code-foundry 1.39.3 → 1.41.0

package/.github/CONTRIBUTING.md

@@ -221,7 +221,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |
 | Scheduled or manual validation                     | Full audit tier                                                                       |
 | Push to a working branch                           | Draft PR workflow                                                                     |
-| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |
+| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |
 
 Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 

package/.github/workflows/validation_self-ci.yml

@@ -101,10 +101,15 @@ jobs:
 
   # CodeQL requires a push analysis to populate default-branch code-scanning
   # alerts. Keep the full validation gate pull-request-only so main pushes do
-  # not duplicate CI, test, or security work.
+  # not duplicate CI, test, or security work. Release Please version merges
+  # change manifests only, so the code tree is identical to the content merge
+  # whose default-branch scan is still current; re-scanning it on every release
+  # wastes the Rust-heavy analysis budget, and the scheduled audit covers drift.
   default-branch-codeql:
     name: CodeQL (default branch)
-    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push'
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push' &&
+      !startsWith(github.event.head_commit.message, 'chore(main): release ')
     permissions:
       actions: read
       contents: read

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.41.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.40.0...v1.41.0) (2026-10-02)
+
+
+### Features
+
+* **validation:** skip default-branch CodeQL on release-please merges ([#694](https://github.com/0xPlayerOne/code-foundry/issues/694)) ([25fc22e](https://github.com/0xPlayerOne/code-foundry/commit/25fc22e6d4b76f0b7e06601f6dc420085949f127))
+
+
+### Bug Fixes
+
+* give the release artifact budgets several releases of headroom ([#696](https://github.com/0xPlayerOne/code-foundry/issues/696)) ([a504607](https://github.com/0xPlayerOne/code-foundry/commit/a504607e16f097a5075191fd24cb26953b06a340))
+
+## [1.40.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.3...v1.40.0) (2026-10-02)
+
+
+### Features
+
+* **sync:** add dependency_updater setting to gate Dependabot and scaffold Renovate ([#692](https://github.com/0xPlayerOne/code-foundry/issues/692)) ([15805de](https://github.com/0xPlayerOne/code-foundry/commit/15805dee09a93ca168bbc00dbc3c3af36a40e7bf))
+
 ## [1.39.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.39.2...v1.39.3) (2026-10-01)
 
 

package/docs/CONFIGURATION.md

@@ -34,21 +34,22 @@ to require an existing mise configuration.
 
 ## Repository and runtime
 
-| Key                     | Values                                       | Notes                                                                |
-| ----------------------- | -------------------------------------------- | -------------------------------------------------------------------- |
-| `version`               | `1`                                          | Configuration schema version.                                        |
-| `profile`               | `auto`, `application`, `monorepo`, `minimal` | Repository shape; `auto` detects it.                                 |
-| `languages`             | comma-separated language names               | Supported values are `typescript`, `rust`, `python`, and `solidity`. |
-| `package_manager`       | `bun`, `pnpm`, `yarn`, `npm`, `none`         | JavaScript package-manager policy.                                   |
-| `toolchain`             | `auto`, `native`, `mise`                     | Environment setup policy.                                            |
-| `runtime_repository`    | `OWNER/REPO`                                 | Source of reusable workflows and runtime code.                       |
-| `runtime_ref`           | tag or commit                                | Runtime version used by generated callers.                           |
-| `features`              | `all` or a list                              | See [Feature selection](#feature-selection).                         |
-| `draft_protection`      | `true`, `false`                              | Skip generated runner-heavy gates for draft PRs when false.          |
-| `billing_paused`        | `true`, `false`                              | Disable Dependabot version updates while CI billing is paused.       |
-| `codeql`                | `auto`, `true`, `false`                      | Enable CodeQL when the repository and GitHub plan support it.        |
-| `dependency_review`     | `auto`, `true`, `false`                      | Enable Dependency Review when supported.                             |
-| `runner` and `*_runner` | GitHub runner labels                         | Override the default runner per workflow.                            |
+| Key                     | Values                                       | Notes                                                                                  |
+| ----------------------- | -------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `version`               | `1`                                          | Configuration schema version.                                                          |
+| `profile`               | `auto`, `application`, `monorepo`, `minimal` | Repository shape; `auto` detects it.                                                   |
+| `languages`             | comma-separated language names               | Supported values are `typescript`, `rust`, `python`, and `solidity`.                   |
+| `package_manager`       | `bun`, `pnpm`, `yarn`, `npm`, `none`         | JavaScript package-manager policy.                                                     |
+| `toolchain`             | `auto`, `native`, `mise`                     | Environment setup policy.                                                              |
+| `runtime_repository`    | `OWNER/REPO`                                 | Source of reusable workflows and runtime code.                                         |
+| `runtime_ref`           | tag or commit                                | Runtime version used by generated callers.                                             |
+| `features`              | `all` or a list                              | See [Feature selection](#feature-selection).                                           |
+| `draft_protection`      | `true`, `false`                              | Skip generated runner-heavy gates for draft PRs when false.                            |
+| `billing_paused`        | `true`, `false`                              | Disable Dependabot version updates while CI billing is paused.                         |
+| `dependency_updater`    | `dependabot`, `renovate`, `none`             | Which dependency-update bot sync manages; see [Feature selection](#feature-selection). |
+| `codeql`                | `auto`, `true`, `false`                      | Enable CodeQL when the repository and GitHub plan support it.                          |
+| `dependency_review`     | `auto`, `true`, `false`                      | Enable Dependency Review when supported.                                               |
+| `runner` and `*_runner` | GitHub runner labels                         | Override the default runner per workflow.                                              |
 
 For `codeql: auto` and `dependency_review: auto`, public repositories use the
 available GitHub security checks and private repositories require the relevant
@@ -82,6 +83,22 @@ remain aliases for compatibility. Other selectable features are:
 - `release` — run Release Please and optional package publication.
 - `dependabot` — install the language-aware Dependabot configuration.
 
