code-foundry 1.50.0 → 1.51.0

package/.github/code-foundry.schema.json

@@ -13,6 +13,14 @@
       "type": "string",
       "enum": ["true", "false"]
     },
+    "release_defer_publication": {
+      "type": "string",
+      "enum": ["true", "false"]
+    },
+    "release_prerelease": {
+      "type": "string",
+      "enum": ["true", "false"]
+    },
     "npm_publish_auth": {
       "description": "npm publisher authentication: auto preserves token users and uses OIDC when no publish token is present; oidc forces trusted publishing; token requires NPM_TOKEN.",
       "type": "string",

package/.github/workflows/release_self-ci.yml

@@ -90,7 +90,6 @@ jobs:
       contents: write
       issues: write
       pull-requests: write
-      # Required by the reusable legacy workflow's declared npm job, which is disabled here.
       id-token: write
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.51.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.50.1...v1.51.0) (2026-10-29)
+
+
+### Features
+
+* **release:** preserve caller publication overrides ([#795](https://github.com/0xPlayerOne/code-foundry/issues/795)) ([e49d2ba](https://github.com/0xPlayerOne/code-foundry/commit/e49d2bac4f8995808bfc6a726b0c2ff1e93c2a5f))
+
+## [1.50.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.50.0...v1.50.1) (2026-10-29)
+
+
+### Bug Fixes
+
+* **sync:** replace complete consumer runtime ref ([#793](https://github.com/0xPlayerOne/code-foundry/issues/793)) ([6a0b5ef](https://github.com/0xPlayerOne/code-foundry/commit/6a0b5ef4f9a02c781745fa64f2f9748ea679f2d5))
+
 ## [1.50.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.49.3...v1.50.0) (2026-10-29)
 
 
@@ -126,23 +140,9 @@
 
 * **fleet:** point the manifest at the rollout worktrees and filter adea's actionlint ([#757](https://github.com/0xPlayerOne/code-foundry/issues/757)) ([55bae8b](https://github.com/0xPlayerOne/code-foundry/commit/55bae8bf99a022bfa03294972d89a3cca20a6203))
 
-## [1.47.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.1...v1.47.2) (2026-10-08)
-
-
-### Bug Fixes
-
-* **qualification:** exclude pending parallel syntax by content, not filename ([#755](https://github.com/0xPlayerOne/code-foundry/issues/755)) ([1f7cae8](https://github.com/0xPlayerOne/code-foundry/commit/1f7cae8167002061850e56e3dc0fa800a69d7be9))
-
-## [1.47.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.0...v1.47.1) (2026-10-08)
-
-
-### Tests
-
-* **doctor:** pin the machine-hook shadow warning ([#753](https://github.com/0xPlayerOne/code-foundry/issues/753)) ([f634269](https://github.com/0xPlayerOne/code-foundry/commit/f634269424580d8d34323319288747587b6d6ae3))
-
 <!-- code-foundry: packaged changelog -->
 
 ---
 
-This packaged changelog lists the 20 most recent releases; 262 older releases are omitted to keep the package small.
+This packaged changelog lists the 20 most recent releases; 264 older releases are omitted to keep the package small.
 See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.

