code-foundry 1.48.6 → 1.48.7

package/.github/workflows/release.yml

@@ -439,6 +439,53 @@ jobs:
           latest=false
           if [ "$PRERELEASE" != true ]; then latest=true; fi
           gh release edit "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --draft=false --prerelease="$PRERELEASE" --latest="$latest"
+      - name: Sync lockfile workspace versions on generated release PRs
+        # Release Please bumps every workspace package.json but has no updater
+        # for bun.lock, which records each workspace's version, so a generated
+        # release PR leaves the lock naming the previous version of every
+        # workspace. Commit the corrected lock onto the release branch before
+        # the draft-state and merge steps read its head. The commit is made with
+        # the validated automation token so the PR's required checks run on it;
+        # a push made with the workflow token starts no workflows, so that
+        # credential skips this step and the release gate reports the stale
+        # lock instead. A rejected push (Release Please moved the branch) is
+        # not retried: the next release run starts again from the new head.
+        if: steps.release.outcome == 'success' && steps.credentials.outputs.token_source == 'configured'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          mapfile -t release_branches < <(
+            gh pr list \
+              --repo "$GITHUB_REPOSITORY" \
+              --state open \
+              --base main \
+              --json headRefName \
+              --jq '.[] | select(.headRefName == "release-please--branches--main" or (.headRefName | startswith("release-please--branches--main--"))) | .headRefName'
+          )
+          if [ ${#release_branches[@]} -eq 0 ]; then
+            exit 0
+          fi
+          gh auth setup-git
+          index=0
+          for branch in "${release_branches[@]}"; do
+            index=$((index + 1))
+            worktree="$RUNNER_TEMP/release-lock-$index"
+            git fetch --no-tags --depth=1 origin "refs/heads/$branch"
+            git worktree add --detach "$worktree" FETCH_HEAD
+            node "$RUNNER_TEMP/code-foundry/src/cli.mjs" release sync-lock --target "$worktree"
+            if git -C "$worktree" diff --quiet -- bun.lock; then
+              continue
+            fi
+            git -C "$worktree" \
+              -c user.name='github-actions[bot]' \
+              -c user.email='41898282+github-actions[bot]@users.noreply.github.com' \
+              commit --quiet -m 'chore(release): sync bun.lock workspace versions' -- bun.lock
+            if ! git -C "$worktree" push origin "HEAD:refs/heads/$branch"; then
+              echo "::warning title=Release lock sync::$branch moved before the lockfile sync could be pushed; the next release run will sync it."
+            fi
+          done
       - name: Normalize generated release PR draft state
         if: steps.release.outcome == 'success'
         env:

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.48.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.6...v1.48.7) (2026-10-23)
+
+
+### Bug Fixes
+
+* **release:** sync bun.lock workspace versions on generated release PRs ([#777](https://github.com/0xPlayerOne/code-foundry/issues/777)) ([b24bfae](https://github.com/0xPlayerOne/code-foundry/commit/b24bfae309ac7003fcc4cd57f79ddc418c27b039))
+
 ## [1.48.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.48.5...v1.48.6) (2026-10-23)
 
 
@@ -133,16 +140,9 @@
 
 * **qualification:** skip parallel-syntax files until actionlint supports them ([#740](https://github.com/0xPlayerOne/code-foundry/issues/740)) ([db98c7f](https://github.com/0xPlayerOne/code-foundry/commit/db98c7f40cae080cdc9dcab7baac4976e5e0656e))
 
-## [1.46.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.45.2...v1.46.0) (2026-10-07)
-
-
-### Features
-
-* **billing:** run fast-lane executes concurrently ([#738](https://github.com/0xPlayerOne/code-foundry/issues/738)) ([b40e82a](https://github.com/0xPlayerOne/code-foundry/commit/b40e82a0709b288a8be46998cfdc8b909f92c23c))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 254 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 255 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/RELEASES.md

@@ -137,6 +137,27 @@ A failed audit leaves the version PR unmerged. Re-run the Release workflow
 (`workflow_dispatch`) so Release Please regenerates the branch from the current
 `main`; do not edit the generated branch or release manually.
 
+## Lockfile workspace versions
+
+Release Please's Node updater bumps every workspace `package.json` but has no
+updater for `bun.lock`, which records each workspace's `version`. A version PR
+therefore leaves the lock naming the previous version of every workspace (the
+agent-sim 0.15.14 release left all 14 workspaces at 0.15.10).
+
+- `validation release_diff` fails a generated release whose `bun.lock` records a
+  workspace version that differs from its `package.json`, and names the first
+  workspaces and the fix.
+- `code-foundry release sync-lock [--target PATH] [--dry-run]` rewrites only
+  those drifted `version` values; it never touches dependencies, the `packages`
+  section or line endings, and does nothing when the lock already matches.
+- The Release workflow runs it on each open generated release branch before the
+  draft-state and merge steps read the PR head, then pushes one
+  `chore(release): sync bun.lock workspace versions` commit with the validated
+  automation token so the required checks run on it. With the fallback workflow
+  token (whose pushes start no workflows) the step is skipped and the gate
+  reports the stale lock instead. A push rejected because Release Please moved
+  the branch is left for the next run.
+
 ## Pull request permissions
 
