code-foundry 1.6.1 → 1.8.0

package/.github/code-foundry.yml

@@ -16,8 +16,8 @@ release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
 git_workflow: direct
-merge_strategy: rebase
-release_merge_strategy: rebase
+merge_strategy: squash
+release_merge_strategy: squash
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 performance_runner: ubuntu-latest

package/.github/workflows/release-pr.yml

@@ -257,7 +257,7 @@ jobs:
             --method POST
             --field base=main
             --field head="$PROMOTION_BRANCH"
-            --field title="Promote staging -> main ($DATE)"
+            --field title="chore(main): promote staging to main ($DATE)"
             --field body=@"$BODY_FILE"
           )
           if [ "$HAS_AUTOMATION_TOKEN" != true ]; then

package/.gitignore

@@ -39,6 +39,8 @@ htmlcov/
 .coverage*
 .next/
 artifacts/
+performance-results.json
+performance-results/
 cache/
 !.github/actions/cache/
 !.github/actions/cache/action.yml

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.8.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.7.0...v1.8.0) (2026-09-08)
+
+
+### Features
+
+* **performance:** enforce source budgets ([#499](https://github.com/0xPlayerOne/code-foundry/issues/499)) ([2f65ba1](https://github.com/0xPlayerOne/code-foundry/commit/2f65ba127f8fe186eda5d6bcae77150f13458428))
+
+## [1.7.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.6.1...v1.7.0) (2026-09-08)
+
+
+### Features
+
+* **release:** standardize generated PR titles ([#497](https://github.com/0xPlayerOne/code-foundry/issues/497)) ([44de0c4](https://github.com/0xPlayerOne/code-foundry/commit/44de0c4f1261a017a0395ddae268c203cccc71b4))
+
 ## [1.6.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.6.0...v1.6.1) (2026-09-08)
 
 

package/docs/CONFIGURATION.md

@@ -98,8 +98,8 @@ present.
 - `direct` (default): feature branches open pull requests directly into
   `main`. Validation and security scans run on every PR. No `staging` branch
   exists, no promotion caller is generated, and `merge_strategy` is not
-  enforced. Release Please version PRs use `release_merge_strategy` (rebase by
-  default; squash is also allowed). Dependabot updates target `main`. This is
+  enforced. Release Please version PRs squash into `main`
+  (`release_merge_strategy: squash`). Dependabot updates target `main`. This is
   the right choice when a repository has no preview or staging environment.
 - `staging-release` (opt-in): feature branches squash into `staging`, a
   promotion PR rebases validated changes into `main` (`merge_strategy:

