code-foundry 1.39.2 → 1.40.0

package/.githooks/pre-commit

@@ -6,8 +6,15 @@ if [ -z "$(git diff --cached --name-only)" ]; then
   exit 0
 fi
 
-if command -v npx >/dev/null 2>&1 && npx --yes code-foundry@__VERSION__ pre-commit; then
-  exit 0
+# Prefer a runtime the repository already depends on. A repository opts into
+# the gate by depending on code-foundry; one that does not keeps the
+# whitespace guard and stays offline. Nothing is fetched at commit time.
+if [ -x node_modules/.bin/code-foundry ]; then
+  exec node_modules/.bin/code-foundry pre-commit
+fi
+
+if [ -f src/runtime.mjs ]; then
+  exec node src/runtime.mjs pre-commit
 fi
 
 git diff --cached --check

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.40.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.3...v1.40.0) (2026-10-02)
+
+
+### Features
+
+* **sync:** add dependency_updater setting to gate Dependabot and scaffold Renovate ([#692](https://github.com/0xPlayerOne/code-foundry/issues/692)) ([15805de](https://github.com/0xPlayerOne/code-foundry/commit/15805dee09a93ca168bbc00dbc3c3af36a40e7bf))
+
+## [1.39.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.2...v1.39.3) (2026-10-01)
+
+
+### Bug Fixes
+
+* **hooks:** run the gate from a local dependency, not npx ([#688](https://github.com/0xPlayerOne/code-foundry/issues/688)) ([d256b69](https://github.com/0xPlayerOne/code-foundry/commit/d256b69b8f89f0041a01c53cc51af32fe582b5dc))
+
 ## [1.39.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.1...v1.39.2) (2026-10-01)
 
 

package/docs/CONFIGURATION.md

@@ -34,21 +34,22 @@ to require an existing mise configuration.
 
 ## Repository and runtime
 
-| Key                     | Values                                       | Notes                                                                |
-| ----------------------- | -------------------------------------------- | -------------------------------------------------------------------- |
-| `version`               | `1`                                          | Configuration schema version.                                        |
-| `profile`               | `auto`, `application`, `monorepo`, `minimal` | Repository shape; `auto` detects it.                                 |
-| `languages`             | comma-separated language names               | Supported values are `typescript`, `rust`, `python`, and `solidity`. |
-| `package_manager`       | `bun`, `pnpm`, `yarn`, `npm`, `none`         | JavaScript package-manager policy.                                   |
-| `toolchain`             | `auto`, `native`, `mise`                     | Environment setup policy.                                            |
-| `runtime_repository`    | `OWNER/REPO`                                 | Source of reusable workflows and runtime code.                       |
-| `runtime_ref`           | tag or commit                                | Runtime version used by generated callers.                           |
-| `features`              | `all` or a list                              | See [Feature selection](#feature-selection).                         |
-| `draft_protection`      | `true`, `false`                              | Skip generated runner-heavy gates for draft PRs when false.          |
-| `billing_paused`        | `true`, `false`                              | Disable Dependabot version updates while CI billing is paused.       |
-| `codeql`                | `auto`, `true`, `false`                      | Enable CodeQL when the repository and GitHub plan support it.        |
-| `dependency_review`     | `auto`, `true`, `false`                      | Enable Dependency Review when supported.                             |
-| `runner` and `*_runner` | GitHub runner labels                         | Override the default runner per workflow.                            |
+| Key                     | Values                                       | Notes                                                                                  |
+| ----------------------- | -------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `version`               | `1`                                          | Configuration schema version.                                                          |
+| `profile`               | `auto`, `application`, `monorepo`, `minimal` | Repository shape; `auto` detects it.                                                   |
+| `languages`             | comma-separated language names               | Supported values are `typescript`, `rust`, `python`, and `solidity`.                   |
+| `package_manager`       | `bun`, `pnpm`, `yarn`, `npm`, `none`         | JavaScript package-manager policy.                                                     |
+| `toolchain`             | `auto`, `native`, `mise`                     | Environment setup policy.                                                              |
+| `runtime_repository`    | `OWNER/REPO`                                 | Source of reusable workflows and runtime code.                                         |
+| `runtime_ref`           | tag or commit                                | Runtime version used by generated callers.                                             |
+| `features`              | `all` or a list                              | See [Feature selection](#feature-selection).                                           |
+| `draft_protection`      | `true`, `false`                              | Skip generated runner-heavy gates for draft PRs when false.                            |
+| `billing_paused`        | `true`, `false`                              | Disable Dependabot version updates while CI billing is paused.                         |
+| `dependency_updater`    | `dependabot`, `renovate`, `none`             | Which dependency-update bot sync manages; see [Feature selection](#feature-selection). |
+| `codeql`                | `auto`, `true`, `false`                      | Enable CodeQL when the repository and GitHub plan support it.                          |
+| `dependency_review`     | `auto`, `true`, `false`                      | Enable Dependency Review when supported.                                               |
+| `runner` and `*_runner` | GitHub runner labels                         | Override the default runner per workflow.                                              |
 
