code-foundry 1.3.2 → 1.4.1

package/.github/dependabot.yml

@@ -30,7 +30,7 @@ updates:
         patterns: ['*']
     ignore:
       # TypeScript 7 cannot resolve node: builtins in this toolchain
-      # (verified); revisit when the TS/eslint toolchain supports TS 7.
+      # (verified); revisit when the TS/oxlint toolchain supports TS 7.
       - dependency-name: 'typescript'
         versions: ['>=7.0.0']
       # Held with TypeScript 5.9 above.

package/.github/workflows/opencode-security_self-ci.yml

@@ -28,10 +28,18 @@ jobs:
         id: detect
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          OPENCODE_SECURITY_OVERRIDE: ${{ vars.OPENCODE_SECURITY }}
         run: |
           enabled=false
           token=false
-          if grep -Eq '^opencode_security:\s*(true|auto)\s*$' .github/code-foundry.yml 2>/dev/null; then enabled=true; fi
+          # The OPENCODE_SECURITY repository variable overrides the
+          # configuration: true opts a repository in, false opts it out, and
+          # an unset value falls back to the code-foundry configuration.
+          if [ "$OPENCODE_SECURITY_OVERRIDE" = "true" ]; then
+            enabled=true
+          elif [ "$OPENCODE_SECURITY_OVERRIDE" = "false" ]; then
+            enabled=false
+          elif grep -Eq '^opencode_security:\s*(true|auto)\s*$' .github/code-foundry.yml 2>/dev/null; then enabled=true; fi
           if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
           echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
           echo "token=$token" >> "$GITHUB_OUTPUT"

package/.github/workflows/validation.yml

@@ -109,7 +109,9 @@ jobs:
 
   codeql:
     name: CodeQL
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    # Release-please pull requests also analyze with CodeQL so repository
+    # rulesets requiring code scanning results never deadlock the release.
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/codeql.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.4.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.4.0...v1.4.1) (2026-09-07)
+
+
+### Bug Fixes
+
+* **validation:** run CodeQL on the release tier ([e93c36c](https://github.com/0xPlayerOne/code-foundry/commit/e93c36c4be11611117a13aa88212f16b6129f464))
+
+## [1.4.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.3.2...v1.4.0) (2026-09-07)
+
+
+### Features
+
+* **sync:** oxfmt-stable config merges, gitignore preservation, and OPENCODE_SECURITY variable override ([455ac37](https://github.com/0xPlayerOne/code-foundry/commit/455ac37635d7e88a0bfe007a98ee12b56bc430dc))
+
 ## [1.3.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.3.1...v1.3.2) (2026-09-07)
 
 

package/docs/CONFIGURATION.md

@@ -56,6 +56,20 @@ repository manifests and source
 Supported features are `ci`, `codeql`, `security`, `test`, `draft-pr`,
 `release-pr`, `release`, and `dependabot`.
 
+## OpenCode Security opt-in and opt-out
+
+`opencode_security` controls the optional OpenCode scan, and the generated
+caller ships in every repository. The `OPENCODE_SECURITY` repository variable
+overrides the configuration at run time, so a scan can be toggled on any
+repository without a configuration change or a new secret:
+
+- `OPENCODE_SECURITY: true` opts the repository in.
+- `OPENCODE_SECURITY: false` opts the repository out.
+- unset falls back to the `opencode_security` configuration (default `false`).
+
+The scan only runs when it is enabled and the `OPENCODE_API_KEY` secret is
+present.
+
 ## Git workflow
 
 `git_workflow` selects the branch topology:

package/docs/WORKFLOWS.md

@@ -16,7 +16,9 @@ workflow_dispatch:
 
 In the `staging-release` topology, pull requests into `staging` run the fast
 tier, ordinary pull requests into `main` run the full audit tier, and exact
-Release Please pull requests into `main` run only release policy. In the
+Release Please pull requests into `main` run only release policy plus CodeQL
+(the CodeQL analysis keeps repository rulesets that require code scanning
+results satisfiable for the release commit). In the
 `direct` topology (the default) every pull request targets `main` and runs the
 full audit tier, because there is no integration branch for a fast pass.
 Scheduled and manual runs select the audit tier in both topologies. Draft PR
@@ -67,7 +69,10 @@ throughout the bounded release flow.
 