package/docs/PERFORMANCE.md

@@ -0,0 +1,58 @@
+# Performance budgets and baselines
+
+Code Foundry measures its source runtime with `bun run performance:check`. The
+check writes `performance-results.json` for CI artifact upload and fails when a
+budget is exceeded. Generated reports are ignored by Git because measurements
+belong to the run that produced them, not the source tree.
+
+## Enforced budgets
+
+| Metric                              | Budget | Why it is bounded                                    |
+| ----------------------------------- | -----: | ---------------------------------------------------- |
+| CLI help startup p95                | 250 ms | Detect eager imports and startup regressions         |
+| Runtime mode startup p95            | 250 ms | Detect baseline runtime initialization regressions   |
+| Focused runtime tests               |   10 s | Keep the representative runtime contract inexpensive |
+| Format, lint, type-check, and build |   15 s | Bound the local CI feedback loop                     |
+| Runtime dependencies                |      0 | Keep the installed CLI dependency-free               |
+| Development dependencies            |      4 | Prevent unreviewed toolchain growth                  |
+| Packed artifact                     | 200 kB | Bound registry transfer and install cost             |
+| Unpacked artifact                   | 750 kB | Bound installed footprint                            |
+| Packed files                        |     80 | Detect accidental release contents                   |
+
+The performance workflow disables build-cache reads and writes for this task.
+That makes timing comparisons independent of a warm protected-branch cache and
+prevents benchmark code from populating shared cache entries.
+
+## v1.6.1 baseline
+
+Measurements were taken on 2026-09-08 with Node 24.18.0. Process startup used
+30 measured samples after four warmups; before and after samples were
+interleaved on the same host.
+
+| Measurement                |   Before |                   After |   Change |
+| -------------------------- | -------: | ----------------------: | -------: |
+| CLI help median            | 36.11 ms |                29.57 ms |   -18.1% |
+| CLI help p95               | 38.11 ms |                31.56 ms |   -17.2% |
+| Runtime mode median        |        - |                35.94 ms | baseline |
+| Focused runtime tests      |        - |                  2.08 s | baseline |
+| Local CI checks            |        - |                  0.50 s | baseline |
+| Packed / unpacked artifact |        - | 160,114 / 616,887 bytes | baseline |
+| Packed files               |        - |                      74 | baseline |
+
+The startup reduction comes from loading command implementations only after
+argument parsing selects a command. `--help` no longer imports sync, release,
+fleet, doctor, and CI command modules.
+
+The first isolated full hosted audit completed in 3 minutes 2 seconds. Its
+longest jobs were TypeScript CodeQL (66 s), dependency audit (62 s), and unit
+tests (46 s); all other suite jobs completed in 20 seconds or less. Those
+measurements identify the three lanes to optimize before adding more CI fanout.
+
+## Release path
+
+Treat budget changes like source changes: explain the measured reason in a
+pull request, run the complete validation gate, and merge only when the new
+result artifact is available. A Release Please PR then carries the change into
+the next version. Never raise a budget solely to clear CI; include before/after
+measurements and the expected effect on local feedback, hosted runner time,
+package transfer, or installed footprint.

package/docs/README.md

@@ -12,6 +12,7 @@ its own names, environments, and deployment details.
 - [Release management](RELEASES.md)
 - [Publishing packages](PUBLISHING.md)
 - [Caching and remote caching](CACHING.md)
+- [Performance budgets and baselines](PERFORMANCE.md)
 
 ## Repository-specific documentation
 

package/docs/RELEASES.md

@@ -24,9 +24,8 @@ topology, feature and fix branches land on `staging` with **squash** merges,
 the `staging` → `main` promotion PR merges with **rebase** (`merge_strategy:
 rebase`), and Release Please version PRs merge with **rebase**
 (`release_merge_strategy: rebase`). In the `direct` topology, feature and fix
-branches squash straight into `main` and Release Please version PRs use the
-configured `release_merge_strategy` (**rebase** by default, or **squash** when
-opted in). `merge_strategy` is not enforced. Release automation never defaults
+branches squash straight into `main` and Release Please version PRs squash into
+`main` (`release_merge_strategy: squash`). `merge_strategy` is not enforced. Release automation never defaults
 to a merge method and never merges with `--admin`: `staging-release` accepts
 only rebase for release PRs, while `direct` accepts rebase or squash.
 