+The `dependency_updater` key selects which dependency-update bot `sync`
+manages, and an explicit value wins over the `dependabot` feature (including
+`features: all`):
+
+- `dependabot` (default) — render `.github/dependabot.yml` whenever the
+  `dependabot` feature is selected; existing repositories are unaffected.
+- `renovate` — never render `.github/dependabot.yml` and remove an existing
+  one; install `renovate.json` from the runtime template only when the
+  repository has none. A repository-owned `renovate.json` is never modified.
+- `none` — never render `.github/dependabot.yml`, remove an existing one, and
+  install nothing.
+
+Installing `renovate.json` does not schedule update runs: a repository still
+needs the Renovate GitHub App or a self-hosted runner. The `billing_paused`
+Dependabot pause applies only while `dependency_updater` is `dependabot`.
+
 The release-integrity and OpenCode Security callers are installed independently
 of feature selection. OpenCode Security is disabled unless the repository or
 organization variable `OPENCODE_SECURITY` is `true` and the

package/docs/WORKFLOWS.md

@@ -141,7 +141,9 @@ While paused, set `billing_paused: true` in `.github/code-foundry.yml` and run a
 sync so the rendered `dependabot.yml` disables version updates
 (`open-pull-requests-limit: 0`, monthly cadence). Remove the flag and sync to
 restore updates when billing resumes. `npx code-foundry ci status` reports the
-Dependabot state, and `pause` warns when updates are still active.
+Dependabot state, and `pause` warns when updates are still active. A repository
+whose `dependency_updater` is `renovate` or `none` has no Dependabot
+configuration to pause.
 
 ## Standard workflow responsibilities
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.39.3",
+  "version": "1.41.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -145,6 +145,14 @@ function synchronize(options) {
   if (!['true', 'false'].includes(draftProtection)) {
     throw new Error(`Unsupported draft_protection: ${draftProtection}; use true or false.`)
   }
+  // Validate the dependency-update bot policy before any sync writes so a
+  // typo fails fast instead of leaving a half-switched updater behind.
+  const dependencyUpdater = configured(config.dependency_updater, 'dependabot')
+  if (!['renovate', 'dependabot', 'none'].includes(dependencyUpdater)) {
+    throw new Error(
+      `Unsupported dependency_updater: ${dependencyUpdater}; use renovate, dependabot, or none.`
+    )
+  }
   const obsoleteConfigKeys = [
     'opencode_security',
     ...(workflow === 'direct' ? ['staging_validation_mode'] : []),
@@ -335,6 +343,33 @@ function synchronize(options) {
     }
   }
 
+  // `dependency_updater` owns the dependency-update bot contract, and an
+  // explicit value wins over the features gate above: a repository that
+  // leaves Dependabot must not keep a previously rendered dependabot.yml,
+  // and a Renovate repository gets a config only when it does not already
+  // own one (repository-owned renovate.json is never modified).
+  if (dependencyUpdater !== 'dependabot') {
+    const destination = join(target, '.github/dependabot.yml')
+    if (existsSync(destination)) {
+      changed.push('.github/dependabot.yml')
+      if (dryRun)
+        console.log(
+          `Would remove .github/dependabot.yml; dependency_updater selects ${dependencyUpdater}.`
+        )
+      else rmSync(destination, { force: true })
+    }
+  }
+  if (dependencyUpdater === 'renovate') {
+    const destination = join(target, 'renovate.json')
+    if (!existsSync(destination)) {
+      const template = join(source, 'src/templates/renovate.json')
+      if (!existsSync(template))
+        throw new Error('Template file missing: src/templates/renovate.json')
+      changed.push('renovate.json')
+      writeOrReport(destination, readFileSync(template), dryRun)
+    }
+  }
+
   // Preserved (repository-owned) workflows may reference the runtime directly,
   // for example a hand-maintained Cloudflare preview caller. Advance their
   // plain semver pins to the synced runtime ref so a stale hand-added pin
@@ -591,7 +626,11 @@ function shouldInclude(file, languages, features, config) {
   if (file === 'ruff.toml') return includesValue(languages, 'python')
   if (file === '.oxfmtrc.json' || file === '.oxlintrc.json')
     return includesValue(languages, 'typescript')
-  if (file === '.github/dependabot.yml') return includesValue(features, 'dependabot')
+  if (file === '.github/dependabot.yml')
+    return (
+      configured(config.dependency_updater, 'dependabot') === 'dependabot' &&
+      includesValue(features, 'dependabot')
+    )
   // The OpenCode Security caller is installed in every repository so the
   // OPENCODE_SECURITY repository variable can opt a repository in (or out)
   // without a configuration change. The detect job keeps the scan off unless
@@ -1017,8 +1056,8 @@ const DIRECT_DOC_REPLACEMENTS = {
       '7. Push to the fork and open a pull request targeting `main`.',
     ],
     [
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |\n',
-      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow plus default-branch CodeQL scan; validation ran on the merged PR     |\n',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |\n',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',

package/src/templates/renovate.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "draftPR": true,
+  "labels": ["dependencies"],
+  "packageRules": [
+    {
+      "description": "Non-major dependency updates ride one grouped draft PR per cycle.",
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+      "groupName": "non-major dependency updates"
+    },
+    {
+      "description": "Major dependency bumps share one grouped draft PR per cycle so a batch reads as one upgrade decision.",
+      "matchUpdateTypes": ["major"],
+      "groupName": "major dependency updates"
+    }
+  ]
+}