code-foundry 1.6.0 → 1.7.0

package/.github/CONTRIBUTING.md

@@ -163,7 +163,7 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 | Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |
 | Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |
 
-The single validation caller keys concurrency by event and pull-request head. A newer update to the same pull request cancels its superseded validation run; scheduled and manual audits remain independent. The mode-aware orchestrator fans out only the jobs required by that event and always concludes with the stable aggregate gate.
+Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Both callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate.
 
 Required checks are enforced by branch protection rulesets/branch protection. Do not duplicate their checklists in the pull request description; document validation commands and results instead.
 

package/.github/code-foundry.yml

@@ -16,8 +16,8 @@ release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: direct
-merge_strategy: rebase
-release_merge_strategy: rebase
+merge_strategy: squash
+release_merge_strategy: squash
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 performance_runner: ubuntu-latest

package/.github/workflows/release-pr.yml

@@ -257,7 +257,7 @@ jobs:
             --method POST
             --field base=main
             --field head="$PROMOTION_BRANCH"
-            --field title="Promote staging -> main ($DATE)"
+            --field title="chore(main): promote staging to main ($DATE)"
             --field body=@"$BODY_FILE"
           )
           if [ "$HAS_AUTOMATION_TOKEN" != true ]; then

package/.github/workflows/validation_audit_self-ci.yml

@@ -0,0 +1,43 @@
+name: Code Foundry Audit
+
+on:
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: code-foundry-audit-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  # Default-branch-capable events must not call the local reusable workflow:
+  # a pull request could otherwise change that workflow and feed an untrusted
+  # runtime ref into steps that can populate the protected branch cache. Use
+  # the protected default branch for both workflow code and runtime code.
+  validation:
+    name: Validation
+    if: vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: 0xPlayerOne/code-foundry/.github/workflows/validation.yml@main
+    with:
+      mode: audit
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: main
+      ci-runner: ubuntu-latest
+      test-runner: ubuntu-latest
+      unit-runner: ubuntu-slim
+      performance-runner: ubuntu-latest
+      security-runner: ubuntu-slim
+      codeql-runner: ubuntu-latest
+      rust-shards: '["all"]'
+      rust-threads: '1'
+      rust-max-parallel: 1
+    secrets:
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}

package/.github/workflows/validation_self-ci.yml

@@ -8,16 +8,12 @@ on:
       - synchronize
       - reopened
       - ready_for_review
-  schedule:
-    - cron: '31 6 * * 1'
-  workflow_dispatch:
 
 # Default every caller job to no repository permissions. Individual jobs grant
 # only the scopes their own validation path consumes.
 permissions: {}
 
-# Superseded PR updates cancel the previous run; schedule and dispatch runs
-# are keyed by event so periodic audits and manual runs stay independent.
+# Superseded PR updates cancel the previous run.
 concurrency:
   group: code-foundry-validation-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
@@ -77,9 +73,9 @@ jobs:
       mode: ${{ needs.mode.outputs.mode }}
       runtime-repository: 0xPlayerOne/code-foundry
       # Pull requests validate the proposed runtime commit. Scheduled and
-      # manually dispatched audits stay on the protected default branch so a
-      # selected branch cannot supply privileged runtime code.
-      runtime-ref: ${{ github.event_name == 'pull_request' && github.sha || 'main' }}
+      # manually dispatched audits are isolated in validation_audit_self-ci.yml
+      # so this caller-selected ref never runs with default-branch cache access.
+      runtime-ref: ${{ github.sha }}
       ci-runner: ubuntu-latest
       test-runner: ubuntu-latest
       unit-runner: ubuntu-slim

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.7.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.6.1...v1.7.0) (2026-09-08)
+
+
+### Features
+
+* **release:** standardize generated PR titles ([#497](https://github.com/0xPlayerOne/code-foundry/issues/497)) ([44de0c4](https://github.com/0xPlayerOne/code-foundry/commit/44de0c4f1261a017a0395ddae268c203cccc71b4))
+
+## [1.6.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.6.0...v1.6.1) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** isolate default-branch security audits ([5ea0914](https://github.com/0xPlayerOne/code-foundry/commit/5ea09146af9995f16d1ab4e9a73f14a13582da36))
+
 ## [1.6.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.5.4...v1.6.0) (2026-09-08)
 
 

package/docs/CONFIGURATION.md

@@ -98,8 +98,8 @@ present.
 - `direct` (default): feature branches open pull requests directly into
   `main`. Validation and security scans run on every PR. No `staging` branch
   exists, no promotion caller is generated, and `merge_strategy` is not
-  enforced. Release Please version PRs use `release_merge_strategy` (rebase by
-  default; squash is also allowed). Dependabot updates target `main`. This is
+  enforced. Release Please version PRs squash into `main`
+  (`release_merge_strategy: squash`). Dependabot updates target `main`. This is
   the right choice when a repository has no preview or staging environment.
 - `staging-release` (opt-in): feature branches squash into `staging`, a
   promotion PR rebases validated changes into `main` (`merge_strategy:

package/docs/RELEASES.md

@@ -24,9 +24,8 @@ topology, feature and fix branches land on `staging` with **squash** merges,
 the `staging` → `main` promotion PR merges with **rebase** (`merge_strategy:
 rebase`), and Release Please version PRs merge with **rebase**
 (`release_merge_strategy: rebase`). In the `direct` topology, feature and fix
-branches squash straight into `main` and Release Please version PRs use the
-configured `release_merge_strategy` (**rebase** by default, or **squash** when
-opted in). `merge_strategy` is not enforced. Release automation never defaults
+branches squash straight into `main` and Release Please version PRs squash into
+`main` (`release_merge_strategy: squash`). `merge_strategy` is not enforced. Release automation never defaults
 to a merge method and never merges with `--admin`: `staging-release` accepts
 only rebase for release PRs, while `direct` accepts rebase or squash.
 
