code-foundry 1.9.5 → 1.9.7

package/src/lib/github-doctor.mjs

@@ -71,7 +71,42 @@ export function doctorGithub(root) {
     )
   }
 
-  const config = readConfig(root)
+  const config = readConfig(join(root, '.github/code-foundry.yml'))
+  const repositorySettings = ghJson(['api', `repos/${repository}`]) ?? {}
+  const configuredWorkflow = config.git_workflow ?? 'direct'
+  details.mergeMethods = {
+    squash: repositorySettings.allow_squash_merge,
+    rebase: repositorySettings.allow_rebase_merge,
+    merge: repositorySettings.allow_merge_commit,
+    autoMerge: repositorySettings.allow_auto_merge,
+  }
+  if (configuredWorkflow === 'direct') {
+    if (repositorySettings.allow_squash_merge !== true)
+      errors.push('direct topology requires squash merging to be enabled.')
+    if (
+      repositorySettings.allow_rebase_merge === true ||
+      repositorySettings.allow_merge_commit === true
+    )
+      errors.push('direct topology must disable rebase and merge-commit methods.')
+    if (config.release_type !== 'none' && repositorySettings.allow_auto_merge !== true)
+      errors.push('automated releases require repository auto-merge to be enabled.')
+    details.stagingBranchExists = Boolean(
+      ghJson(['api', `repos/${repository}/branches/staging`])?.name
+    )
+    if (details.stagingBranchExists)
+      errors.push('direct topology still has a staging branch; remove the obsolete branch.')
+    for (const ruleset of mainRulesets) {
+      for (const rule of ruleset.rules ?? []) {
+        if (rule?.type !== 'pull_request') continue
+        const methods = rule.parameters?.allowed_merge_methods ?? []
+        if (methods.length !== 1 || methods[0] !== 'squash') {
+          errors.push(
+            `main ruleset ${ruleset.name ?? ruleset.id} must allow only squash merges; got ${methods.join(', ') || '(none)'}.`
+          )
+        }
+      }
+    }
+  }
   if (
     ['workflow-dispatch', 'dispatch'].includes(config.post_release_mode) &&
     config.post_release !== 'false' &&
@@ -80,11 +115,19 @@ export function doctorGithub(root) {
   ) {
     errors.push('post-release workflow-dispatch mode requires CODE_FOUNDRY_TOKEN to be present.')
   }
+  const repositoryVariables =
+    ghJson(['variable', 'list', '--repo', repository, '--json', 'name,value']) ?? []
+  const opencodeSecurityVariable = Array.isArray(repositoryVariables)
+    ? repositoryVariables.find(
+        /** @param {{ name?: string }} variable */ (variable) =>
+          variable.name === 'OPENCODE_SECURITY'
+      )
+    : undefined
   const credentialChecks = {
     npmTokenPresent: secretNames.includes('NPM_TOKEN'),
     turboTokenPresent: secretNames.includes('TURBO_TOKEN'),
     turboTeamPresent: Boolean(
-      ghJson(['variable', 'list', '--repo', repository, '--json', 'name'])?.some(
+      repositoryVariables.some(
         /** @param {{ name?: string }} variable */ (variable) => variable.name === 'TURBO_TEAM'
       )
     ),
@@ -103,18 +146,15 @@ export function doctorGithub(root) {
       'turbo_remote is enabled but TURBO_TOKEN and/or TURBO_TEAM is not configured; remote caching will be skipped.'
     )
   if (
-    ['true', 'auto'].includes(config.opencode_security ?? 'false') &&
+    String(opencodeSecurityVariable?.value ?? 'false').toLowerCase() === 'true' &&
     !credentialChecks.opencodeApiKeyPresent
   )
     warnings.push(
-      'opencode_security is enabled but OPENCODE_API_KEY is not configured; the optional scan will be skipped.'
+      'OPENCODE_SECURITY is true but OPENCODE_API_KEY is not configured; the optional scan will be skipped.'
     )
-  if (['true', 'auto'].includes(config.opencode_security ?? 'false'))
-    details.credentials.opencodeSecurityConfigured = true
-  details.credentials.opencodeSecurityVariable =
-    ghJson(['variable', 'list', '--repo', repository, '--json', 'name'])?.some(
-      /** @param {{ name?: string }} variable */ (variable) => variable.name === 'OPENCODE_SECURITY'
-    ) ?? false
+  details.credentials.opencodeSecurityEnabled =
+    String(opencodeSecurityVariable?.value ?? 'false').toLowerCase() === 'true'
+  details.credentials.opencodeSecurityVariable = Boolean(opencodeSecurityVariable)
 
   const prs = ghJson([
     'pr',

package/src/lib/validation-policy.mjs

@@ -19,9 +19,9 @@ export const RELEASE_PLEASE_PREFIX = 'release-please--branches--main'
 
 /** Stable aggregate check name emitted by the validation orchestrator's gate job. */
 export const AGGREGATE_CHECK_NAME = 'Validation / Gate'
-/** Job ids owned by the validation orchestrator. The release tier runs no
- * suite jobs: its policy executes as a conditional step inside the gate, so
- * no release-policy job id exists. */
+/** Job ids owned by the validation orchestrator. Release runs the full audit
+ * suite and validates its generated diff inside the gate, so no separate
+ * release-policy job id exists. */
 export const VALIDATION_JOBS = ['ci', 'test', 'security', 'codeql']
 
 /** Events that may trigger canonical validation. */
@@ -82,12 +82,10 @@ export function classifyValidationMode(input) {
 const REQUIRED_JOBS_BY_MODE = {
   fast: ['ci', 'test'],
   audit: ['ci', 'test', 'security', 'codeql'],
-  // The release tier skips the CI/test/security suites (the generated release
-  // diff check runs as a conditional step inside the gate itself) but still
-  // runs CodeQL: repository rulesets that require code scanning results need
-  // a CodeQL analysis of the release pull request's commit, and Release
-  // Please pull requests must not deadlock against that requirement.
-  release: ['codeql'],
+  // Release Please pull requests run the full audit suite so every registered
+  // validation check succeeds rather than appearing as an expected skip. The
+  // gate additionally validates the generated release diff.
+  release: ['ci', 'test', 'security', 'codeql'],
 }
 
 /**