code-foundry 1.50.1 → 1.51.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/CONTRIBUTING.md +1 -1
- package/.github/code-foundry.schema.json +8 -0
- package/.github/workflows/release_self-ci.yml +0 -1
- package/.github/workflows/validation_self-ci.yml +3 -6
- package/CHANGELOG.md +15 -15
- package/docs/CONFIGURATION.md +2 -0
- package/docs/PERFORMANCE.md +10 -4
- package/package.json +1 -1
- package/src/commands/sync.mjs +21 -9
package/.github/CONTRIBUTING.md
CHANGED
|
@@ -227,7 +227,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
|
|
|
227
227
|
| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |
|
|
228
228
|
| Scheduled or manual validation | Full audit tier |
|
|
229
229
|
| Push to a working branch | Draft PR workflow |
|
|
230
|
-
| Push to `main` | Release workflow; CodeQL
|
|
230
|
+
| Push to `main` | Release workflow; CodeQL scans every push to main, all commits included |
|
|
231
231
|
|
|
232
232
|
Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
|
|
233
233
|
|
|
@@ -13,6 +13,14 @@
|
|
|
13
13
|
"type": "string",
|
|
14
14
|
"enum": ["true", "false"]
|
|
15
15
|
},
|
|
16
|
+
"release_defer_publication": {
|
|
17
|
+
"type": "string",
|
|
18
|
+
"enum": ["true", "false"]
|
|
19
|
+
},
|
|
20
|
+
"release_prerelease": {
|
|
21
|
+
"type": "string",
|
|
22
|
+
"enum": ["true", "false"]
|
|
23
|
+
},
|
|
16
24
|
"npm_publish_auth": {
|
|
17
25
|
"description": "npm publisher authentication: auto preserves token users and uses OIDC when no publish token is present; oidc forces trusted publishing; token requires NPM_TOKEN.",
|
|
18
26
|
"type": "string",
|
|
@@ -112,15 +112,12 @@ jobs:
|
|
|
112
112
|
|
|
113
113
|
# CodeQL requires a push analysis to populate default-branch code-scanning
|
|
114
114
|
# alerts. Keep the full validation gate pull-request-only so main pushes do
|
|
115
|
-
# not duplicate CI, test, or security work.
|
|
116
|
-
#
|
|
117
|
-
# whose default-branch scan is still current; re-scanning it on every release
|
|
118
|
-
# wastes the Rust-heavy analysis budget, and the scheduled audit covers drift.
|
|
115
|
+
# not duplicate CI, test, or security work. Run CodeQL for every main push:
|
|
116
|
+
# commit subjects do not prove that a push contains only release metadata.
|
|
119
117
|
default-branch-codeql:
|
|
120
118
|
name: CodeQL (default branch)
|
|
121
119
|
if: >-
|
|
122
|
-
vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push'
|
|
123
|
-
!startsWith(github.event.head_commit.message, 'chore(main): release ')
|
|
120
|
+
vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'push'
|
|
124
121
|
permissions:
|
|
125
122
|
actions: read
|
|
126
123
|
contents: read
|
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [1.51.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.51.0...v1.51.1) (2026-10-29)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
### Bug Fixes
|
|
7
|
+
|
|
8
|
+
* **ci:** run CodeQL on every main push ([#797](https://github.com/0xPlayerOne/code-foundry/issues/797)) ([d6d299d](https://github.com/0xPlayerOne/code-foundry/commit/d6d299dd5b073d6a5e13ffc2aa016d856208d2e4))
|
|
9
|
+
|
|
10
|
+
## [1.51.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.50.1...v1.51.0) (2026-10-29)
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
### Features
|
|
14
|
+
|
|
15
|
+
* **release:** preserve caller publication overrides ([#795](https://github.com/0xPlayerOne/code-foundry/issues/795)) ([e49d2ba](https://github.com/0xPlayerOne/code-foundry/commit/e49d2bac4f8995808bfc6a726b0c2ff1e93c2a5f))
|
|
16
|
+
|
|
3
17
|
## [1.50.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.50.0...v1.50.1) (2026-10-29)
|
|
4
18
|
|
|
5
19
|
|
|
@@ -126,23 +140,9 @@
|
|
|
126
140
|
|
|
127
141
|
* fix generated agent contribution and validation references ([#760](https://github.com/0xPlayerOne/code-foundry/issues/760)) ([c3564c9](https://github.com/0xPlayerOne/code-foundry/commit/c3564c92cb168449317afe2e40359144bf7a0c71))
|
|
128
142
|
|
|
129
|
-
## [1.47.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.2...v1.47.3) (2026-10-09)
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
### Maintenance
|
|
133
|
-
|
|
134
|
-