 Custom workflows are repository-owned and are not rewritten by sync. Add
 `if: vars.CI_BILLING_PAUSED != 'true'` to each custom root job that should
-honor the shared billing pause.
+honor the shared billing pause. The optional OpenCode Security scan honors a
+second toggle: the `OPENCODE_SECURITY` repository variable (`true`/`false`)
+overrides the `opencode_security` configuration per run, so individual
+repositories can opt in or out without a code change.
 
 ## Standard workflow responsibilities
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.3.2",
+  "version": "1.4.1",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -432,8 +432,11 @@ function shouldInclude(file, languages, features, config) {
   if (file === '.oxfmtrc.json' || file === '.oxlintrc.json')
     return includesValue(languages, 'typescript')
   if (file === '.github/dependabot.yml') return includesValue(features, 'dependabot')
-  if (file === '.github/workflows/opencode-security.yml')
-    return ['true', 'auto'].includes(config.opencode_security ?? 'false')
+  // The OpenCode Security caller is installed in every repository so the
+  // OPENCODE_SECURITY repository variable can opt a repository in (or out)
+  // without a configuration change. The detect job keeps the scan off unless
+  // the configuration or the variable enables it and the API key exists.
+  if (file === '.github/workflows/opencode-security.yml') return true
   const workflow = file.match(/^\.github\/workflows\/([^/]+)\.yml$/)?.[1]
   // The staging promotion caller only exists in the staging-release topology;
   // direct repositories open feature branches into main and need no promotion.
@@ -774,10 +777,48 @@ export function isGeneratedEventCaller(content, stem, runtimeRepository) {
 /** @param {string} baseline @param {string} existing */
 function mergeGitignore(baseline, existing) {
   const marker = '# Repository-specific rules'
-  const custom = existing.includes(marker)
-    ? existing.slice(existing.indexOf(marker) + marker.length).trim()
-    : ''
-  return custom ? `${baseline.trimEnd()}\n\n${marker}\n${custom}\n` : baseline
+  const markerIndex = existing.indexOf(marker)
+  const head = markerIndex >= 0 ? existing.slice(0, markerIndex) : existing
+  const customSection = markerIndex >= 0 ? existing.slice(markerIndex + marker.length).trim() : ''
+  const baselineLines = new Set(
+    baseline
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter(Boolean)
+  )
+  // Preserve consumer-owned entries the baseline does not define, including
+  // the comments that introduce them, so a sync never silently drops
+  // repository-specific ignore rules that live outside the managed section
+  // (for example Cloudflare or framework build output added by the repo).
+  /** @type {string[]} */
+  const preserved = []
+  /** @type {string[]} */
+  let pending = []
+  for (const line of head.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith('#')) {
+      pending.push(line)
+      continue
+    }
+    if (baselineLines.has(trimmed)) {
+      pending = []
+      continue
+    }
+    preserved.push(...pending, line)
+    pending = []
+  }
+  /** @type {string[]} */
+  const customLines = []
+  const seen = new Set()
+  for (const line of [...preserved, ...(customSection ? customSection.split(/\r?\n/) : [])]) {
+    const trimmed = line.trim()
+    if (!trimmed || seen.has(trimmed)) continue
+    seen.add(trimmed)
+    customLines.push(line)
+  }
+  return customLines.length
+    ? `${baseline.trimEnd()}\n\n${marker}\n${customLines.join('\n')}\n`
+    : baseline
 }
 
