please branch gate stays at the job level so
-  # ordinary pull requests render a single skipped check instead of two.
-  # The scan itself still runs only for generated release pull requests
-  # (or manual dispatch) with the scanner configured and keyed.
-  scan:
-    name: OpenCode Security / Scan
+  detect:
+    name: OpenCode Security / Detect
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
       (github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
     runs-on: ubuntu-slim
+    outputs:
+      enabled: ${{ steps.detect.outputs.enabled }}
+      token: ${{ steps.detect.outputs.token }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -36,17 +35,27 @@ jobs:
           if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
           echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
           echo "token=$token" >> "$GITHUB_OUTPUT"
-      - name: Scan
-        if: steps.detect.outputs.enabled == 'true' && steps.detect.outputs.token == 'true'
-        uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@137698ef3545204af8fad00fc8bd64d663c8122e # main
-        with:
-          # This is the scanner checkout ref, not the consumer PR ref. The
-          # reusable workflow already checks out the consumer repository.
-          source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
-          runner: ubuntu-latest
-          model: opencode-go/muse-spark-1.3-contributor
-          mode: standard
-          fail_on_severity: high
-          max_cost_usd: 1
-        secrets:
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+
+  # Reusable workflows can only be called from a job level, so the scan is
+  # its own job gated on the detect outputs. The scan itself still runs only
+  # for generated release pull requests (or manual dispatch) with the
+  # scanner configured and keyed.
+  scan:
+    name: OpenCode Security / Scan
+    needs: detect
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      needs.detect.outputs.enabled == 'true' &&
+      needs.detect.outputs.token == 'true'
+    uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@137698ef3545204af8fad00fc8bd64d663c8122e # main
+    with:
+      # This is the scanner checkout ref, not the consumer PR ref. The
+      # reusable workflow already checks out the consumer repository.
+      source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
+      runner: ubuntu-latest
+      model: opencode-go/muse-spark-1.3-contributor
+      mode: standard
+      fail_on_severity: high
+      max_cost_usd: 1
+    secrets:
+      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.3.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.3.0...v1.3.1) (2026-09-07)
+
+
+### Bug Fixes
+
+* restore job-level OpenCode scanner call; preserve consumer oxlint ignores on sync ([#473](https://github.com/0xPlayerOne/code-foundry/issues/473)) ([171ac3d](https://github.com/0xPlayerOne/code-foundry/commit/171ac3dc57368a6ad1e21d8b439a34cbbe2eca58))
+
 ## [1.3.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.2.1...v1.3.0) (2026-09-07)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -227,7 +227,12 @@ export function syncRepository(options) {
     }
     if (file === '.oxfmtrc.json' && existsSync(destination)) {
       content = Buffer.from(
-        mergeOxfmtConfig(content.toString('utf8'), readFileSync(destination, 'utf8'))
+        mergeIgnorePatternsConfig(content.toString('utf8'), readFileSync(destination, 'utf8'))
+      )
+    }
+    if (file === '.oxlintrc.json' && existsSync(destination)) {
+      content = Buffer.from(
+        mergeIgnorePatternsConfig(content.toString('utf8'), readFileSync(destination, 'utf8'))
       )
     }
     if (!existsSync(destination) || !buffersEqual(content, readFileSync(destination))) {
@@ -776,13 +781,14 @@ function mergeGitignore(baseline, existing) {
 }
 
 /**
- * Merge the baseline Oxfmt config with the consumer's current config. The
- * baseline owns every key except `ignorePatterns`, where consumer-specific
- * patterns (added by sync migrations or by the repository) are preserved so
- * repeated syncs never churn them.
+ * Merge a baseline Oxc config (.oxfmtrc.json / .oxlintrc.json) with the
+ * consumer's current config. The baseline owns every key except
+ * `ignorePatterns`, where consumer-specific patterns (added by sync
+ * migrations or by the repository) are preserved so repeated syncs never
+ * churn them.
  * @param {string} baseline @param {string} existing @returns {string}
  */
-function mergeOxfmtConfig(baseline, existing) {
+function mergeIgnorePatternsConfig(baseline, existing) {
   /** @type {string[]} */
   let extra = []
   try {