* **fleet:** point the manifest at the rollout worktrees and filter adea's actionlint ([#757](https://github.com/0xPlayerOne/code-foundry/issues/757)) ([55bae8b](https://github.com/0xPlayerOne/code-foundry/commit/55bae8bf99a022bfa03294972d89a3cca20a6203))
|
|
135
|
-
|
|
136
|
-
## [1.47.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.47.1...v1.47.2) (2026-10-08)
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
### Bug Fixes
|
|
140
|
-
|
|
141
|
-
* **qualification:** exclude pending parallel syntax by content, not filename ([#755](https://github.com/0xPlayerOne/code-foundry/issues/755)) ([1f7cae8](https://github.com/0xPlayerOne/code-foundry/commit/1f7cae8167002061850e56e3dc0fa800a69d7be9))
|
|
142
|
-
|
|
143
143
|
<!-- code-foundry: packaged changelog -->
|
|
144
144
|
|
|
145
145
|
---
|
|
146
146
|
|
|
147
|
-
This packaged changelog lists the 20 most recent releases;
|
|
147
|
+
This packaged changelog lists the 20 most recent releases; 265 older releases are omitted to keep the package small.
|
|
148
148
|
See the [full changelog](https://github.com/0xPlayerOne/code-foundry/blob/main/CHANGELOG.md) for the complete history.
|
package/docs/CONFIGURATION.md
CHANGED
|
@@ -178,6 +178,8 @@ See [Merge queue validation](merge-queues.md) before enabling it.
|
|
|
178
178
|
| `release_qualification_receipts` | `true`, `false` (default `false`) | Opt in to seven-day source qualification receipts for eligible version-only Release Please PRs. Defaults to false; see [workflow policy](WORKFLOWS.md#standard-triggers) for requirements and fallback behavior. |
|
|
179
179
|
| `release_batching_schedule` | five-field numeric cron | Batch Release Please into scheduled windows. Ordinary pushes skip the producer; release-PR squashes and manual dispatches still run. Batched releases are created privately as drafts and published with prerelease visibility atomically. Manual dispatches publish stable hotfixes. Absent, releases publish per merge. Requires a single root Release Please package. |
|
|
180
180
|
| `release_batching_prerelease` | `true`, `false` | Defaults to `true` with a schedule. Sync enables `draft` and `force-tag-creation` in Release Please; the producer publishes the draft with the selected visibility. `false` keeps scheduled releases stable-visible. |
|
|
181
|
+
| `release_defer_publication` | `true`, `false` (default `false`) | Keep deferred publication enabled in the caller; the reusable workflow skips npm, reconciliation, and post-release hooks. Requires one draft root package with force-tag creation, configured directly or by prerelease batching. |
|
|
182
|
+
| `release_prerelease` | `true`, `false` (unset by default) | Set a fixed prerelease input; unset keeps event-based batching. |
|
|
181
183
|
| `release_batching_soak_hours` | `1`–`336` | Generate a daily promoter that promotes the newest prerelease when the oldest candidate since the last stable has soaked this many hours, stitching batch notes. Requires a batching schedule and prerelease publication. Set `STABLE_PROMOTION_HELD=true` in repository Actions variables to hold scheduled and manual promotion; `force` overrides the hold or soak, and `version` selects a plain semantic version. |
|
|
182
184
|
| `release_batching_qualification_workflow` | workflow filename (for example `release-assets.yml`) | Require the latest release-event run of this workflow for the candidate tag’s exact source commit to succeed before stable promotion. Requires a batching soak. Running, missing, failed, or cancelled runs hold promotion, including named and forced promotions; `force` only bypasses hold and soak. The promoter receives read-only Actions access. |
|
|
183
185
|
| `release_batching_dev_channel` | `true`, `false` | Publish a dev channel: every push to main tags a `v<stable>-dev.<run>` pre-release on top of the newest stable and dispatches the configured asset lane. Dev builds are never promoted to stable, auto builds pause with `CI_BILLING_PAUSED`, and manual dispatches accept a `version` input for repairs. Defaults to `false`. |
|
package/docs/PERFORMANCE.md
CHANGED
|
@@ -14,8 +14,8 @@ budget is exceeded. Reports are generated-run evidence and are ignored by Git.