 /**
@@ -788,6 +829,11 @@ function mergeGitignore(baseline, existing) {
  * churn them. Keys the baseline does not define (e.g. a repository-owned
  * `overrides` block) belong to the consumer and are preserved as well, so
  * a sync never silently drops repository-owned configuration.
+ *
+ * When the merged semantics already match the consumer file, the exact
+ * existing bytes are returned untouched: rewriting canonical JSON here
+ * would fight the formatter (which collapses short collections that
+ * `JSON.stringify` expands) and churn the file on every sync.
  * @param {string} baseline @param {string} existing @returns {string}
  */
 function mergeIgnorePatternsConfig(baseline, existing) {
@@ -808,19 +854,36 @@ function mergeIgnorePatternsConfig(baseline, existing) {
   } catch {
     return baseline
   }
-  let preserved = false
+  /** @type {Record<string, any>} */
+  const merged = { ...config }
   for (const [key, value] of Object.entries(consumer)) {
-    if (!(key in config)) {
-      config[key] = value
-      preserved = true
-    }
+    if (!(key in merged)) merged[key] = value
   }
   const extra = Array.isArray(consumer.ignorePatterns) ? consumer.ignorePatterns : []
-  const base = Array.isArray(config.ignorePatterns) ? config.ignorePatterns : []
+  const base = Array.isArray(merged.ignorePatterns) ? merged.ignorePatterns : []
   const missing = extra.filter((pattern) => !base.includes(pattern))
-  if (missing.length) config.ignorePatterns = [...base, ...missing]
-  if (!preserved && !missing.length) return baseline
-  return `${JSON.stringify(config, null, 2)}\n`
+  if (missing.length) merged.ignorePatterns = [...base, ...missing]
+  if (jsonDeepEqual(merged, consumer)) return existing
+  return `${JSON.stringify(merged, null, 2)}\n`
+}
+
+/**
+ * Order-insensitive deep equality for JSON-compatible values. Used to detect
+ * semantic equality between the merged Oxc configuration and the consumer's
+ * current file so formatting differences never trigger a rewrite.
+ * @param {any} a @param {any} b @returns {boolean}
+ */
+function jsonDeepEqual(a, b) {
+  if (a === b) return true
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false
+    return a.every((item, index) => jsonDeepEqual(item, b[index]))
+  }
+  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false
+  const aKeys = Object.keys(a)
+  const bKeys = Object.keys(b)
+  if (aKeys.length !== bKeys.length) return false
+  return aKeys.every((key) => key in b && jsonDeepEqual(a[key], b[key]))
 }
 
 /**

package/src/lib/github-doctor.mjs

@@ -109,6 +109,12 @@ export function doctorGithub(root) {
     warnings.push(
       'opencode_security is enabled but OPENCODE_API_KEY is not configured; the optional scan will be skipped.'
     )
+  if (['true', 'auto'].includes(config.opencode_security ?? 'false'))
+    details.credentials.opencodeSecurityConfigured = true
+  details.credentials.opencodeSecurityVariable =
+    ghJson(['variable', 'list', '--repo', repository, '--json', 'name'])?.some(
+      /** @param {{ name?: string }} variable */ (variable) => variable.name === 'OPENCODE_SECURITY'
+    ) ?? false
 
   const prs = ghJson([
     'pr',

package/src/lib/validation-policy.mjs

@@ -82,10 +82,12 @@ export function classifyValidationMode(input) {
 const REQUIRED_JOBS_BY_MODE = {
   fast: ['ci', 'test'],
   audit: ['ci', 'test', 'security', 'codeql'],
-  // The release tier requires no suite jobs: the generated release diff
-  // check runs as a conditional step inside the gate itself, so an empty
-  // requirement list is complete and any suite result is irrelevant.
-  release: [],
+  // The release tier skips the CI/test/security suites (the generated release
+  // diff check runs as a conditional step inside the gate itself) but still
+  // runs CodeQL: repository rulesets that require code scanning results need
+  // a CodeQL analysis of the release pull request's commit, and Release
+  // Please pull requests must not deadlock against that requirement.
+  release: ['codeql'],
 }
 
 /**