code-foundry 1.46.5 → 1.47.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.47.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.6...v1.47.0) (2026-10-08)
+
+
+### Features
+
+* **release:** configurable dev channel on top of batched releases ([#749](https://github.com/0xPlayerOne/code-foundry/issues/749)) ([8fd8556](https://github.com/0xPlayerOne/code-foundry/commit/8fd85567a1a89735ab0db589649741253fbbeb21)), closes [#699](https://github.com/0xPlayerOne/code-foundry/issues/699)
+
+## [1.46.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.5...v1.46.6) (2026-10-08)
+
+
+### Bug Fixes
+
+* **pre-commit:** build before lint and type-check when the gate opts in ([#748](https://github.com/0xPlayerOne/code-foundry/issues/748)) ([f56454f](https://github.com/0xPlayerOne/code-foundry/commit/f56454f313a1a5b802b8a17b09d850902de1ba55)), closes [#691](https://github.com/0xPlayerOne/code-foundry/issues/691)
+
 ## [1.46.5](https://github.com/0xPlayerOne/code-foundry/compare/v1.46.4...v1.46.5) (2026-10-08)
 
 
@@ -126,23 +140,9 @@
 
 * **cli:** assert expected doctor warnings ([#712](https://github.com/0xPlayerOne/code-foundry/issues/712)) ([d036bee](https://github.com/0xPlayerOne/code-foundry/commit/d036beee79a9b200315cdbee5509fc3c2a6c4a04))
 
-## [1.44.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.1...v1.44.2) (2026-10-03)
-
-
-### Bug Fixes
-
-* **ci:** cancel only superseded pull-request runs in managed workflows ([#710](https://github.com/0xPlayerOne/code-foundry/issues/710)) ([f5fead6](https://github.com/0xPlayerOne/code-foundry/commit/f5fead677c032d253f2e1a2a256da4f207ddfa2a))
-
-## [1.44.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.44.0...v1.44.1) (2026-10-03)
-
-
-### Bug Fixes
-
-* **release:** budget the package without the changelog and ship recent history only ([#708](https://github.com/0xPlayerOne/code-foundry/issues/708)) ([ab365e0](https://github.com/0xPlayerOne/code-foundry/commit/ab365e0910472c3596429adc86a1c8f3e19730f9))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 240 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 242 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -131,7 +131,7 @@ See [Merge queue validation](merge-queues.md) before enabling it.
 | `coverage_minimum`                        | `0`–`100`                                            | Minimum percentage; defaults to `80`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `coverage_metrics`                        | `lines`, `functions`, `branches`, `statements`       | Metrics checked by the coverage gate.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `coverage_report`                         | comma-separated repository paths                     | Istanbul JSON summary or LCOV evidence files.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `pre_commit_build`                        | `true`, `false`                                      | Run the project's build in the local pre-commit gate. Defaults to `false`; see [Pre-commit gate](#pre-commit-gate).                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `pre_commit_build`                        | `true`, `false`                                      | Run the project's build in the local pre-commit gate, before lint and type-check (mirroring CI's ordering). Defaults to `false`; see [Pre-commit gate](#pre-commit-gate).                                                                                                                                                                                                                                                                                                                                                                             |
 | `filter_<task>`                           | comma-separated repository path globs                | Skip a lane when no changed path matches; see [Lane path filters](#lane-path-filters).                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `rust_sccache`                            | `true`, `false`                                      | Install sccache and wrap rustc so compile artifacts survive manifest/lockfile churn.                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `rust_nextest`                            | `true`, `false`                                      | Install cargo-nextest and prefer `cargo nextest run` over `cargo test` in Rust test lanes.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
@@ -141,6 +141,8 @@ See [Merge queue validation](merge-queues.md) before enabling it.
 | `release_batching_prerelease`             | `true`, `false`                                      | Defaults to `true` with a schedule. Sync enables `draft` and `force-tag-creation` in Release Please; the producer publishes the draft with the selected visibility. `false` keeps scheduled releases stable-visible.                                                                                                                                                                                                                                                                                                                                  |
 | `release_batching_soak_hours`             | `1`–`336`                                            | Generate a daily promoter that promotes the newest prerelease when the oldest candidate since the last stable has soaked this many hours, stitching batch notes. Requires a batching schedule and prerelease publication. Set `STABLE_PROMOTION_HELD=true` in repository Actions variables to hold scheduled and manual promotion; `force` overrides the hold or soak, and `version` selects a plain semantic version.                                                                                                                                |
 | `release_batching_qualification_workflow` | workflow filename (for example `release-assets.yml`) | Require the latest release-event run of this workflow for the candidate tag’s exact source commit to succeed before stable promotion. Requires a batching soak. Running, missing, failed, or cancelled runs hold promotion, including named and forced promotions; `force` only bypasses hold and soak. The promoter receives read-only Actions access.                                                                                                                                                                                               |
+| `release_batching_dev_channel`            | `true`, `false`                                      | Publish a dev channel: every push to main tags a `v<stable>-dev.<run>` pre-release on top of the newest stable and dispatches the configured asset lane. Dev builds are never promoted to stable, auto builds pause with `CI_BILLING_PAUSED`, and manual dispatches accept a `version` input for repairs. Defaults to `false`.                                                                                                                                                                                                                        |
+| `release_batching_dev_workflow`           | workflow filename                                    | The `workflow_dispatch` asset lane the dev channel dispatches with a `version` input; the lane and its version injection stay app-provided because packaging differs per app. Required by `release_batching_dev_channel`.                                                                                                                                                                                                                                                                                                                             |
 