 The release job validates the configured automation token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.48.6",
+  "version": "1.48.7",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/cli.mjs

@@ -23,6 +23,7 @@ Usage:
   npx code-foundry ci pause|resume|status [--target PATH]
   npx code-foundry release reconcile [--github] [--base BRANCH] [--head BRANCH]
   npx code-foundry release hook --tag TAG --workflow WORKFLOW
+  npx code-foundry release sync-lock [--target PATH] [--dry-run]
   npx code-foundry release-integrity settings --repo OWNER/REPO
   npx code-foundry release-integrity release --repo OWNER/REPO --tag TAG
   npx code-foundry release-integrity manifest --asset PATH [--root PATH]
@@ -93,9 +94,9 @@ function parseArgs(argv) {
 
   if (command === 'release') {
     const subcommand = argv.shift() ?? ''
-    if (!['reconcile', 'hook', 'validate-prs', 'recovery-plan'].includes(subcommand))
+    if (!['reconcile', 'hook', 'validate-prs', 'recovery-plan', 'sync-lock'].includes(subcommand))
       fail(
-        `unknown release command: ${subcommand ?? '(missing)'}; use release reconcile, release hook, release validate-prs, or release recovery-plan`
+        `unknown release command: ${subcommand ?? '(missing)'}; use release reconcile, release hook, release validate-prs, release recovery-plan, or release sync-lock`
       )
     options.releaseSubcommand = subcommand
   } else if (command === 'release-integrity') {
@@ -247,11 +248,13 @@ async function main() {
         dispatchPostReleaseHook,
         reconcileRelease,
         releaseRecoveryPlan,
+        syncReleaseLock,
         validateReleasePullRequestDiffs,
       } = await import('./commands/release.mjs')
       if (options.releaseSubcommand === 'hook') dispatchPostReleaseHook(target, options)
       else if (options.releaseSubcommand === 'validate-prs') validateReleasePullRequestDiffs(target)
       else if (options.releaseSubcommand === 'recovery-plan') releaseRecoveryPlan(target)
+      else if (options.releaseSubcommand === 'sync-lock') syncReleaseLock(target, options)
       else reconcileRelease(target, options)
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))

package/src/commands/release.mjs

@@ -17,6 +17,7 @@ import {
   selectReconciliationPullRequest,
   validateReleasePullRequests,
 } from '../lib/release-policy.mjs'
+import { syncBunLockWorkspaceVersions } from '../lib/bun-lock.mjs'
 import { hasDeliveredHook, releaseDeliveryKey, selectHookDelivery } from '../lib/release-hook.mjs'
 
 /** @typedef {{ target: string, dryRun: boolean, github: boolean, base: string, head: string }} ReleaseOptions */
@@ -768,6 +769,27 @@ export function dispatchPostReleaseHook(root, options) {
   return { ...decision, deliveryKey: key, dispatched: true }
 }
 
+/**
+ * Rewrite the workspace versions `bun.lock` records to match the manifests a
+ * Release Please run just bumped.
+ * @param {string} root
+ * @param {{ dryRun: boolean }} options
+ */
+export function syncReleaseLock(root, options) {
+  const changes = syncBunLockWorkspaceVersions(root, { dryRun: options.dryRun })
+  if (!changes.length) {
+    console.log('bun.lock workspace versions already match package.json; nothing to sync.')
+    return changes
+  }
+  const verb = options.dryRun ? 'Would update' : 'Updated'
+  for (const change of changes) {
+    console.log(
+      `${verb} bun.lock ${change.path || '.'} (${change.name}): ${change.from} -> ${change.to}`
+    )
+  }
+  return changes
+}
+
 /** @param {string} root */
 export function validateReleasePullRequestDiffs(root) {
   const repository = process.env.GITHUB_REPOSITORY