package/docs/CONFIGURATION.md

@@ -178,6 +178,8 @@ See [Merge queue validation](merge-queues.md) before enabling it.
 | `release_qualification_receipts`          | `true`, `false` (default `false`)                    | Opt in to seven-day source qualification receipts for eligible version-only Release Please PRs. Defaults to false; see [workflow policy](WORKFLOWS.md#standard-triggers) for requirements and fallback behavior.                                                                                                                                                                                                                                                                                                                                      |
 | `release_batching_schedule`               | five-field numeric cron                              | Batch Release Please into scheduled windows. Ordinary pushes skip the producer; release-PR squashes and manual dispatches still run. Batched releases are created privately as drafts and published with prerelease visibility atomically. Manual dispatches publish stable hotfixes. Absent, releases publish per merge. Requires a single root Release Please package.                                                                                                                                                                              |
 | `release_batching_prerelease`             | `true`, `false`                                      | Defaults to `true` with a schedule. Sync enables `draft` and `force-tag-creation` in Release Please; the producer publishes the draft with the selected visibility. `false` keeps scheduled releases stable-visible.                                                                                                                                                                                                                                                                                                                                  |
+| `release_defer_publication`               | `true`, `false` (default `false`)                    | Keep deferred publication enabled in the caller; the reusable workflow skips npm, reconciliation, and post-release hooks. Requires one draft root package with force-tag creation, configured directly or by prerelease batching.                                                                                                                                                                                                                                                                                                                     |
+| `release_prerelease`                      | `true`, `false` (unset by default)                   | Set a fixed prerelease input; unset keeps event-based batching.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `release_batching_soak_hours`             | `1`–`336`                                            | Generate a daily promoter that promotes the newest prerelease when the oldest candidate since the last stable has soaked this many hours, stitching batch notes. Requires a batching schedule and prerelease publication. Set `STABLE_PROMOTION_HELD=true` in repository Actions variables to hold scheduled and manual promotion; `force` overrides the hold or soak, and `version` selects a plain semantic version.                                                                                                                                |
 | `release_batching_qualification_workflow` | workflow filename (for example `release-assets.yml`) | Require the latest release-event run of this workflow for the candidate tag’s exact source commit to succeed before stable promotion. Requires a batching soak. Running, missing, failed, or cancelled runs hold promotion, including named and forced promotions; `force` only bypasses hold and soak. The promoter receives read-only Actions access.                                                                                                                                                                                               |
 | `release_batching_dev_channel`            | `true`, `false`                                      | Publish a dev channel: every push to main tags a `v<stable>-dev.<run>` pre-release on top of the newest stable and dispatches the configured asset lane. Dev builds are never promoted to stable, auto builds pause with `CI_BILLING_PAUSED`, and manual dispatches accept a `version` input for repairs. Defaults to `false`.                                                                                                                                                                                                                        |

package/docs/PERFORMANCE.md

@@ -14,8 +14,8 @@ budget is exceeded. Reports are generated-run evidence and are ignored by Git.
 | Format, lint, type-check, and build   |     15 s | Bound the local CI feedback loop                     |
 | Runtime dependencies                  |        0 | Keep the installed CLI dependency-free               |
 | Development dependencies              |        4 | Prevent unreviewed toolchain growth                  |
-| Packed artifact (without changelog)   |   296 kB | Bound registry transfer and install cost             |
-| Unpacked artifact (without changelog) | 1,136 kB | Bound installed footprint                            |
+| Packed artifact (without changelog)   | 316.5 kB | Bound registry transfer and install cost             |
+| Unpacked artifact (without changelog) | 1,225 kB | Bound installed footprint                            |
 | Packed files (without changelog)      |      120 | Detect accidental release contents                   |
 
 The source-of-truth budgets live in `scripts/performance-check.mjs`. When those
@@ -29,8 +29,14 @@ included it eroded on every release and repeatedly failed release pull requests.
 The check packs a staging copy without the changelog and reports the repository
 changelog size and its packaged (trimmed) size as informational metrics. At
 v1.44.0 the measured artifact was 280,902 packed bytes, 1,070,333 unpacked bytes,
-and 118 files, leaving roughly 5% packed and 6% unpacked headroom for source
-growth.
+and 118 files.
+
+On v1.50.1 base `f671dd8`, the measured artifact was 315,853 packed bytes,
+1,200,759 unpacked bytes, and 120 files. Release caller publication overrides
+measure 316,295 packed bytes, 1,222,905 unpacked bytes, and 120 files: an
+increase of 442 packed bytes and 22,146 unpacked bytes. The packed limit is
+316,500 bytes, leaving 205 bytes of measured headroom; the unpacked and file-count
+limits remain 1,225,000 bytes and 120 files.
 
 The published package ships a changelog trimmed to the 20 most recent releases
 with a link to the full history on GitHub. `scripts/package-changelog.mjs`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.50.0",
+  "version": "1.51.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -900,6 +900,11 @@ jobs:
 
 /** @param {Record<string, string>} config */
 function validateReleaseBatchingConfig(config) {
+  for (const key of ['release_defer_publication', 'release_prerelease']) {
+    if (config[key] !== undefined && !['true', 'false'].includes(config[key])) {
+      throw new Error(`Unsupported ${key}: ${config[key]}; use true or false.`)
+    }
+  }
   const schedule = String(config.release_batching_schedule ?? '').trim()
   if (schedule) {
     const limits = [
@@ -1094,6 +1099,26 @@ export function renderDevChannel(config) {
   )
 }
 