 Supported task capabilities are `format`, `lint`, `type_check`, `build`, `unit`,
 `integration`, `e2e`, `smoke`, `eval`, and `performance`. `coverage` is a policy
@@ -194,7 +196,11 @@ gate is change-aware and never runs work for code the commit cannot affect:
   Clippy.
 - The build does not run at commit time; CI and explicit commands own it. Set
   `pre_commit_build: true` to run the `build` script (or `cargo build`) when
-  code is staged.
+  code is staged. The build then runs before lint and type-check — mirroring
+  CI's ordering — because those tasks read built package output. With the
+  build disabled, a lint or type-check failure that a fresh clone's missing
+  build output could explain is printed with a one-line note saying so instead
+  of a bare error.
 
 Tools read working-tree contents, so a partially staged file is checked as it
 exists on disk. Task scripts that declare dependencies of their own, such as a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.46.5",
+  "version": "1.47.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -308,6 +308,13 @@ function synchronize(options) {
       const promoterPath = join(target, '.github/workflows/promote-stable.yml')
       if (promoter) writeOrReport(promoterPath, promoter, dryRun)
       else if (existsSync(promoterPath) && !dryRun) rmSync(promoterPath)
+      // The dev channel rides along the same way: rendered from
+      // release_batching_dev_channel, removed when the key is gone so a
+      // disabled channel stops tagging dev builds on every push.
+      const devChannel = renderDevChannel(config)
+      const devChannelPath = join(target, '.github/workflows/dev-channel.yml')
+      if (devChannel) writeOrReport(devChannelPath, devChannel, dryRun)
+      else if (existsSync(devChannelPath) && !dryRun) rmSync(devChannelPath)
     }
     if (file === '.github/dependabot.yml') {
       content = Buffer.from(renderDependabot(content.toString('utf8'), config, languages))
@@ -936,6 +943,29 @@ function validateReleaseBatchingConfig(config) {
       )
     }
   }
+  if (
+    config.release_batching_dev_channel &&
+    !['true', 'false'].includes(config.release_batching_dev_channel)
+  ) {
+    throw new Error(
+      `Unsupported release_batching_dev_channel: ${config.release_batching_dev_channel}; use true or false.`
+    )
+  }
+  if (configured(config.release_batching_dev_channel, 'false') === 'true') {
+    if (
+      !config.release_batching_dev_workflow ||
+      !/^[A-Za-z0-9_.-]+\.ya?ml$/.test(config.release_batching_dev_workflow)
+    ) {
+      throw new Error(
+        'Unsupported release_batching_dev_workflow: use the filename of the workflow_dispatch asset lane the dev build should dispatch.'
+      )
+    }
+  }
+  if (config.release_batching_dev_workflow && config.release_batching_dev_channel !== 'true') {
+    throw new Error(
+      'Unsupported release_batching_dev_workflow: requires release_batching_dev_channel: true.'
+    )
+  }
 }
 
