code-foundry 1.36.2 → 1.36.4

package/.github/dependabot.yml

@@ -17,7 +17,7 @@ updates:
       github-actions:
         applies-to: version-updates
         patterns: ['*']
-  - package-ecosystem: npm
+  - package-ecosystem: bun
     directory: /
     target-branch: staging
     schedule:
@@ -25,7 +25,7 @@ updates:
       day: sunday
     open-pull-requests-limit: 99
     groups:
-      npm-dependencies:
+      bun-dependencies:
         applies-to: version-updates
         patterns: ['*']
     ignore:

package/.github/workflows/cloudflare-deploy.yml

@@ -306,7 +306,11 @@ jobs:
               # Previews refuse a production Build Output; rebuild flagged as
               # a preview build first.
               CLOUDFLARE_PREVIEW_BUILD=true cf-wrangler build --mode preview
-              cf previews deploy "$PREVIEW_NAME" > "$RUNNER_TEMP/cf-preview.json"
+              # --prebuilt: the preview Build Output was just produced above,
+              # and previews deploy otherwise re-runs the framework's own
+              # build, which not every project tolerates (e.g. Vite plugin
+              # configPath vs newConfig).
+              cf previews deploy --prebuilt "$PREVIEW_NAME" > "$RUNNER_TEMP/cf-preview.json"
               value="$(jq -r '.preview_urls[0] // empty' "$RUNNER_TEMP/cf-preview.json")"
               version_id="$(jq -r '.deployment_id // empty' "$RUNNER_TEMP/cf-preview.json")"
             fi

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.36.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.3...v1.36.4) (2026-09-29)
+
+
+### Bug Fixes
+
+* **cloudflare:** deploy previews from the prebuilt Preview Build Output ([#664](https://github.com/0xPlayerOne/code-foundry/issues/664)) ([34966ea](https://github.com/0xPlayerOne/code-foundry/commit/34966ea3917c145c441a460c741c125c60f84d25))
+
+## [1.36.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.2...v1.36.3) (2026-09-29)
+
+
+### Maintenance
+
+* track the JavaScript Dependabot ecosystem as bun by default ([#648](https://github.com/0xPlayerOne/code-foundry/issues/648)) ([6aa9712](https://github.com/0xPlayerOne/code-foundry/commit/6aa9712904340a7e4783f697a0e02d2be6ab1dce))
+
 ## [1.36.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.36.1...v1.36.2) (2026-09-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.36.2",
+  "version": "1.36.4",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -818,11 +818,13 @@ function removeWorkflowBlock(content, blockId) {
 
 /**
  * Dependabot updates land on the repository's integration branch. Direct
- * repositories have no staging branch, so every update targets main. Cargo,
- * npm, and pip updates are emitted only when Rust, TypeScript, or Python is
- * part of the configured language set, respectively; weekly updater runs
- * fail when an ecosystem has no manifests to read, so unconfigured
- * ecosystems are dropped instead of left to error.
+ * repositories have no staging branch, so every update targets main. The
+ * JavaScript ecosystem block ships as `bun` (the fleet default) and is
+ * retargeted to `npm` for consumers whose `package_manager` is npm; Cargo,
+ * the JavaScript block, and pip updates are emitted only when Rust,
+ * TypeScript, or Python is part of the configured language set,
+ * respectively; weekly updater runs fail when an ecosystem has no manifests
+ * to read, so unconfigured ecosystems are dropped instead of left to error.
  *
  * The billing pause must also cover Dependabot: its update runs execute as
  * Actions workflows under the `dynamic` event, so the `CI_BILLING_PAUSED`
@@ -843,11 +845,20 @@ export function renderDependabot(content, config, languages) {
     rendered = stripDependabotEcosystem(rendered, 'cargo')
   }
   if (!includesValue(languages, 'typescript')) {
-    rendered = stripDependabotEcosystem(rendered, 'npm')
+    rendered = stripDependabotEcosystem(rendered, 'bun')
   }
   if (!includesValue(languages, 'python')) {
     rendered = stripDependabotEcosystem(rendered, 'pip')
   }
+  if (
+    includesValue(languages, 'typescript') &&
+    configured(config.package_manager, 'bun') === 'npm'
+  ) {
+    // The template tracks the fleet's bun majority; an npm-locked consumer
+    // needs the npm ecosystem or Dependabot fails with misconfigured_tooling
+    // (it cannot read bun.lock).
+    rendered = swapBunEcosystemForNpm(rendered)
+  }
   if (configured(config.billing_paused, 'false') === 'true') {
     rendered = pauseDependabot(rendered)
   }
@@ -855,6 +866,19 @@ export function renderDependabot(content, config, languages) {
   return rendered.replaceAll('target-branch: staging', 'target-branch: main')
 }
 
+/**
+ * Retarget the JavaScript ecosystem block to npm for npm-locked consumers.
+ * Exact-string based so template drift fails loudly at Dependabot time
+ * instead of silently scanning the wrong lockfile.
+ * @param {string} content
+ * @returns {string}
+ */
+function swapBunEcosystemForNpm(content) {
+  return content
+    .replace('  - package-ecosystem: bun\n', '  - package-ecosystem: npm\n')
+    .replace('      bun-dependencies:\n', '      npm-dependencies:\n')
+}
+
 /**
  * Disable Dependabot version updates for every remaining ecosystem. The
  * transformations are regex-based so they hold for any ecosystem count and