+/**
+ * Pin consumer runtime refs without retaining the self-CI expression used by
+ * the Code Foundry repository. Self callers keep their event-relative refs.
+ *
+ * @param {string} content
+ * @param {string} ref
+ * @param {boolean} selfRepository
+ */
+export function pinRuntimeRefs(content, ref, selfRepository) {
+  if (selfRepository) return content
+  const foldedRuntimeRef =
+    /^([ \t]*runtime-ref:)[ \t]*>-[ \t]*\r?\n(?:[ \t]+\$\{\{[^\r\n]*\}\}[ \t]*(?:\r?\n|$))+/gm
+  return content
+    .replace(
+      foldedRuntimeRef,
+      (match, key) => `${key} ${ref}${match.endsWith('\r\n') ? '\r\n' : '\n'}`
+    )
+    .replace(/^([ \t]*runtime-ref:)[ \t]+.*$/gm, (_, key) => `${key} ${ref}`)
+}
+
 /**
  * @param {string} content
  * @param {Record<string,string>} config
@@ -1149,11 +1174,12 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
     new RegExp(`${escapeRegExp(remotePrefix)}([^\\s@]+)`, 'g'),
     `$&@${ref}`
   )
-  // Pin every runtime reference in the rendered caller: the orchestrator input
-  // in the `with:` block and the mode job's runtime checkout. Self templates
-  // use ${{ github.sha }} and are only rewritten when rendered for consumers.
-  rendered = rendered.replace(/^(\s+runtime-ref:)\s+.*$/gm, `$1 ${ref}`)
-  rendered = rendered.replace(/^(\s+ref:)\s+\$\{\{\s*github\.sha\s*\}\}\s*$/gm, `$1 ${ref}`)
+  // Replace complete folded self-CI runtime expressions when rendering a
+  // consumer. The source repository keeps its event-relative runtime refs.
+  rendered = pinRuntimeRefs(rendered, ref, selfRepository)
+  if (!selfRepository) {
+    rendered = rendered.replace(/^(\s+ref:)\s+\$\{\{\s*github\.sha\s*\}\}\s*$/gm, `$1 ${ref}`)
+  }
   rendered = rendered.replace(/^(\s+runtime-repository:)\s+.*$/gm, `$1 ${repository}`)
   rendered = rendered.replace(
     new RegExp(`^(\\s+repository:)\\s+0xPlayerOne\\/code-foundry\\s*$`, 'gm'),
@@ -1225,7 +1251,9 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
       rendered = removeWorkflowBlock(rendered, job)
     rendered = rendered.replace(/^    needs: \[preflight\]\n/m, '')
     rendered = rendered.replace(/^      config-file: \.github\/release-please-foundry\.json\n/m, '')
-    rendered = rendered.replace(/^      defer-publication: true\n/m, '')
+    if (config.release_defer_publication !== 'true') {
+      rendered = rendered.replace(/^      defer-publication: true\n/m, '')
+    }
     rendered = rendered.replace(
       /^    if: github\.ref == 'refs\/heads\/main' && \(vars\.CI_BILLING_PAUSED != 'true' \|\| \(github\.event_name == 'workflow_dispatch' && inputs\['release-while-paused'\] == true\)\)\n/m,
       "    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)\n"
@@ -1245,12 +1273,17 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
         "    if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)\n",
         "    if: >-\n      (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && (github.event_name != 'push' || startsWith(github.event.head_commit.message, 'chore(main): release '))\n"
       )
-      if (configured(config.release_batching_prerelease, 'true') === 'true') {
-        rendered = rendered.replace(
-          '      git-workflow:',
-          "      prerelease: ${{ github.event_name != 'workflow_dispatch' }}\n      git-workflow:"
-        )
-      }
+    }
+    const prerelease =
+      config.release_prerelease ||
+      (batchingSchedule && config.release_batching_prerelease !== 'false'
+        ? "${{ github.event_name != 'workflow_dispatch' }}"
+        : '')
+    if (prerelease) {
+      rendered = rendered.replace(
+        '      git-workflow:',
+        `      prerelease: ${prerelease}\n      git-workflow:`
+      )
     }
     const npmSecrets =
       configured(config.npm_publish, 'false') !== 'true'