 /** Render the batch-soak promoter for a repository, or null when the
@@ -953,6 +983,102 @@ export function renderPromoteStable(config) {
   )
 }
 
+/**
+ * The dev channel for repositories with `release_batching_dev_channel`. Every
+ * push to main tags a `v<stable>-dev.<run>` pre-release on top of the newest
+ * stable and dispatches the repository's own asset lane with a `version`
+ * input; the oldest dev builds are pruned so the channel stays bounded. Dev
+ * builds are never promoted: the batch-soak promoter's batch selector already
+ * excludes `-dev.` tags, so the channel lives beside stable forever.
+ * `__DEV_WORKFLOW__` is replaced with the configured asset lane at render
+ * time; the lane stays app-provided because packaging differs per app.
+ */
+const DEV_CHANNEL_TEMPLATE = `# Generated by Code Foundry sync from release_batching_dev_channel; rerun sync after changing or removing the key.
+
+name: Publish dev channel
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Publish this dev version now (for example v0.75.1-dev.42). Leave empty to derive it from the newest stable.
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: dev-channel
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Tag the dev build and dispatch the asset lane
+    # Auto dev builds pause with the shared billing pause; the manual dispatch
+    # (the repair path) still runs.
+    if: github.event_name == 'workflow_dispatch' || vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Publish the dev prerelease and dispatch the asset lane
+        env:
+          GH_TOKEN: \${{ github.token }}
+          DEV_WORKFLOW: '__DEV_WORKFLOW__'
+          REQUESTED: \${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          repo="$GITHUB_REPOSITORY"
+          if [ -n "$REQUESTED" ]; then
+            tag="$REQUESTED"
+          else
+            stable="$(gh api --paginate --slurp "repos/$repo/releases?per_page=100" | jq -r '
+              [ .[] | select(.draft == false and .prerelease == false)
+                | select(.tag_name | test("^v[0-9]+[.][0-9]+[.][0-9]+$")) ]
+              | sort_by(.published_at) | .[-1].tag_name // empty')"
+            if [ -z "$stable" ]; then
+              echo "No stable release exists yet; a dev channel needs a stable baseline." | tee "$GITHUB_STEP_SUMMARY"
+              exit 0
+            fi
+            tag="\${stable}-dev.\${GITHUB_RUN_NUMBER}"
+          fi
+          if gh release view "$tag" --repo "$repo" >/dev/null 2>&1; then
+            echo "$tag already exists; nothing to do." | tee "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          gh release create "$tag" --repo "$repo" --prerelease --target "$GITHUB_SHA" \
+            --title "$tag" --notes "Dev build of \${GITHUB_SHA::7}; a dev-channel build is never promoted to stable."
+          gh workflow run "$DEV_WORKFLOW" --repo "$repo" --ref main -f version="$tag"
+          echo "Dispatched $DEV_WORKFLOW for $tag." | tee "$GITHUB_STEP_SUMMARY"
+
+          # Keep the channel bounded: the newest dev builds stay, the rest go.
+          gh api --paginate --slurp "repos/$repo/releases?per_page=100" | jq -r '
+            [ .[] | select(.draft == false and .prerelease == true)
+              | select(.tag_name | test("^v[0-9]+[.][0-9]+[.][0-9]+-dev[.][0-9]+$")) ]
+            | sort_by(.created_at) | reverse | .[3:] | .[].tag_name' | while read -r stale; do
+            echo "Pruning $stale."
+            gh release delete "$stale" --repo "$repo" --yes --cleanup-tag
+          done
+`
+
+/**
+ * Render the dev channel workflow for a repository, or null when the
+ * repository has not opted in.
+ *
+ * @param {Record<string, string>} config
+ * @returns {string | null}
+ */
+export function renderDevChannel(config) {
+  if (configured(config.release_batching_dev_channel, 'false') !== 'true') return null
+  return DEV_CHANNEL_TEMPLATE.replaceAll(
+    '__DEV_WORKFLOW__',
+    config.release_batching_dev_workflow ?? ''
+  )
+}
+
 /**
  * @param {string} content
  * @param {Record<string,string>} config