@@ -46,7 +45,7 @@ release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
 git_workflow: direct # direct (default) or staging-release
 merge_strategy: rebase # staging-release only: staging -> main promotion PRs rebase
-release_merge_strategy: rebase # required; direct also allows squash
+release_merge_strategy: squash # direct default; staging-release requires rebase
 ```
 
 `git_workflow: staging-release` is opt-in; without it, repositories use the
@@ -136,6 +135,6 @@ already passed).
 
 1. Merge tested changes into `main` (direct: feature PRs; staging-release: promote `staging` into `main`).
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's configured `release_merge_strategy` (**rebase** by default; **squash** is also valid for direct topology).
+3. Merge the release PR with squash in the direct topology (`release_merge_strategy: squash`).
 4. Confirm the GitHub Release and any package publication.
 5. staging-release only: synchronize `staging` with the new `main` release commit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/release-please-config.json

@@ -1,6 +1,8 @@
 {
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "bump-minor-pre-major": true,
+  "pull-request-title-pattern": "chore(main): release ${version}",
+  "group-pull-request-title-pattern": "chore(main): release ${version}",
   "changelog-sections": [
     { "type": "feat", "section": "Features" },
     { "type": "fix", "section": "Bug Fixes" },

package/src/commands/sync.mjs

@@ -108,7 +108,7 @@ export function syncRepository(options) {
   const existingConfig = readConfig(configPath)
   if (!Object.keys(existingConfig).length && !options.init)
     throw new Error('Missing .github/code-foundry.yml; run init first.')
-  const defaults = createDefaultConfig(target, source)
+  const defaults = createDefaultConfig(target, source, existingConfig.git_workflow)
   let config = { ...defaults, ...existingConfig }
   // Resolve and validate the license policy before any sync writes occur
   // (including config/default additions) so an unsupported policy fails
@@ -658,7 +658,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       'This repository uses the `staging-release` workflow: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Feature PRs land on `staging` with squash merges; promotion and release PRs land on `main` with rebase merges. Re-align `staging` with `main` after a release when needed.',
-      'This repository uses the `direct` workflow: topic branches **squash** directly into `main`, and the Release Please version PR lands on `main` with the configured `release_merge_strategy` (rebase by default, or squash when opted in). Feature PRs land on `main` with squash merges. No integration branch exists; all pull requests target `main`.',
+      'This repository uses the `direct` workflow: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Feature and release PRs land on `main` with squash merges. No integration branch exists; all pull requests target `main`.',
     ],
   ],
   '.github/CONTRIBUTING.md': [
@@ -676,7 +676,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       'The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.',
-      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR lands on `main` with the configured `release_merge_strategy` (rebase by default, or squash when opted in). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. Feature branches never touch `staging`; repositories with a preview/staging environment opt into `git_workflow: staging-release` explicitly.',
+      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. Feature branches never touch `staging`; repositories with a preview/staging environment opt into `git_workflow: staging-release` explicitly.',
     ],
     [
       'git switch staging\ngit pull --ff-only origin staging',
@@ -702,7 +702,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
-      '| Change | Target | Merge method | Merge gate |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Working branch | `main` | Squash | All applicable required checks pass |\n| Release Please version PR | `main` | Configured `release_merge_strategy` (rebase default, or squash in the direct topology) | Validation gate and release policy pass |',
+      '| Change | Target | Merge method | Merge gate |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Working branch | `main` | Squash | All applicable required checks pass |\n| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |',
     ],
     ['1. Create a focused branch from `staging`.', '1. Create a focused branch from `main`.'],
   ],
@@ -1068,11 +1068,12 @@ function buffersEqual(a, b) {
   return a.equals(b)
 }
 
-/** @param {string} root @param {string} source @returns {Record<string,string>} */
-function createDefaultConfig(root, source) {
+/** @param {string} root @param {string} source @param {string|undefined} configuredWorkflow @returns {Record<string,string>} */
+function createDefaultConfig(root, source, configuredWorkflow) {
   const languages = detectLanguages(root).join(',')
   const packageManager = detectPackageManager(root)
   const runners = recommendRunners(root)
+  const stagingRelease = configuredWorkflow === 'staging-release'
   return {
     version: '1',
     profile: detectProfile(root),
@@ -1107,8 +1108,8 @@ function createDefaultConfig(root, source) {
     custom_workflows: 'preserve',
     license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later',
     git_workflow: 'direct',
-    merge_strategy: 'rebase',
-    release_merge_strategy: 'rebase',
+    merge_strategy: stagingRelease ? 'rebase' : 'squash',
+    release_merge_strategy: stagingRelease ? 'rebase' : 'squash',
   }
 }