code-foundry 1.33.1 → 1.33.3

package/.github/workflows/cloudflare-deploy.yml

@@ -285,12 +285,12 @@ jobs:
           set -euo pipefail
           if [ "$WRANGLER_VERSION" = local ]; then
             if [ -n "$BUILD_SCRIPT" ]; then
-              wrangler=(bunx --bun --no-install wrangler)
+              wrangler=(npx --no-install wrangler)
             else
               wrangler=(npx --no-install wrangler)
             fi
           elif [ -n "$BUILD_SCRIPT" ]; then
-            wrangler=(bunx --bun "wrangler@$WRANGLER_VERSION")
+            wrangler=(npx -y "wrangler@$WRANGLER_VERSION")
           else
             wrangler=(npx -y "wrangler@$WRANGLER_VERSION")
           fi

package/.github/workflows/release.yml

@@ -260,7 +260,7 @@ jobs:
               --state open \
               --base main \
               --json number,headRefName \
-              --jq '.[] | select(.headRefName | startswith("release-please--branches--main")) | .number'
+              --jq '.[] | select(.headRefName == "release-please--branches--main" or (.headRefName | startswith("release-please--branches--main--"))) | .number'
           )
 
           if [ ${#release_prs[@]} -eq 0 ]; then
@@ -301,71 +301,40 @@ jobs:
               --state open \
               --base main \
               --json number,title,headRefName \
-              --jq '.[] | select(.title | startswith("chore(main): release ")) | select(.headRefName | startswith("release-please--branches--main")) | .number'
+              --jq '.[] | select(.title | startswith("chore(main): release ")) | select(.headRefName == "release-please--branches--main" or (.headRefName | startswith("release-please--branches--main--"))) | .number'
           )
           if [ "${#release_prs[@]}" -eq 0 ]; then
             echo 'No generated release pull request is open; nothing to merge.'
             exit 0
           fi
-          node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release validate-prs
+          release_validation=$(node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release validate-prs)
+          printf '%s\n' "$release_validation"
           for pr in "${release_prs[@]}"; do
-            # GitHub's merge state is the authoritative required-check gate.
-            # `gh pr checks --required` is not reliable for ruleset-backed
-            # required contexts in private repositories: it can return an
-            # empty result even while the required aggregate check is present
-            # and green. Polling mergeStateStatus avoids that discovery race;
-            # GitHub reports MERGEABLE only after branch policy permits the
-            # requested merge strategy. Non-required checks may leave the PR
-            # UNSTABLE, so accept that state only with mergeable MERGEABLE.
-            echo "Waiting for release PR #$pr to become mergeable under branch policy"
-            merge_state=UNKNOWN
-            mergeable=UNKNOWN
-            for attempt in $(seq 1 90); do
-              : "$attempt"
-              if read -r merge_state mergeable < <(
-                gh pr view "$pr" \
-                  --repo "$GITHUB_REPOSITORY" \
-                  --json mergeStateStatus,mergeable \
-                  --jq '[.mergeStateStatus, .mergeable] | @tsv' 2>/dev/null
-              ); then
-                case "$merge_state" in
-                  CLEAN|UNSTABLE)
-                    if [ "$mergeable" = MERGEABLE ]; then
-                      break
-                    fi
-                    ;;
-                  DIRTY)
-                    echo "Release PR #$pr is not mergeable (mergeStateStatus=$merge_state); resolve conflicts before retrying the release." >&2
-                    exit 1
-                    ;;
-                esac
-                if [ "$mergeable" = CONFLICTING ]; then
-                  echo "Release PR #$pr is not mergeable (mergeable=$mergeable); resolve conflicts before retrying the release." >&2
-                  exit 1
-                fi
-              else
-                # gh API failure: read leaves the variables empty on EOF;
-                # treat the state as unknown and keep polling.
-                merge_state=UNKNOWN
-                mergeable=UNKNOWN
-              fi
-              sleep 10
-            done
-            if { [ "$merge_state" != CLEAN ] && [ "$merge_state" != UNSTABLE ]; } || [ "$mergeable" != MERGEABLE ]; then
-              echo "Release PR #$pr did not become mergeable within the mergeability window (last mergeStateStatus=$merge_state, mergeable=$mergeable). Required checks may still be pending or branch policy blocks the merge; review the pull request before retrying." >&2
-              exit 1
-            fi
-            release_head=$(gh pr view "$pr" \
+            # Keep the generated-PR audit above, then let GitHub wait for the
+            # actual branch policy. A synchronous poll here made a healthy
+            # release fail when required workflows outlasted the runner's
+            # mergeability window. --auto does not bypass checks or reviews;
+            # GitHub merges only after every required condition is satisfied.
+            echo "Requesting branch-policy-gated auto-merge for release PR #$pr"
+            release_head=$(jq -er --arg number "$pr" \
+              '.generated[] | select((.number | tostring) == $number) | .headRefOid | strings | select(length > 0)' \
+              <<< "$release_validation")
+            current_release_head=$(gh pr view "$pr" \
               --repo "$GITHUB_REPOSITORY" \
               --json headRefOid \
               --jq '.headRefOid')
-            if [ -z "$release_head" ]; then
-              echo "Could not resolve head commit SHA for release PR #$pr" >&2
+            if [ -z "$release_head" ] || [ "$current_release_head" != "$release_head" ]; then
+              echo "Release PR #$pr changed after its path diff was validated; refusing to enqueue a stale validation result." >&2
               exit 1
             fi
+            # --match-head-commit binds this queue request. GitHub may keep
+            # auto-merge enabled if Release Please later updates the branch;
+            # the latest head must still pass the required Validation / Gate,
+            # including its release-diff policy, before GitHub can merge it.
             gh pr merge "$pr" \
               --repo "$GITHUB_REPOSITORY" \
               --${{ steps.profile.outputs.release_merge_strategy }} \
+              --auto \
               --match-head-commit "$release_head" \
               --delete-branch
           done

