code-foundry 1.36.2 → 1.36.3

package/.github/dependabot.yml

@@ -17,7 +17,7 @@ updates:
       github-actions:
         applies-to: version-updates
         patterns: ['*']
-  - package-ecosystem: npm
+  - package-ecosystem: bun
     directory: /
     target-branch: staging
     schedule:
@@ -25,7 +25,7 @@ updates:
       day: sunday
     open-pull-requests-limit: 99
     groups:
-      npm-dependencies:
+      bun-dependencies:
         applies-to: version-updates
         patterns: ['*']
     ignore:

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.36.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.2...v1.36.3) (2026-09-29)
+
+
+### Maintenance
+
+* track the JavaScript Dependabot ecosystem as bun by default ([#648](https://github.com/0xPlayerOne/code-foundry/issues/648)) ([6aa9712](https://github.com/0xPlayerOne/code-foundry/commit/6aa9712904340a7e4783f697a0e02d2be6ab1dce))
+
 ## [1.36.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.1...v1.36.2) (2026-09-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.36.2",
+  "version": "1.36.3",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -818,11 +818,13 @@ function removeWorkflowBlock(content, blockId) {
 
 /**
  * Dependabot updates land on the repository's integration branch. Direct
- * repositories have no staging branch, so every update targets main. Cargo,
- * npm, and pip updates are emitted only when Rust, TypeScript, or Python is
- * part of the configured language set, respectively; weekly updater runs
- * fail when an ecosystem has no manifests to read, so unconfigured
- * ecosystems are dropped instead of left to error.
+ * repositories have no staging branch, so every update targets main. The
+ * JavaScript ecosystem block ships as `bun` (the fleet default) and is
+ * retargeted to `npm` for consumers whose `package_manager` is npm; Cargo,
+ * the JavaScript block, and pip updates are emitted only when Rust,
+ * TypeScript, or Python is part of the configured language set,
+ * respectively; weekly updater runs fail when an ecosystem has no manifests
+ * to read, so unconfigured ecosystems are dropped instead of left to error.
  *
  * The billing pause must also cover Dependabot: its update runs execute as
  * Actions workflows under the `dynamic` event, so the `CI_BILLING_PAUSED`
@@ -843,11 +845,20 @@ export function renderDependabot(content, config, languages) {
     rendered = stripDependabotEcosystem(rendered, 'cargo')
   }
   if (!includesValue(languages, 'typescript')) {
-    rendered = stripDependabotEcosystem(rendered, 'npm')
+    rendered = stripDependabotEcosystem(rendered, 'bun')
   }
   if (!includesValue(languages, 'python')) {
     rendered = stripDependabotEcosystem(rendered, 'pip')
   }
+  if (
+    includesValue(languages, 'typescript') &&
+    configured(config.package_manager, 'bun') === 'npm'
+  ) {
+    // The template tracks the fleet's bun majority; an npm-locked consumer
+    // needs the npm ecosystem or Dependabot fails with misconfigured_tooling
+    // (it cannot read bun.lock).
+    rendered = swapBunEcosystemForNpm(rendered)
+  }
   if (configured(config.billing_paused, 'false') === 'true') {
     rendered = pauseDependabot(rendered)
   }
@@ -855,6 +866,19 @@ export function renderDependabot(content, config, languages) {
   return rendered.replaceAll('target-branch: staging', 'target-branch: main')
 }
 
+/**
+ * Retarget the JavaScript ecosystem block to npm for npm-locked consumers.
+ * Exact-string based so template drift fails loudly at Dependabot time
+ * instead of silently scanning the wrong lockfile.
+ * @param {string} content
+ * @returns {string}
+ */
+function swapBunEcosystemForNpm(content) {
+  return content
+    .replace('  - package-ecosystem: bun\n', '  - package-ecosystem: npm\n')
+    .replace('      bun-dependencies:\n', '      npm-dependencies:\n')
+}
+
 /**
  * Disable Dependabot version updates for every remaining ecosystem. The
  * transformations are regex-based so they hold for any ecosystem count and