package/src/lib/pre-commit.mjs

@@ -98,6 +98,25 @@ export function preCommitBuildEnabled(value) {
   return resolved === 'true'
 }
 
+/**
+ * The one-line explanation printed when lint or type-check fails while the
+ * commit-time build is disabled. CI builds before those tasks, so a fresh
+ * clone can fail the gate against an unmodified tree — a bare ENOENT trains
+ * `--no-verify` unless the gate names the actual problem.
+ *
+ * @param {{ build: boolean, buildScript: boolean, packageManager: string | null }} options
+ * @returns {string | undefined} The hint, or undefined when it cannot apply.
+ */
+export function freshCloneBuildHint({ build, buildScript, packageManager }) {
+  if (build || !buildScript) return undefined
+  const runner = packageManager ?? 'npm'
+  return (
+    `note: these checks may be reading missing build output on a fresh clone; ` +
+    `run "${runner} run build" once, or set pre_commit_build: true in ` +
+    `.github/code-foundry.yml to build before lint and type-check`
+  )
+}
+
 /**
  * Split a file list so one tool invocation never exceeds the platform's
  * argument-length limit on very large commits.

package/src/runtime-core.mjs

@@ -25,6 +25,7 @@ import {
   parseStagedFiles,
   planPreCommit,
   preCommitBuildEnabled,
+  freshCloneBuildHint,
 } from './lib/pre-commit.mjs'
 import { runNodePackagePerformance } from './lib/node-package-performance.mjs'
 import {
@@ -428,16 +429,20 @@ function commandExists(command) {
   return spawnSync(command, ['--version'], { stdio: 'ignore' }).status === 0
 }
 
-/** @param {string} command @param {string[]} [args] @param {Record<string, unknown>} [options] */
+/** @param {string} command @param {string[]} [args] @param {{ onFailure?: string }} [options] */
 function run(command, args = [], options = {}) {
+  const { onFailure, ...spawnOptions } = options
   const result = spawnSync(command, args, {
     cwd: root,
     stdio: 'inherit',
     env: process.env,
-    ...options,
+    ...spawnOptions,
   })
   if (result.error) throw result.error
-  if (result.status !== 0) process.exit(result.status ?? 1)
+  if (result.status !== 0) {
+    if (onFailure) console.error(onFailure)
+    process.exit(result.status ?? 1)
+  }
 }
 
 // pip-audit can report its clean result with a non-zero status when the
@@ -494,28 +499,28 @@ function packageCommand(args) {
   }
 }
 
-/** @param {string[]} names */
-function runScript(names) {
+/** @param {string[]} names @param {{ onFailure?: string }} [options] */
+function runScript(names, options = {}) {
   const name = names.find((candidate) => hasScript(candidate))
   if (!name) return false
   const [manager, args] = packageCommand(['run', name])
   if (!manager) return false
-  run(manager, args)
+  run(manager, args, options)
   return true
 }
 
