code-foundry 1.36.1 → 1.36.3

package/.github/dependabot.yml

@@ -17,7 +17,7 @@ updates:
       github-actions:
         applies-to: version-updates
         patterns: ['*']
-  - package-ecosystem: npm
+  - package-ecosystem: bun
     directory: /
     target-branch: staging
     schedule:
@@ -25,7 +25,7 @@ updates:
       day: sunday
     open-pull-requests-limit: 99
     groups:
-      npm-dependencies:
+      bun-dependencies:
         applies-to: version-updates
         patterns: ['*']
     ignore:

package/.github/workflows/cloudflare-deploy.yml

@@ -283,19 +283,30 @@ jobs:
             # cf path: refresh the Build Output with the project's own
             # cf-wrangler delegate, then deploy/preview it with the cf CLI.
             # Both CLIs come from the app's devDependencies installed by the
-            # build step; the Node launcher avoids the Bun-runtime trap.
-            cfbin=(npx --no-install)
-            "${cfbin[@]}" cf-wrangler build
+            # build step. Resolve their bins by walking up from the working
+            # directory: bun hoists workspace bins to arbitrary levels, and
+            # npx's local resolution misses them (then hits the registry,
+            # where cf-wrangler does not exist).
+            binpath="$PWD"
+            while [ "$binpath" != / ]; do
+              [ -d "$binpath/node_modules/.bin" ] && PATH="$binpath/node_modules/.bin:$PATH"
+              binpath=$(dirname "$binpath")
+            done
+            export PATH
+            command -v cf-wrangler >/dev/null || {
+              echo 'cf-wrangler not found: declare cf and wrangler as devDependencies of the deployed package' >&2
+              exit 1
+            }
             if [ "$MODE" = production ]; then
-              out="$("${cfbin[@]}" cf deploy --prebuilt)"
+              out="$(cf deploy --prebuilt)"
               printf '%s\n' "$out"
               version_id="$(printf '%s\n' "$out" | sed -n 's/.*Current Version ID: *//p' | head -1 | tr -d '[:space:]')"
               value="${DEPLOYMENT_URL:-$(printf '%s\n' "$out" | grep -o 'https://[^[:space:]]*' | head -1)}"
             else
               # Previews refuse a production Build Output; rebuild flagged as
               # a preview build first.
-              CLOUDFLARE_PREVIEW_BUILD=true "${cfbin[@]}" cf-wrangler build --mode preview
-              "${cfbin[@]}" cf previews deploy "$PREVIEW_NAME" > "$RUNNER_TEMP/cf-preview.json"
+              CLOUDFLARE_PREVIEW_BUILD=true cf-wrangler build --mode preview
+              cf previews deploy "$PREVIEW_NAME" > "$RUNNER_TEMP/cf-preview.json"
               value="$(jq -r '.preview_urls[0] // empty' "$RUNNER_TEMP/cf-preview.json")"
               version_id="$(jq -r '.deployment_id // empty' "$RUNNER_TEMP/cf-preview.json")"
             fi

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.36.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.2...v1.36.3) (2026-09-29)
+
+
+### Maintenance
+
+* track the JavaScript Dependabot ecosystem as bun by default ([#648](https://github.com/0xPlayerOne/code-foundry/issues/648)) ([6aa9712](https://github.com/0xPlayerOne/code-foundry/commit/6aa9712904340a7e4783f697a0e02d2be6ab1dce))
+
+## [1.36.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.1...v1.36.2) (2026-09-29)
+
+
+### Bug Fixes
+
+* **cloudflare:** resolve cf bins by walking up node_modules/.bin ([#662](https://github.com/0xPlayerOne/code-foundry/issues/662)) ([e82bbe0](https://github.com/0xPlayerOne/code-foundry/commit/e82bbe0a1687b5cc8bf939769e15639f25199969))
+
 ## [1.36.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.0...v1.36.1) (2026-09-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.36.1",
+  "version": "1.36.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -818,11 +818,13 @@ function removeWorkflowBlock(content, blockId) {
 
 /**
  * Dependabot updates land on the repository's integration branch. Direct
- * repositories have no staging branch, so every update targets main. Cargo,
- * npm, and pip updates are emitted only when Rust, TypeScript, or Python is
- * part of the configured language set, respectively; weekly updater runs
- * fail when an ecosystem has no manifests to read, so unconfigured
- * ecosystems are dropped instead of left to error.
+ * repositories have no staging branch, so every update targets main. The
+ * JavaScript ecosystem block ships as `bun` (the fleet default) and is
+ * retargeted to `npm` for consumers whose `package_manager` is npm; Cargo,
+ * the JavaScript block, and pip updates are emitted only when Rust,
+ * TypeScript, or Python is part of the configured language set,
+ * respectively; weekly updater runs fail when an ecosystem has no manifests
+ * to read, so unconfigured ecosystems are dropped instead of left to error.
  *
  * The billing pause must also cover Dependabot: its update runs execute as
  * Actions workflows under the `dynamic` event, so the `CI_BILLING_PAUSED`
@@ -843,11 +845,20 @@ export function renderDependabot(content, config, languages) {
     rendered = stripDependabotEcosystem(rendered, 'cargo')
   }
   if (!includesValue(languages, 'typescript')) {
-    rendered = stripDependabotEcosystem(rendered, 'npm')
+    rendered = stripDependabotEcosystem(rendered, 'bun')
   }
   if (!includesValue(languages, 'python')) {
     rendered = stripDependabotEcosystem(rendered, 'pip')
   }
+  if (
+    includesValue(languages, 'typescript') &&
+    configured(config.package_manager, 'bun') === 'npm'
+  ) {
+    // The template tracks the fleet's bun majority; an npm-locked consumer
+    // needs the npm ecosystem or Dependabot fails with misconfigured_tooling
+    // (it cannot read bun.lock).
+    rendered = swapBunEcosystemForNpm(rendered)
+  }
   if (configured(config.billing_paused, 'false') === 'true') {
     rendered = pauseDependabot(rendered)
   }
@@ -855,6 +866,19 @@ export function renderDependabot(content, config, languages) {
   return rendered.replaceAll('target-branch: staging', 'target-branch: main')
 }
 
+/**
+ * Retarget the JavaScript ecosystem block to npm for npm-locked consumers.
+ * Exact-string based so template drift fails loudly at Dependabot time
+ * instead of silently scanning the wrong lockfile.
+ * @param {string} content
+ * @returns {string}
+ */
+function swapBunEcosystemForNpm(content) {
+  return content
+    .replace('  - package-ecosystem: bun\n', '  - package-ecosystem: npm\n')
+    .replace('      bun-dependencies:\n', '      npm-dependencies:\n')
+}
+
 /**
  * Disable Dependabot version updates for every remaining ecosystem. The
  * transformations are regex-based so they hold for any ecosystem count and