code-foundry 1.9.6 → 1.9.7

package/.github/CONTRIBUTING.md

@@ -19,7 +19,7 @@ Agents must follow these rules before changing code:
 1. Read this file, `AGENTS.md`, and the relevant project documentation.
 2. Inspect the current branch, worktree, remotes, and existing changes before editing.
 3. Preserve user-owned changes. Never discard or overwrite unrelated work.
-4. Branch from `staging` and target pull requests at `staging`; do not work directly on `main`.
+4. Branch from `main` and target pull requests at `main`; do not push directly to `main`.
 5. Keep the change focused. Do not expand scope without documenting why.
 6. Run the applicable format, lint, type-check, build, unit, performance, integration, E2E, smoke, and security checks.
 7. Report exact validation results, skipped checks, known limitations, and remaining risks.
@@ -35,22 +35,20 @@ Agents must not:
 ## Branching model
 
 ```text
-                                      release PR
-                                   ┌──────────────┐
-                                   │              ▼
-feat/*  fix/*  chore/*  ──PR──▶  staging  ──PR──▶  main
-docs/*  test/*  refactor/*         │              │
-                                   │              └── protected release branch
-                                   └── integration branch
+                              release PR
+                           ┌──────────────┐
+                           │              ▼
+feat/*  fix/*  chore/*  ──PR──▶  main
+docs/*  test/*  refactor/*         │
+                                   └── protected release branch
 ```
 
-| Branch                                                         | Purpose                  | Contribution rule                                                         |
-| -------------------------------------------------------------- | ------------------------ | ------------------------------------------------------------------------- |
-| `main`                                                         | Protected release branch | Merge through the `staging` → `main` release PR. No direct pushes.        |
-| `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
-| `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
+| Branch                                                         | Purpose                  | Contribution rule                                      |
+| -------------------------------------------------------------- | ------------------------ | ------------------------------------------------------ |
+| `main`                                                         | Protected release branch | Merge through pull requests only. No direct pushes.    |
+| `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `main`; keep changes small and reviewable. |
 
-The Git workflow is `staging-release`: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other merge strategy. Re-align `staging` with `main` after a release when needed.
+The Git workflow is `direct`: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Release automation never defaults to a merge method and never merges with `--admin`; `code-foundry doctor` and `code-foundry sync` fail closed on any other release merge strategy. This repository has one protected integration and release branch: `main`.
 
 ## Before you start
 
@@ -67,8 +65,8 @@ The Git workflow is `staging-release`: topic branches **squash** into `staging`,
 ```sh
 git status --short --branch
 git fetch origin
-git switch staging
-git pull --ff-only origin staging
+git switch main
+git pull --ff-only origin main
 git switch -c feat/short-description
 ```
 
@@ -93,7 +91,7 @@ Run the checks relevant to the change. For a release or security-sensitive chang
 
 For maintainers, trusted contributors, and automation agents:
 
-1. Start from an up-to-date `staging` branch.
+1. Start from an up-to-date `main` branch.
 2. Create a focused branch with a descriptive prefix.
 3. Inspect the relevant code and tests before making changes.
 4. Implement the smallest complete change.
@@ -107,9 +105,9 @@ For maintainers, trusted contributors, and automation agents:
    chore(ci): cache Rust dependencies
    ```
 
-8. Push the branch and open a pull request into `staging`.
+8. Push the branch and open a pull request into `main`.
 9. Address review feedback and failed checks on the same branch.
-10. Merge with a squash after required checks pass and the change is ready; feature PRs land on `staging` with squash merges.
+10. Merge with a squash after required checks pass and the change is ready; feature PRs land on `main` with squash merges.
 
 ### Internal agent handoff
 
@@ -130,11 +128,11 @@ For contributors who do not have direct write access:
 
 1. Fork the repository on GitHub.
 2. Add the upstream repository as `upstream`.
-3. Branch from the upstream `staging` branch.
+3. Branch from the upstream `main` branch.
 4. Make a focused change and follow the local setup instructions.
 5. Add tests and documentation for behavior changes.
 6. Run all applicable checks locally.
-7. Push to the fork and open a pull request targeting `staging`.
+7. Push to the fork and open a pull request targeting `main`.
 8. Explain the problem, proposed solution, validation, compatibility, and rollout impact.
 9. Address maintainer feedback without rewriting unrelated history or scope.
 