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.33.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.2...v1.33.3) (2026-09-29)
+
+
+### Bug Fixes
+
+* **ci:** launch wrangler under Node in the cloudflare deploy step ([#649](https://github.com/0xPlayerOne/code-foundry/issues/649)) ([e797934](https://github.com/0xPlayerOne/code-foundry/commit/e7979343d3ff4d1fe5dc1520568a501cce0c47f3))
+
+## [1.33.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.1...v1.33.2) (2026-09-26)
+
+
+### Bug Fixes
+
+* **release:** queue version PR merges on branch policy ([#646](https://github.com/0xPlayerOne/code-foundry/issues/646)) ([ca492c8](https://github.com/0xPlayerOne/code-foundry/commit/ca492c8402bfc43ef718c0a6443ee06fcb33e957))
+
 ## [1.33.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.33.0...v1.33.1) (2026-09-25)
 
 

package/docs/RELEASES.md

@@ -128,15 +128,29 @@ repository or organization secret to enable guarded
 automatic merging and downstream workflows triggered by the resulting
 release. The token needs `contents`, `issues`, and `pull-requests` write
 permissions. Code Foundry validates every changed path in the generated
-version pull request before using the token to merge it, waits for the
-required checks to finish, and then polls the pull request's
-`mergeStateStatus` until it is `CLEAN`, or `UNSTABLE` with `mergeable`
-`MERGEABLE`, before merging. Non-required checks that branch policy does not
-require (for example external code review still running after every required
-check passed) do not block the merge; conflicts fail immediately and a bounded
-polling window fails closed if branch or ruleset policy still blocks the merge
-(a ruleset may register additional required checks after earlier ones have
-already passed).
+version pull request before requesting its merge with GitHub's auto-merge
+feature and the configured canonical method (`squash` for `direct`, `rebase`
+for `staging-release`). GitHub performs the merge only after the branch's
+required checks and reviews pass; the release runner exits after submitting
+that request rather than waiting for every workflow to finish. This keeps a
+healthy release from failing just because required checks outlast a bounded
+runner-side wait. No checks, reviews, or branch rules are bypassed. The
+request uses the exact head SHA returned by Code Foundry's path audit and is
+refused if the branch changed during that audit.
+
+Repositories using a valid `CODE_FOUNDRY_TOKEN` must allow auto-merge in their
+GitHub settings when release checks may still be pending. GitHub rejects the
+request if auto-merge is unavailable. If the PR is already eligible, the same
+command merges it immediately under branch policy. A head change detected
+between the path audit and enqueueing fails the release job. Conflicts remain
+subject to GitHub's branch policy and keep the merge from completing until
+resolved. GitHub's
+automatic head-branch deletion setting removes branches after deferred merges;
+the CLI's `--delete-branch` option also removes a branch when the merge completes
+immediately. GitHub can keep auto-merge enabled if a later Release Please run
+updates the branch. With the documented required `Validation / Gate`, each
+synchronized head reruns the release-diff policy, and GitHub waits for that
+head's required checks before merging.
 