|
|
|
14
14
|
| Format, lint, type-check, and build | 15 s | Bound the local CI feedback loop |
|
|
15
15
|
| Runtime dependencies | 0 | Keep the installed CLI dependency-free |
|
|
16
16
|
| Development dependencies | 4 | Prevent unreviewed toolchain growth |
|
|
17
|
-
| Packed artifact (without changelog) |
|
|
18
|
-
| Unpacked artifact (without changelog) | 1,
|
|
17
|
+
| Packed artifact (without changelog) | 316.5 kB | Bound registry transfer and install cost |
|
|
18
|
+
| Unpacked artifact (without changelog) | 1,225 kB | Bound installed footprint |
|
|
19
19
|
| Packed files (without changelog) | 120 | Detect accidental release contents |
|
|
20
20
|
|
|
21
21
|
The source-of-truth budgets live in `scripts/performance-check.mjs`. When those
|
|
@@ -29,8 +29,14 @@ included it eroded on every release and repeatedly failed release pull requests.
|
|
|
29
29
|
The check packs a staging copy without the changelog and reports the repository
|
|
30
30
|
changelog size and its packaged (trimmed) size as informational metrics. At
|
|
31
31
|
v1.44.0 the measured artifact was 280,902 packed bytes, 1,070,333 unpacked bytes,
|
|
32
|
-
and 118 files
|
|
33
|
-
|
|
32
|
+
and 118 files.
|
|
33
|
+
|
|
34
|
+
On v1.50.1 base `f671dd8`, the measured artifact was 315,853 packed bytes,
|
|
35
|
+
1,200,759 unpacked bytes, and 120 files. Release caller publication overrides
|
|
36
|
+
measure 316,295 packed bytes, 1,222,905 unpacked bytes, and 120 files: an
|
|
37
|
+
increase of 442 packed bytes and 22,146 unpacked bytes. The packed limit is
|
|
38
|
+
316,500 bytes, leaving 205 bytes of measured headroom; the unpacked and file-count
|
|
39
|
+
limits remain 1,225,000 bytes and 120 files.
