code-foundry 1.3.0 → 1.3.2

package/.github/code-foundry.yml

@@ -11,7 +11,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v1.2.0
+runtime_ref: v1.3.1
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later

package/.github/workflows/opencode-security_self-ci.yml

@@ -9,17 +9,16 @@ permissions:
   contents: read
 
 jobs:
-  # One job: the release-please branch gate stays at the job level so
-  # ordinary pull requests render a single skipped check instead of two.
-  # The scan itself still runs only for generated release pull requests
-  # (or manual dispatch) with the scanner configured and keyed.
-  scan:
-    name: OpenCode Security / Scan
+  detect:
+    name: OpenCode Security / Detect
     if: >-
       vars.CI_BILLING_PAUSED != 'true' &&
       (github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
     runs-on: ubuntu-slim
+    outputs:
+      enabled: ${{ steps.detect.outputs.enabled }}
+      token: ${{ steps.detect.outputs.token }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -36,17 +35,27 @@ jobs:
           if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
           echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
           echo "token=$token" >> "$GITHUB_OUTPUT"
-      - name: Scan
-        if: steps.detect.outputs.enabled == 'true' && steps.detect.outputs.token == 'true'
-        uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@137698ef3545204af8fad00fc8bd64d663c8122e # main
-        with:
-          # This is the scanner checkout ref, not the consumer PR ref. The
-          # reusable workflow already checks out the consumer repository.
-          source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
-          runner: ubuntu-latest
-          model: opencode-go/muse-spark-1.3-contributor
-          mode: standard
-          fail_on_severity: high
-          max_cost_usd: 1
-        secrets:
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+
+  # Reusable workflows can only be called from a job level, so the scan is
+  # its own job gated on the detect outputs. The scan itself still runs only
+  # for generated release pull requests (or manual dispatch) with the
+  # scanner configured and keyed.
+  scan:
+    name: OpenCode Security / Scan
+    needs: detect
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      needs.detect.outputs.enabled == 'true' &&
+      needs.detect.outputs.token == 'true'
+    uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@137698ef3545204af8fad00fc8bd64d663c8122e # main
+    with:
+      # This is the scanner checkout ref, not the consumer PR ref. The
+      # reusable workflow already checks out the consumer repository.
+      source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
+      runner: ubuntu-latest
+      model: opencode-go/muse-spark-1.3-contributor
+      mode: standard
+      fail_on_severity: high
+      max_cost_usd: 1
+    secrets:
+      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.3.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.3.1...v1.3.2) (2026-09-07)
+
+
+### Bug Fixes
+
+* preserve consumer-only Oxc config keys across syncs ([#476](https://github.com/0xPlayerOne/code-foundry/issues/476)) ([07aee3a](https://github.com/0xPlayerOne/code-foundry/commit/07aee3aed2aadeccf9740e1966941281e3f031f4))
+
+## [1.3.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.3.0...v1.3.1) (2026-09-07)
+
+
+### Bug Fixes
+
+* restore job-level OpenCode scanner call; preserve consumer oxlint ignores on sync ([#473](https://github.com/0xPlayerOne/code-foundry/issues/473)) ([171ac3d](https://github.com/0xPlayerOne/code-foundry/commit/171ac3dc57368a6ad1e21d8b439a34cbbe2eca58))
+
 ## [1.3.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.2.1...v1.3.0) (2026-09-07)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -227,7 +227,12 @@ export function syncRepository(options) {
     }
     if (file === '.oxfmtrc.json' && existsSync(destination)) {
       content = Buffer.from(
-        mergeOxfmtConfig(content.toString('utf8'), readFileSync(destination, 'utf8'))
+        mergeIgnorePatternsConfig(content.toString('utf8'), readFileSync(destination, 'utf8'))
+      )
+    }
+    if (file === '.oxlintrc.json' && existsSync(destination)) {
+      content = Buffer.from(
+        mergeIgnorePatternsConfig(content.toString('utf8'), readFileSync(destination, 'utf8'))
       )
     }
     if (!existsSync(destination) || !buffersEqual(content, readFileSync(destination))) {
@@ -776,32 +781,45 @@ function mergeGitignore(baseline, existing) {
 }
 
 /**
- * Merge the baseline Oxfmt config with the consumer's current config. The
- * baseline owns every key except `ignorePatterns`, where consumer-specific
- * patterns (added by sync migrations or by the repository) are preserved so
- * repeated syncs never churn them.
+ * Merge a baseline Oxc config (.oxfmtrc.json / .oxlintrc.json) with the
+ * consumer's current config. The baseline owns every key it defines, except
+ * `ignorePatterns`, where consumer-specific patterns (added by sync
+ * migrations or by the repository) are preserved so repeated syncs never
+ * churn them. Keys the baseline does not define (e.g. a repository-owned
+ * `overrides` block) belong to the consumer and are preserved as well, so
+ * a sync never silently drops repository-owned configuration.
  * @param {string} baseline @param {string} existing @returns {string}
  */
-function mergeOxfmtConfig(baseline, existing) {
-  /** @type {string[]} */
-  let extra = []
+function mergeIgnorePatternsConfig(baseline, existing) {
+  /** @type {Record<string, any>} */
+  let consumer = {}
   try {
-    const parsed = JSON.parse(existing)
-    if (Array.isArray(parsed.ignorePatterns)) extra = parsed.ignorePatterns
+    consumer = JSON.parse(existing)
+    if (consumer === null || typeof consumer !== 'object' || Array.isArray(consumer))
+      return baseline
   } catch {
     return baseline
   }
-  if (extra.length === 0) return baseline
-  let config
+  /** @type {Record<string, any>} */
+  let config = {}
   try {
     config = JSON.parse(baseline)
+    if (config === null || typeof config !== 'object' || Array.isArray(config)) return baseline
   } catch {
     return baseline
   }
+  let preserved = false
+  for (const [key, value] of Object.entries(consumer)) {
+    if (!(key in config)) {
+      config[key] = value
+      preserved = true
+    }
+  }
+  const extra = Array.isArray(consumer.ignorePatterns) ? consumer.ignorePatterns : []
   const base = Array.isArray(config.ignorePatterns) ? config.ignorePatterns : []
   const missing = extra.filter((pattern) => !base.includes(pattern))
-  if (missing.length === 0) return baseline
-  config.ignorePatterns = [...base, ...missing]
+  if (missing.length) config.ignorePatterns = [...base, ...missing]
+  if (!preserved && !missing.length) return baseline
   return `${JSON.stringify(config, null, 2)}\n`
 }