@@ -46,7 +45,7 @@ release_type: auto # auto, node, python, rust, simple, or none
 npm_publish: false # true only for an npm package
 git_workflow: direct # direct (default) or staging-release
 merge_strategy: rebase # staging-release only: staging -> main promotion PRs rebase
-release_merge_strategy: rebase # required; direct also allows squash
+release_merge_strategy: squash # direct default; staging-release requires rebase
 ```
 
 `git_workflow: staging-release` is opt-in; without it, repositories use the
@@ -136,6 +135,6 @@ already passed).
 
 1. Merge tested changes into `main` (direct: feature PRs; staging-release: promote `staging` into `main`).
 2. Review the generated Release Please PR and changelog.
-3. Merge the release PR with the repository's configured `release_merge_strategy` (**rebase** by default; **squash** is also valid for direct topology).
+3. Merge the release PR with squash in the direct topology (`release_merge_strategy: squash`).
 4. Confirm the GitHub Release and any package publication.
 5. staging-release only: synchronize `staging` with the new `main` release commit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.6.1",
+  "version": "1.8.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {
@@ -43,6 +43,7 @@
     "format:check": "oxfmt --check .",
     "fmt": "oxfmt .",
     "lint": "oxlint",
+    "performance:check": "node scripts/performance-check.mjs",
     "test": "node --test",
     "test:unit": "node --test",
     "type-check": "tsc --project jsconfig.json",

package/release-please-config.json

@@ -1,6 +1,8 @@
 {
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "bump-minor-pre-major": true,
+  "pull-request-title-pattern": "chore(main): release ${version}",
+  "group-pull-request-title-pattern": "chore(main): release ${version}",
   "changelog-sections": [
     { "type": "feat", "section": "Features" },
     { "type": "fix", "section": "Bug Fixes" },

package/src/cli.mjs

@@ -4,16 +4,6 @@
 import { resolve } from 'node:path'
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
-import { doctor } from './commands/doctor.mjs'
-import {
-  dispatchPostReleaseHook,
-  reconcileRelease,
-  releaseRecoveryPlan,
-  validateReleasePullRequestDiffs,
-} from './commands/release.mjs'
-import { discoverRepositories, upgradeFleet } from './commands/fleet.mjs'
-import { syncRepository } from './commands/sync.mjs'
-import { manageCiBilling } from './commands/ci.mjs'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
@@ -133,12 +123,13 @@ function parseArgs(argv) {
   return { command, options }
 }
 
-function main() {
+async function main() {
   const { command, options } = parseArgs(process.argv.slice(2))
   const target = resolve(options.target)
 
   if (command === 'init') {
     try {
+      const { syncRepository } = await import('./commands/sync.mjs')
       syncRepository({
         target,
         source: packageRoot,
@@ -151,12 +142,14 @@ function main() {
     }
   } else if (command === 'sync') {
     try {
+      const { syncRepository } = await import('./commands/sync.mjs')
       syncRepository({ target, source: packageRoot, dryRun: options.dryRun, force: options.force })
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))
     }
   } else if (command === 'doctor') {
     try {
+      const { doctor } = await import('./commands/doctor.mjs')
       doctor(target, { github: options.github })
     } catch (error) {
       console.error(`code-foundry: ${error instanceof Error ? error.message : String(error)}`)
@@ -164,6 +157,12 @@ function main() {
     }
   } else if (command === 'release') {
     try {
+      const {
+        dispatchPostReleaseHook,
+        reconcileRelease,
+        releaseRecoveryPlan,
+        validateReleasePullRequestDiffs,
+      } = await import('./commands/release.mjs')
       if (options.releaseSubcommand === 'hook') dispatchPostReleaseHook(target, options)
       else if (options.releaseSubcommand === 'validate-prs') validateReleasePullRequestDiffs(target)
       else if (options.releaseSubcommand === 'recovery-plan') releaseRecoveryPlan(target)
@@ -173,6 +172,7 @@ function main() {
     }
   } else if (command === 'fleet') {
     try {
+      const { discoverRepositories, upgradeFleet } = await import('./commands/fleet.mjs')
       const root = resolve(options.root)
       if (options.fleetSubcommand === 'status')
         console.log(JSON.stringify(discoverRepositories(root), null, 2))
@@ -189,6 +189,7 @@ function main() {
     }
   } else if (command === 'ci') {
     try {
+      const { manageCiBilling } = await import('./commands/ci.mjs')
       manageCiBilling(target, /** @type {'pause'|'resume'|'status'} */ (options.ciSubcommand))
     } catch (error) {