|
|
34
40
|
|
|
35
41
|
The published package ships a changelog trimmed to the 20 most recent releases
|
|
36
42
|
with a link to the full history on GitHub. `scripts/package-changelog.mjs`
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "code-foundry",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.51.1",
|
|
4
4
|
"description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
|
|
5
5
|
"homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
|
|
6
6
|
"bugs": {
|
package/src/commands/sync.mjs
CHANGED
|
@@ -900,6 +900,11 @@ jobs:
|
|
|
900
900
|
|
|
901
901
|
/** @param {Record<string, string>} config */
|
|
902
902
|
function validateReleaseBatchingConfig(config) {
|
|
903
|
+
for (const key of ['release_defer_publication', 'release_prerelease']) {
|
|
904
|
+
if (config[key] !== undefined && !['true', 'false'].includes(config[key])) {
|
|
905
|
+
throw new Error(`Unsupported ${key}: ${config[key]}; use true or false.`)
|
|
906
|
+
}
|
|
907
|
+
}
|
|
903
908
|
const schedule = String(config.release_batching_schedule ?? '').trim()
|
|
904
909
|
if (schedule) {
|
|
905
910
|
const limits = [
|
|
@@ -1246,7 +1251,9 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
|
|
|
1246
1251
|
rendered = removeWorkflowBlock(rendered, job)
|
|
1247
1252
|
rendered = rendered.replace(/^ needs: \[preflight\]\n/m, '')
|
|
1248
1253
|
rendered = rendered.replace(/^ config-file: \.github\/release-please-foundry\.json\n/m, '')
|
|
1249
|
-
|
|
1254
|
+
if (config.release_defer_publication !== 'true') {
|
|
1255
|
+
rendered = rendered.replace(/^ defer-publication: true\n/m, '')
|
|
1256
|
+
}
|
|
1250
1257
|
rendered = rendered.replace(
|
|
1251
1258
|
/^ if: github\.ref == 'refs\/heads\/main' && \(vars\.CI_BILLING_PAUSED != 'true' \|\| \(github\.event_name == 'workflow_dispatch' && inputs\['release-while-paused'\] == true\)\)\n/m,
|
|
1252
1259
|
" if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)\n"
|
|
@@ -1266,12 +1273,17 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
|
|
|
1266
1273
|
" if: vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)\n",
|
|
1267
1274
|
" if: >-\n (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && (github.event_name != 'push' || startsWith(github.event.head_commit.message, 'chore(main): release '))\n"
|
|
1268
1275
|
)
|
|
1269
|
-
|
|
1270
|
-
|
|
1271
|
-
|
|
1272
|
-
|
|
1273
|
-
|
|
1274
|
-
|
|
1276
|
+
}
|
|
1277
|
+
const prerelease =
|
|
1278
|
+
config.release_prerelease ||
|
|
1279
|
+
(batchingSchedule && config.release_batching_prerelease !== 'false'
|
|
1280
|
+
? "${{ github.event_name != 'workflow_dispatch' }}"
|
|
1281
|
+
: '')
|
|
1282
|
+
if (prerelease) {
|
|
1283
|
+
rendered = rendered.replace(
|
|
1284
|
+
' git-workflow:',
|
|
1285
|
+
` prerelease: ${prerelease}\n git-workflow:`
|
|
1286
|
+
)
|
|
1275
1287
|
}
|
|
1276
1288
|
const npmSecrets =
|
|
1277
1289
|
configured(config.npm_publish, 'false') !== 'true'
|
|
@@ -1590,8 +1602,8 @@ const DIRECT_DOC_REPLACEMENTS = {
|
|
|
1590
1602
|
'7. Push to the fork and open a pull request targeting `main`.',
|
|
1591
1603
|
],
|
|
1592
1604
|
[
|
|
1593
|
-
'| Event | Expected automation |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `staging` | Fast validation: CI plus unit tests, ending in `Validation / Gate` |\n| Draft ordinary pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready ordinary pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `staging` | Promotion PR workflow; canonical validation waits for the PR event |\n| Push to `main` | Release workflow; CodeQL
|
|
1594
|
-
'| Event | Expected automation |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `main` | Release workflow; CodeQL
|
|
1605
|
+
'| Event | Expected automation |\n| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `staging` | Fast validation: CI plus unit tests, ending in `Validation / Gate` |\n| Draft ordinary pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready ordinary pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `staging` | Promotion PR workflow; canonical validation waits for the PR event |\n| Push to `main` | Release workflow; CodeQL scans every push to main, all commits included |\n',
|
|
1606
|
+
'| Event | Expected automation |\n| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `main` | Release workflow; CodeQL scans every push to main, all commits included |\n',
|
|
1595
1607
|
],
|
|
1596
1608
|
[
|
|
1597
1609
|
'| Change | Target | Merge method | Merge gate |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch | `staging` | Squash | All applicable required checks pass |\n| `staging` → `main` promotion | `main` | Rebase (`merge_strategy`) | Current staging checks, release review, and rollout notes |\n| Release Please version PR | `main` | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass |\n',
|