 For `codeql: auto` and `dependency_review: auto`, public repositories use the
 available GitHub security checks and private repositories require the relevant
@@ -82,6 +83,22 @@ remain aliases for compatibility. Other selectable features are:
 - `release` — run Release Please and optional package publication.
 - `dependabot` — install the language-aware Dependabot configuration.
 
+The `dependency_updater` key selects which dependency-update bot `sync`
+manages, and an explicit value wins over the `dependabot` feature (including
+`features: all`):
+
+- `dependabot` (default) — render `.github/dependabot.yml` whenever the
+  `dependabot` feature is selected; existing repositories are unaffected.
+- `renovate` — never render `.github/dependabot.yml` and remove an existing
+  one; install `renovate.json` from the runtime template only when the
+  repository has none. A repository-owned `renovate.json` is never modified.
+- `none` — never render `.github/dependabot.yml`, remove an existing one, and
+  install nothing.
+
+Installing `renovate.json` does not schedule update runs: a repository still
+needs the Renovate GitHub App or a self-hosted runner. The `billing_paused`
+Dependabot pause applies only while `dependency_updater` is `dependabot`.
+
 The release-integrity and OpenCode Security callers are installed independently
 of feature selection. OpenCode Security is disabled unless the repository or
 organization variable `OPENCODE_SECURITY` is `true` and the

package/docs/WORKFLOWS.md

@@ -141,7 +141,9 @@ While paused, set `billing_paused: true` in `.github/code-foundry.yml` and run a
 sync so the rendered `dependabot.yml` disables version updates
 (`open-pull-requests-limit: 0`, monthly cadence). Remove the flag and sync to
 restore updates when billing resumes. `npx code-foundry ci status` reports the
-Dependabot state, and `pause` warns when updates are still active.
+Dependabot state, and `pause` warns when updates are still active. A repository
+whose `dependency_updater` is `renovate` or `none` has no Dependabot
+configuration to pause.
 
 ## Standard workflow responsibilities
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.39.2",
+  "version": "1.40.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -145,6 +145,14 @@ function synchronize(options) {
   if (!['true', 'false'].includes(draftProtection)) {
     throw new Error(`Unsupported draft_protection: ${draftProtection}; use true or false.`)
   }
+  // Validate the dependency-update bot policy before any sync writes so a
+  // typo fails fast instead of leaving a half-switched updater behind.
+  const dependencyUpdater = configured(config.dependency_updater, 'dependabot')
+  if (!['renovate', 'dependabot', 'none'].includes(dependencyUpdater)) {
+    throw new Error(
+      `Unsupported dependency_updater: ${dependencyUpdater}; use renovate, dependabot, or none.`
+    )
+  }
   const obsoleteConfigKeys = [
     'opencode_security',
     ...(workflow === 'direct' ? ['staging_validation_mode'] : []),
@@ -260,9 +268,6 @@ function synchronize(options) {
     if (file === 'LICENSE' && license !== 'preserve' && license !== 'none') continue
     if (file === '.github/CODEOWNERS' && existsSync(destination)) continue
     let content = readFileSync(sourceFile)
-    if (file === '.githooks/pre-commit') {
-      content = Buffer.from(renderHook(sourceFile, source))
-    }
     if (file === 'release-please-config.json') {
       content = Buffer.from(renderReleaseConfig(target, sourceFile))
     }
@@ -338,6 +343,33 @@ function synchronize(options) {
     }
   }
 