-/** @param {string} tool @param {string[]} [args] */
-function runTool(tool, args = []) {
+/** @param {string} tool @param {string[]} [args] @param {{ onFailure?: string }} [options] */
+function runTool(tool, args = [], options = {}) {
   if (['ruff', 'pytest', 'pylint'].includes(tool)) {
     const venvTool = resolve(root, `.venv/bin/${tool}`)
-    if (existsSync(venvTool)) return run(venvTool, args)
+    if (existsSync(venvTool)) return run(venvTool, args, options)
   }
   const [manager] = packageCommand([])
-  if (manager === 'bun') return run('bunx', ['--no-install', tool, ...args])
-  if (manager === 'pnpm') return run('pnpm', ['exec', tool, ...args])
-  if (manager === 'yarn') return run('yarn', ['exec', tool, ...args])
-  if (manager === 'npm') return run('npx', ['--no-install', tool, ...args])
-  return run(tool, args)
+  if (manager === 'bun') return run('bunx', ['--no-install', tool, ...args], options)
+  if (manager === 'pnpm') return run('pnpm', ['exec', tool, ...args], options)
+  if (manager === 'yarn') return run('yarn', ['exec', tool, ...args], options)
+  if (manager === 'npm') return run('npx', ['--no-install', tool, ...args], options)
+  return run(tool, args, options)
 }
 
 function install() {
@@ -1193,9 +1198,11 @@ function runToolOnFiles(tool, args, files) {
  *
  * The gate is change-aware: it formats and lints only staged files, runs the
  * project's type-check command only when typed sources or compiler config are
- * staged, and never builds unless `pre_commit_build: true` opts back in. The
- * full suite still runs in CI. Tools see working-tree contents, so a partially
- * staged file is checked as it exists on disk.
+ * staged, and never builds unless `pre_commit_build: true` opts back in — in
+ * which case the build runs before lint and type-check, mirroring CI's
+ * ordering, because those tasks read built package output. The full suite
+ * still runs in CI. Tools see working-tree contents, so a partially staged
+ * file is checked as it exists on disk.
  */
 export function preCommit() {
   const staged = parseStagedFiles(
@@ -1225,9 +1232,22 @@ export function preCommit() {
       runScript(['format:check', 'format', 'fmt'])
     }
   }
+  // Mirror CI's prerequisite ordering: lint, boundary, and type-check tasks
+  // read built package output, so the opt-in build runs before them. Format
+  // stays first for the fastest feedback on the most common failure. Without
+  // the opt-in, a failure that CI (which builds first) cannot reproduce gets
+  // the one-line explanation instead of training `--no-verify`.
+  if (plan.build) ci('build')
+  const buildHint = freshCloneBuildHint({
+    build: plan.build,
+    buildScript: hasScript('build'),
+    packageManager: packageCommand([])[0],
+  })
+
   if (js && (plan.lintAll || plan.lintFiles.length)) {
     if (plan.lintAll) {
-      if (!runScript(['lint']) && hasOxlintSetup()) runTool('oxlint', ['--deny-warnings'])
+      if (!runScript(['lint'], { onFailure: buildHint }) && hasOxlintSetup())
+        runTool('oxlint', ['--deny-warnings'])
     } else if (hasOxlintSetup()) {
       runToolOnFiles(
         'oxlint',
@@ -1241,8 +1261,11 @@ export function preCommit() {
   if (js && plan.typeCheck) {
     // Use the project's own command so project references, workspaces, and
     // path aliases resolve exactly as they do in CI.
-    const scripted = runScript(['type-check', 'typecheck', 'type:check'])
-    if (!scripted && existsSync(resolve(root, 'tsconfig.json'))) runTool('tsc', ['--noEmit'])
+    const scripted = runScript(['type-check', 'typecheck', 'type:check'], {
+      onFailure: buildHint,
+    })
+    if (!scripted && existsSync(resolve(root, 'tsconfig.json')))
+      runTool('tsc', ['--noEmit'], { onFailure: buildHint })
   }
   if (plan.rust) {
     run('cargo', ['fmt', '--check'])
@@ -1255,7 +1278,6 @@ export function preCommit() {
     runToolOnFiles('ruff', ['format', '--check', '--force-exclude'], plan.pythonFiles)
     runToolOnFiles('ruff', ['check', '--force-exclude'], plan.pythonFiles)
   }
-  if (plan.build) ci('build')
 }
 
 // Only dispatch when this module is the process entry point. The CLI imports