code-foundry 1.44.4 → 1.44.6

package/.github/workflows/release.yml

@@ -187,17 +187,35 @@ jobs:
           # with HTTP 403 even on REST, so the configured automation token is
           # validated against the current repository before any write. gh api
           # authenticates through the GH_TOKEN environment variable and never
-          # prints the token; the
-          # response body is discarded and only the exit status selects the
-          # credential for the rest of the job.
+          # prints the token; the response body is discarded and only the exit
+          # status selects the credential for the rest of the job.
+          #
+          # Reading the repository does not imply the write this workflow
+          # needs: fine-grained tokens can pass the read probe and even create
+          # draft releases while the git-refs endpoint still rejects them, and
+          # release-please creates the release tag through that endpoint when
+          # the manifest config enables force-tag-creation. Probe the write
+          # directly with a throwaway tag on the current commit; delete it on
+          # success so the probe leaves no trace. Any failure falls back to
+          # the short-lived workflow token, whose integration role creates
+          # refs without this limitation.
+          write_ok=false
           if [ "$HAS_AUTOMATION_TOKEN" = true ] && gh api "repos/${GITHUB_REPOSITORY}" --jq '.full_name' >/dev/null 2>&1; then
+            probe_ref="refs/tags/token-write-probe-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+            if gh api -X POST "repos/${GITHUB_REPOSITORY}/git/refs" \
+                -f "ref=$probe_ref" -f "sha=${GITHUB_SHA}" >/dev/null 2>&1; then
+              gh api -X DELETE "repos/${GITHUB_REPOSITORY}/git/refs/tags/token-write-probe-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >/dev/null 2>&1 || true
+              write_ok=true
+            fi
+          fi
+          if [ "$write_ok" = true ]; then
             echo "auto_merge=true" >> "$GITHUB_OUTPUT"
             echo "token_source=configured" >> "$GITHUB_OUTPUT"
           else
             echo "auto_merge=false" >> "$GITHUB_OUTPUT"
             echo "token_source=fallback" >> "$GITHUB_OUTPUT"
             if [ "$HAS_AUTOMATION_TOKEN" = true ]; then
-              echo "::warning title=Release token fallback::The configured CODE_FOUNDRY_TOKEN was rejected by GitHub; failing over to the short-lived workflow token. The version pull request will be left for manual merge."
+              echo "::warning title=Release token fallback::The configured CODE_FOUNDRY_TOKEN was rejected by GitHub for the tag-creation write release-please needs; failing over to the short-lived workflow token. The version pull request will be left for manual merge."
             fi
           fi
       - name: Release Please (automation token)

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.44.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.5...v1.44.6) (2026-10-05)
+
+
+### Bug Fixes
+
+* **config:** pin the lint-bearing CI lane to a standard runner by default ([#718](https://github.com/0xPlayerOne/code-foundry/issues/718)) ([fc0ed14](https://github.com/0xPlayerOne/code-foundry/commit/fc0ed14434151fb11eef7c0d4c324c7a370d5058))
+
+## [1.44.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.4...v1.44.5) (2026-10-05)
+
+
+### Bug Fixes
+
+* **release:** probe the tag-creation write before trusting the automation token ([#716](https://github.com/0xPlayerOne/code-foundry/issues/716)) ([fabaddc](https://github.com/0xPlayerOne/code-foundry/commit/fabaddcb05d5dc701248b693f91be6ee433f8d39))
+
 ## [1.44.4](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.3...v1.44.4) (2026-10-03)
 
 
@@ -136,23 +150,9 @@
 
 * perf-budget-best-of-n ([#674](https://github.com/0xPlayerOne/code-foundry/issues/674)) ([c377ede](https://github.com/0xPlayerOne/code-foundry/commit/c377ede617d89fb0606413ab7b5d478330c49e93))
 
-## [1.37.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.37.1...v1.37.2) (2026-09-30)
-
-
-### Bug Fixes
-
-* **cloudflare:** surface the cf deploy error instead of discarding it ([66de0d1](https://github.com/0xPlayerOne/code-foundry/commit/66de0d1e8238315dbd910abbd907e921cbc6764f))
-
-## [1.37.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.37.0...v1.37.1) (2026-09-30)
-
-
-### Bug Fixes
-
-* **cloudflare:** build the production Build Output before the prebuilt deploy ([5f2f83c](https://github.com/0xPlayerOne/code-foundry/commit/5f2f83c6d6135c403b520f83469c0c5ca350cdba))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 224 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 226 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.44.4",
+  "version": "1.44.6",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/lib/profile.mjs

@@ -126,7 +126,10 @@ export function recommendRunners(root) {
     hasBrowserProject(root)
   return {
     runner: heavy ? 'ubuntu-latest' : 'ubuntu-slim',
-    ci_runner: heavy ? 'ubuntu-latest' : 'ubuntu-slim',
+    // The CI lane carries the lint step: oxlint's allocator pool reserves
+    // 4 GiB of virtual address space per worker and aborts on ubuntu-slim,
+    // so the lint-bearing lane always pins a standard runner.
+    ci_runner: 'ubuntu-latest',
     test_runner: heavy ? 'ubuntu-latest' : 'ubuntu-slim',
     unit_runner: heavy ? 'ubuntu-latest' : 'ubuntu-slim',
     performance_runner: 'ubuntu-latest',