+  // `dependency_updater` owns the dependency-update bot contract, and an
+  // explicit value wins over the features gate above: a repository that
+  // leaves Dependabot must not keep a previously rendered dependabot.yml,
+  // and a Renovate repository gets a config only when it does not already
+  // own one (repository-owned renovate.json is never modified).
+  if (dependencyUpdater !== 'dependabot') {
+    const destination = join(target, '.github/dependabot.yml')
+    if (existsSync(destination)) {
+      changed.push('.github/dependabot.yml')
+      if (dryRun)
+        console.log(
+          `Would remove .github/dependabot.yml; dependency_updater selects ${dependencyUpdater}.`
+        )
+      else rmSync(destination, { force: true })
+    }
+  }
+  if (dependencyUpdater === 'renovate') {
+    const destination = join(target, 'renovate.json')
+    if (!existsSync(destination)) {
+      const template = join(source, 'src/templates/renovate.json')
+      if (!existsSync(template))
+        throw new Error('Template file missing: src/templates/renovate.json')
+      changed.push('renovate.json')
+      writeOrReport(destination, readFileSync(template), dryRun)
+    }
+  }
+
   // Preserved (repository-owned) workflows may reference the runtime directly,
   // for example a hand-maintained Cloudflare preview caller. Advance their
   // plain semver pins to the synced runtime ref so a stale hand-added pin
@@ -589,26 +621,16 @@ function renderReleaseConfig(target, sourceFile) {
   return `${JSON.stringify(mergeReleaseConfig(target, sourceFile), null, 2)}\n`
 }
 
-/**
- * The hook runs `npx code-foundry@<version>` on every commit, so the version
- * is substituted at generation time rather than resolved at run time. A
- * mutable dist-tag there would let any publish under that tag run code on
- * every developer's machine at commit time; pinning means the gate a
- * repository received is the gate that generated it.
- *
- * @param {string} sourceFile the template path
- * @param {string} sourceRoot the package root that carries package.json
- */
-function renderHook(sourceFile, sourceRoot) {
-  return readFileSync(sourceFile, 'utf8').replaceAll('__VERSION__', readPackageVersion(sourceRoot))
-}
-
 /** @param {string} file @param {string} languages @param {string} features @param {Record<string, string>} config */
 function shouldInclude(file, languages, features, config) {
   if (file === 'ruff.toml') return includesValue(languages, 'python')
   if (file === '.oxfmtrc.json' || file === '.oxlintrc.json')
     return includesValue(languages, 'typescript')
-  if (file === '.github/dependabot.yml') return includesValue(features, 'dependabot')
+  if (file === '.github/dependabot.yml')
+    return (
+      configured(config.dependency_updater, 'dependabot') === 'dependabot' &&
+      includesValue(features, 'dependabot')
+    )
   // The OpenCode Security caller is installed in every repository so the
   // OPENCODE_SECURITY repository variable can opt a repository in (or out)
   // without a configuration change. The detect job keeps the scan off unless

package/src/templates/renovate.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "draftPR": true,
+  "labels": ["dependencies"],
+  "packageRules": [
+    {
+      "description": "Non-major dependency updates ride one grouped draft PR per cycle.",
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+      "groupName": "non-major dependency updates"
+    },
+    {
+      "description": "Major dependency bumps share one grouped draft PR per cycle so a batch reads as one upgrade decision.",
+      "matchUpdateTypes": ["major"],
+      "groupName": "major dependency updates"
+    }
+  ]
+}