 ## Operational checklist
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.33.1",
+  "version": "1.33.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/release.mjs

@@ -783,7 +783,7 @@ export function validateReleasePullRequestDiffs(root) {
       '--base',
       'main',
       '--json',
-      'number,title,headRefName',
+      'number,title,headRefName,headRefOid',
     ])
     prs = Array.isArray(result) ? result : []
     if (selectGeneratedReleasePrs(prs).length) break
@@ -792,6 +792,8 @@ export function validateReleasePullRequestDiffs(root) {
   const generated = selectGeneratedReleasePrs(Array.isArray(prs) ? prs : [])
   /** @type {Map<number, string[]>} */
   const paths = new Map()
+  /** @type {string[]} */
+  const headErrors = []
   for (const pr of generated) {
     const number = Number(pr.number)
     const result = spawnSync(
@@ -800,12 +802,36 @@ export function validateReleasePullRequestDiffs(root) {
       { cwd: resolve(root), encoding: 'utf8' }
     )
     paths.set(number, result.status === 0 ? result.stdout.split(/\r?\n/).filter(Boolean) : [])
+
+    const auditedHead = typeof pr.headRefOid === 'string' ? pr.headRefOid : ''
+    const currentPr = ghJson(root, [
+      'pr',
+      'view',
+      String(number),
+      '--repo',
+      repository,
+      '--json',
+      'headRefOid',
+    ])
+    const currentHead =
+      currentPr && typeof currentPr === 'object' && !Array.isArray(currentPr)
+        ? /** @type {{ headRefOid?: unknown }} */ (currentPr).headRefOid
+        : undefined
+    if (!auditedHead || currentHead !== auditedHead) {
+      headErrors.push(
+        `Generated release PR #${number} changed head while its path diff was being validated; rerun release validation before merging.`
+      )
+    }
   }
   const validation = validateReleasePullRequests(
     Array.isArray(prs) ? prs : [],
     paths,
     approvedReleaseFiles(readReleaseConfig(root))
   )
+  if (headErrors.length) {
+    validation.valid = false
+    validation.errors.push(...headErrors)
+  }
   console.log(JSON.stringify(validation, null, 2))
   if (!validation.valid) throw new Error(validation.errors.join(' '))
   return validation

package/src/lib/release-policy.mjs

@@ -173,18 +173,18 @@ export function selectReleaseCredential(input) {
   return { token: '', source: 'missing', autoMerge: false }
 }
 
-/** @param {Array<{number?: number, title?: string, headRefName?: string}>} prs */
+/** @param {Array<{number?: number, title?: string, headRefName?: string, headRefOid?: string}>} prs */
 export function selectGeneratedReleasePrs(prs) {
   return prs.filter(
     (pr) =>
       String(pr.title ?? '').startsWith('chore(main): release ') &&
-      String(pr.headRefName ?? '').startsWith('release-please--branches--main')
+      isReleasePleaseHead(pr.headRefName)
   )
 }
 
 /**
  * Validate all generated release PR diffs before any merge is attempted.
- * @param {Array<{number?: number, title?: string, headRefName?: string}>} prs
+ * @param {Array<{number?: number, title?: string, headRefName?: string, headRefOid?: string}>} prs
  * @param {Map<number, string[]>} changedPathsByPr
  * @param {Set<string>} allowed
  */