@@ -157,17 +155,14 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 | Event                                              | Expected automation                                                                   |
 | -------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |
-| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |
-| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |
-| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |
+| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |
+| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |
 | Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate`                         |
 | Scheduled or manual validation                     | Full audit tier                                                                       |
 | Push to a working branch                           | Draft PR workflow                                                                     |
-| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |
 | Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |
 
-Draft pull requests do not start runner-heavy validation. Marking a pull request ready for review starts the applicable validation tier; converting it back to draft cancels in-flight validation, and no replacement starts until it is ready again.
+Draft pull requests do not start validation. Marking a pull request ready for review starts the applicable validation tier. Convert it back to draft after an update, then mark it ready again after every update so the required checks attach to the current head. Converting it to draft runs only the lightweight cancellation control.
 
 Pull-request validation keys concurrency by event and pull-request head, so a newer update cancels its superseded run. Scheduled and manual audits use a separate caller pinned to the protected default branch; this prevents caller-selected runtime code from executing with default-branch cache access. Both callers use the mode-aware orchestrator, which fans out only the required jobs and concludes with the stable aggregate gate.
 
@@ -181,11 +176,10 @@ Security checks can be skipped when repository visibility or the GitHub plan doe
 
 ## Review and merge protocol
 
-| Change                       | Target    | Merge method                                    | Merge gate                                                |
-| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |
-| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |
-| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |
-| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |
+| Change                    | Target | Merge method                      | Merge gate                              |
+| ------------------------- | ------ | --------------------------------- | --------------------------------------- |
+| Working branch            | `main` | Squash                            | All applicable required checks pass     |
+| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |
 
 Reviewers focus on correctness, security, maintainability, test coverage, operational impact, and compatibility. Authors remain responsible for responding to feedback and verifying the final commit.
 
@@ -195,7 +189,7 @@ Report vulnerabilities privately using [SECURITY.md](./SECURITY.md), never in a
 
 For an urgent production or security issue:
 
-1. Create a focused branch from `staging`.
+1. Create a focused branch from `main`.
 2. Document the urgency and affected systems without exposing secrets.
 3. Open a pull request and run the narrowest complete validation available.
 4. Request the appropriate maintainer review.

package/.github/SECURITY.md

@@ -4,11 +4,10 @@
 
 ## Supported Versions
 
-The latest commit on `staging` receives security patches. Patches are promoted to `main` through the next release cycle.
+The latest commit on `main` receives security patches.
 
 | Branch           | Supported |
 | ---------------- | --------- |
-| `staging`        | ✅        |
 | `main`           | ✅        |
 | Feature branches | ❌        |
 

package/.github/code-foundry.yml

@@ -11,7 +11,7 @@ dependency_review: auto
 package_manager: bun
 toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v1.3.1
+runtime_ref: v1.9.6
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later

package/.github/workflows/opencode-security_self-ci.yml

@@ -30,13 +30,13 @@ jobs:
         id: detect
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          OPENCODE_SECURITY_OVERRIDE: ${{ vars.OPENCODE_SECURITY }}
+          OPENCODE_SECURITY: ${{ vars.OPENCODE_SECURITY }}
         run: |
           enabled=false
           token=false
           # OpenCode Security is controlled only by the repository or
           # organization variable. An unset value is disabled.
-          if [ "$OPENCODE_SECURITY_OVERRIDE" = "true" ]; then
+          if [ "$OPENCODE_SECURITY" = "true" ]; then
             enabled=true
           fi
           if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi

package/.github/workflows/release_self-ci.yml

@@ -30,5 +30,4 @@ jobs:
       runtime-ref: ${{ github.sha }}
     secrets:
       CODE_FOUNDRY_TOKEN: ${{ secrets.CODE_FOUNDRY_TOKEN }}
-      STAGING_DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/validation.yml

@@ -80,7 +80,7 @@ permissions:
 jobs:
   ci:
     name: CI
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -92,7 +92,7 @@ jobs:
 
   test:
     name: Test
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit')
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -106,7 +106,7 @@ jobs:
 
   security:
     name: Security
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'audit' || inputs.mode == 'release')
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -129,9 +129,10 @@ jobs:
 
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
-  # The release tier runs no suite jobs: its policy (generated release diff
-  # validation) executes as a conditional step below, so no separate
-  # release-policy job renders skipped checks on ordinary pull requests.
+  # The release tier runs the full audit suite so Release Please pull requests
+  # expose no neutral suite checks. Its generated release diff policy executes
+  # as a conditional step below, so ordinary pull requests still render no
+  # skipped release-policy row.
   gate:
     name: Gate
     needs: [ci, test, security, codeql]

package/AGENTS.md

@@ -71,11 +71,11 @@ Ask for clarification when a missing decision would materially change the implem
 8. Run the broadest applicable validation available.
 9. Report what changed, exact checks and results, skipped checks with reasons, risks, and remaining work.
 