       fail(error instanceof Error ? error.message : String(error))
@@ -196,7 +197,7 @@ function main() {
   } else fail(`unknown command: ${command}`)
 }
 
-main()
+await main()
 
 /** @param {string} root @returns {string} */
 function readPackageVersion(root) {

package/src/commands/sync.mjs

@@ -108,7 +108,7 @@ export function syncRepository(options) {
   const existingConfig = readConfig(configPath)
   if (!Object.keys(existingConfig).length && !options.init)
     throw new Error('Missing .github/code-foundry.yml; run init first.')
-  const defaults = createDefaultConfig(target, source)
+  const defaults = createDefaultConfig(target, source, existingConfig.git_workflow)
   let config = { ...defaults, ...existingConfig }
   // Resolve and validate the license policy before any sync writes occur
   // (including config/default additions) so an unsupported policy fails
@@ -658,7 +658,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       'This repository uses the `staging-release` workflow: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Feature PRs land on `staging` with squash merges; promotion and release PRs land on `main` with rebase merges. Re-align `staging` with `main` after a release when needed.',
-      'This repository uses the `direct` workflow: topic branches **squash** directly into `main`, and the Release Please version PR lands on `main` with the configured `release_merge_strategy` (rebase by default, or squash when opted in). Feature PRs land on `main` with squash merges. No integration branch exists; all pull requests target `main`.',
+      'This repository uses the `direct` workflow: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Feature and release PRs land on `main` with squash merges. No integration branch exists; all pull requests target `main`.',
     ],
   ],
   '.github/CONTRIBUTING.md': [
@@ -676,7 +676,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       'The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.',
-      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR lands on `main` with the configured `release_merge_strategy` (rebase by default, or squash when opted in). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. Feature branches never touch `staging`; repositories with a preview/staging environment opt into `git_workflow: staging-release` explicitly.',
+      'The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. Feature branches never touch `staging`; repositories with a preview/staging environment opt into `git_workflow: staging-release` explicitly.',
     ],
     [
       'git switch staging\ngit pull --ff-only origin staging',
@@ -702,7 +702,7 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
-      '| Change | Target | Merge method | Merge gate |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Working branch | `main` | Squash | All applicable required checks pass |\n| Release Please version PR | `main` | Configured `release_merge_strategy` (rebase default, or squash in the direct topology) | Validation gate and release policy pass |',
+      '| Change | Target | Merge method | Merge gate |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Working branch | `main` | Squash | All applicable required checks pass |\n| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |',
     ],
     ['1. Create a focused branch from `staging`.', '1. Create a focused branch from `main`.'],
   ],
@@ -1068,11 +1068,12 @@ function buffersEqual(a, b) {
   return a.equals(b)
 }
 
-/** @param {string} root @param {string} source @returns {Record<string,string>} */
-function createDefaultConfig(root, source) {
+/** @param {string} root @param {string} source @param {string|undefined} configuredWorkflow @returns {Record<string,string>} */
+function createDefaultConfig(root, source, configuredWorkflow) {
   const languages = detectLanguages(root).join(',')
   const packageManager = detectPackageManager(root)
   const runners = recommendRunners(root)
+  const stagingRelease = configuredWorkflow === 'staging-release'
   return {
     version: '1',
     profile: detectProfile(root),
@@ -1107,8 +1108,8 @@ function createDefaultConfig(root, source) {
     custom_workflows: 'preserve',
     license: existsSync(join(root, 'LICENSE')) ? 'preserve' : 'gpl-3.0-or-later',
     git_workflow: 'direct',
-    merge_strategy: 'rebase',
-    release_merge_strategy: 'rebase',
+    merge_strategy: stagingRelease ? 'rebase' : 'squash',
+    release_merge_strategy: stagingRelease ? 'rebase' : 'squash',
   }
 }
 

package/src/templates/gitignore

@@ -39,6 +39,8 @@ htmlcov/
 .coverage*
 .next/
 artifacts/
+performance-results.json
+performance-results/
 cache/
 !.github/actions/cache/
 !.github/actions/cache/action.yml