package/src/lib/bun-lock.mjs

@@ -0,0 +1,149 @@
+// @ts-check
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Release Please's Node updater bumps every workspace `package.json` but has no
+ * updater for `bun.lock`, which records each workspace's version. A release
+ * commit therefore leaves the lock naming the previous version of every
+ * workspace. These helpers read and rewrite only those recorded versions; the
+ * rest of the lock is never touched.
+ */
+
+const WORKSPACES_START = /^ {2}"workspaces": \{\s*$/
+const WORKSPACES_END = /^ {2}\},?\s*$/
+const ENTRY_START = /^ {4}"([^"]*)": \{\s*$/
+const ENTRY_END = /^ {4}\},?\s*$/
+const NAME_LINE = /^ {6}"name": "([^"]*)",?\s*$/
+const VERSION_LINE = /^( {6}"version": ")([^"]*)(".*)$/
+
+/**
+ * @typedef {{ path: string, name: string, version: string, line: number }} LockedWorkspace
+ */
+
+/**
+ * The workspace versions a `bun.lock` records, with the line each sits on.
+ * Workspaces without a `version` line (the root, private packages without a
+ * version) are not listed: bun omits the key when the manifest has none.
+ * @param {string} text
+ * @returns {LockedWorkspace[]}
+ */
+export function lockedWorkspaces(text) {
+  const lines = text.split(/\r?\n/)
+  /** @type {LockedWorkspace[]} */
+  const found = []
+  let inWorkspaces = false
+  let entry = ''
+  let name = ''
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (!inWorkspaces) {
+      if (WORKSPACES_START.test(line)) inWorkspaces = true
+      continue
+    }
+    if (!entry) {
+      if (WORKSPACES_END.test(line)) break
+      const start = ENTRY_START.exec(line)
+      if (start) {
+        entry = start[1]
+        name = ''
+      }
+      continue
+    }
+    if (ENTRY_END.test(line)) {
+      entry = ''
+      continue
+    }
+    const nameLine = NAME_LINE.exec(line)
+    if (nameLine) {
+      name = nameLine[1]
+      continue
+    }
+    const versionLine = VERSION_LINE.exec(line)
+    if (versionLine) found.push({ path: entry, name, version: versionLine[2], line: index })
+  }
+  return found
+}
+
+/**
+ * @param {string} root
+ * @param {string} workspacePath
+ * @returns {string | undefined}
+ */
+function manifestVersion(root, workspacePath) {
+  const file = join(root, workspacePath, 'package.json')
+  if (!existsSync(file)) return undefined
+  try {
+    const version = JSON.parse(readFileSync(file, 'utf8')).version
+    return typeof version === 'string' && version ? version : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Locked workspace versions that differ from their manifest.
+ * @param {string} root
+ * @returns {Array<LockedWorkspace & { manifest: string }>}
+ */
+export function bunLockVersionDrift(root) {
+  const lockPath = join(root, 'bun.lock')
+  if (!existsSync(lockPath)) return []
+  /** @type {Array<LockedWorkspace & { manifest: string }>} */
+  const drift = []
+  for (const workspace of lockedWorkspaces(readFileSync(lockPath, 'utf8'))) {
+    const manifest = manifestVersion(root, workspace.path)
+    if (manifest !== undefined && manifest !== workspace.version)
+      drift.push({ ...workspace, manifest })
+  }
+  return drift
+}
+
+/**
+ * Release-gate errors for a stale `bun.lock`.
+ * @param {string} root
+ * @returns {string[]}
+ */
+export function validateBunLockVersions(root) {
+  const drift = bunLockVersionDrift(root)
+  if (!drift.length) return []
+  const shown = drift
+    .slice(0, 3)
+    .map(
+      (entry) =>
+        `${entry.path || '.'} (${entry.name || 'unnamed'}) is ${entry.version} in bun.lock but ${entry.manifest} in package.json`
+    )
+  const more = drift.length > shown.length ? ` (+${drift.length - shown.length} more)` : ''
+  return [
+    `bun.lock records ${drift.length} workspace version(s) that differ from package.json: ${shown.join('; ')}${more}. Run code-foundry release sync-lock.`,
+  ]
+}
+
+/**
+ * Rewrite stale workspace versions in `bun.lock` to match their manifests.
+ * Only the `version` value of a drifted workspace changes.
+ * @param {string} root
+ * @param {{ dryRun?: boolean }} [options]
+ * @returns {Array<{ path: string, name: string, from: string, to: string }>}
+ */
+export function syncBunLockWorkspaceVersions(root, options = {}) {
+  const drift = bunLockVersionDrift(root)
+  if (!drift.length) return []
+  const lockPath = join(root, 'bun.lock')
+  const text = readFileSync(lockPath, 'utf8')
+  const newline = text.includes('\r\n') ? '\r\n' : '\n'
+  const lines = text.split(/\r?\n/)
+  for (const entry of drift) {
+    const match = VERSION_LINE.exec(lines[entry.line])
+    if (!match) continue
+    lines[entry.line] = `${match[1]}${entry.manifest}${match[3]}`
+  }
+  if (!options.dryRun) writeFileSync(lockPath, lines.join(newline))
+  return drift.map((entry) => ({
+    path: entry.path,
+    name: entry.name,
+    from: entry.version,
+    to: entry.manifest,
+  }))
+}

package/src/lib/release-policy.mjs

@@ -2,6 +2,7 @@
 
 import { existsSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
+import { validateBunLockVersions } from './bun-lock.mjs'
 import { isReleasePleaseHead } from './validation-policy.mjs'
 
 const DEFAULT_RELEASE_FILES = new Set([
@@ -453,6 +454,7 @@ export function validateGeneratedReleaseDiff(input) {
     errors.push('Generated release pull request changes no version metadata.')
   }
   errors.push(...validateCargoLockVersions(root, config))
+  errors.push(...validateBunLockVersions(root))
   // Callers that can read the unified diff opt into the content audit. A null
   // patch means the diff was requested but unreadable, which must not pass.
   if (typeof patch === 'string') errors.push(...auditReleaseDiffContent(patch, { config }))