-For normal feature work, branch from `staging` and target pull requests at `staging`. Treat `main` as the protected release branch. Follow `.github/CONTRIBUTING.md` for the complete internal and external contribution flow.
+For normal feature work, branch from `main` and target pull requests at `main`. Treat `main` as the protected release branch. Follow `.github/CONTRIBUTING.md` for the complete internal and external contribution flow.
 
 ## Git workflow and merging
 
-This repository uses the `staging-release` workflow: topic branches **squash** into `staging`, a promotion PR **rebases** validated changes into `main` (`merge_strategy: rebase`), and the Release Please version PR **rebases** into `main` (`release_merge_strategy: rebase`). Feature PRs land on `staging` with squash merges; promotion and release PRs land on `main` with rebase merges. Re-align `staging` with `main` after a release when needed.
+This repository uses the `direct` workflow: topic branches **squash** directly into `main`, and the Release Please version PR **squashes** into `main` (`release_merge_strategy: squash`). Feature and release PRs land on `main` with squash merges. No integration branch exists; all pull requests target `main`.
 
 Merge only with the repository's canonical method. Never merge with `--admin`, never default or auto-select a merge method, and never use a method the branch ruleset does not allow. When in doubt, prefer the merge button's configured method and verify the ruleset after merging. Check `.github/CONTRIBUTING.md` for the complete flow and merge table.
 
@@ -149,7 +149,7 @@ If a check cannot run, state the exact reason. A skipped check is not a passing
 ## GitHub workflows and configuration
 
 - Keep workflows concise, independently runnable, and safe to re-run.
-- Use `push` for `main, staging` and `pull_request` for `staging` unless a workflow has a documented event-specific reason.
+- Use `push` for `main` and `pull_request` for `main` unless a workflow has a documented event-specific reason.
 - Give workflows clear names and jobs concise names; avoid repeating the workflow name in the job name.
 - Use per-workflow concurrency groups that cancel superseded runs while allowing independent workflows to run in parallel.
 - Keep setup language-aware and cache dependency downloads by lockfile; do not cache secrets, `node_modules`, virtual environments, or broad build output without a measured reason.

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.9.7](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.6...v1.9.7) (2026-09-08)
+
+
+### Bug Fixes
+
+* **ci:** run full validation on release PRs ([#517](https://github.com/0xPlayerOne/code-foundry/issues/517)) ([01a3555](https://github.com/0xPlayerOne/code-foundry/commit/01a355505d6372dc26e2d917e0e6d566ab25546c))
+* **sync:** remove direct topology staging residue ([#515](https://github.com/0xPlayerOne/code-foundry/issues/515)) ([2765e6a](https://github.com/0xPlayerOne/code-foundry/commit/2765e6a6f66137d37f3d65f8eb8311ba28eeafd7))
+
 ## [1.9.6](https://github.com/0xPlayerOne/code-foundry/compare/v1.9.5...v1.9.6) (2026-09-08)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.9.6",
+  "version": "1.9.7",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -551,6 +551,21 @@ function renderWorkflow(content, config, repository, ref, rustCodeql) {
   // target main, so their callers trigger on main alone.
   if (!isStagingRelease(config.git_workflow)) {
     rendered = rendered.replace(/^(\s+branches:)\s*\[main,\s*staging\]\s*$/gm, `$1 [main]`)
+    // Direct repositories have no staging branch or release reconciliation,
+    // so their generated release caller must not expose the legacy deploy-key
+    // secret. Keep it in the staging-release template for repositories that
+    // still explicitly select that topology.
+    if (workflow === 'release') {
+      rendered = rendered.replace(
+        /^\s+STAGING_DEPLOY_KEY:\s+\$\{\{\s*secrets\.STAGING_DEPLOY_KEY\s*\}\}\s*\n/m,
+        ''
+      )
+    }
+  } else if (workflow === 'release' && !rendered.includes('STAGING_DEPLOY_KEY')) {
+    rendered = rendered.replace(
+      /^(\s+)CODE_FOUNDRY_TOKEN:\s+\$\{\{\s*secrets\.CODE_FOUNDRY_TOKEN\s*\}\}\s*$/m,
+      '$&\n$1STAGING_DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}'
+    )
   }
   if (workflow === 'draft-pr') {
     // The draft PR caller states the PR base explicitly so the shared
@@ -657,21 +672,26 @@ function stripDependabotEcosystem(content, ecosystem) {
  * @returns {string}
  */
 export function renderContributionDocs(content, file, config) {
-  if (isStagingRelease(config.git_workflow)) {
-    if (configured(config.staging_validation_mode, 'fast') !== 'audit') return content
-    return content.replace(
-      'Fast validation: CI plus unit tests, ending in `Validation / Gate`',
-      'Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`'
-    )
-  }
   const replacements = DIRECT_DOC_REPLACEMENTS[file]
   if (!replacements) return content
   let rendered = content
-  for (const [from, to] of replacements) {
-    if (!rendered.includes(from)) {
-      throw new Error(`Missing direct-workflow template marker in ${file}: ${JSON.stringify(from)}`)
+  const stagingRelease = isStagingRelease(config.git_workflow)
+  for (const [staging, direct] of replacements) {
+    const from = stagingRelease ? direct : staging
+    const to = stagingRelease ? staging : direct
+    if (rendered.includes(from)) {
+      rendered = rendered.replace(from, to)
+    } else if (!rendered.includes(to)) {
+      throw new Error(
+        `Missing ${stagingRelease ? 'staging-release' : 'direct'} workflow template marker in ${file}: ${JSON.stringify(from)}`
+      )
     }
-    rendered = rendered.replace(from, to)
+  }
+  if (stagingRelease && configured(config.staging_validation_mode, 'fast') === 'audit') {
+    rendered = rendered.replace(
+      'Fast validation: CI plus unit tests, ending in `Validation / Gate`',
+      'Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`'
+    )
   }
   return rendered
 }
@@ -729,11 +749,11 @@ const DIRECT_DOC_REPLACEMENTS = {
     ],
     [
       '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `staging`             | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `staging`             | Fast validation: CI plus unit tests, ending in `Validation / Gate`                    |\n| Draft ordinary pull request targeting `main`       | No runner-heavy validation; run local checks before requesting review                 |\n| Ready ordinary pull request targeting `main`       | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate`                         |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `staging`                                  | Promotion PR workflow; canonical validation waits for the PR event                    |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
-      '| Event | Expected automation |\n|------------------------------------------------------------------------------------------------------------------------------------------------|\n| Draft pull request targeting `main` | No runner-heavy validation; run local checks before requesting review |\n| Ready pull request targeting `main` | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate` |\n| Scheduled or manual validation | Full audit tier |\n| Push to a working branch | Draft PR workflow |\n| Push to `main` | Release workflow; canonical validation already ran on the merged PR |',
+      '| Event                                              | Expected automation                                                                   |\n| -------------------------------------------------- | ------------------------------------------------------------------------------------- |\n| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |\n| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |\n| Exact Release Please pull request targeting `main` | Release-policy validation only, ending in `Validation / Gate`                         |\n| Scheduled or manual validation                     | Full audit tier                                                                       |\n| Push to a working branch                           | Draft PR workflow                                                                     |\n| Push to `main`                                     | Release workflow; canonical validation already ran on the merged PR                   |\n',
     ],
     [
       '| Change                       | Target    | Merge method                                    | Merge gate                                                |\n| ---------------------------- | --------- | ----------------------------------------------- | --------------------------------------------------------- |\n| Working branch               | `staging` | Squash                                          | All applicable required checks pass                       |\n| `staging` → `main` promotion | `main`    | Rebase (`merge_strategy`)                       | Current staging checks, release review, and rollout notes |\n| Release Please version PR    | `main`    | Rebase (`release_merge_strategy`, fails closed) | Validation gate and release policy pass                   |\n',
-      '| Change | Target | Merge method | Merge gate |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Working branch | `main` | Squash | All applicable required checks pass |\n| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |',
+      '| Change                    | Target | Merge method                      | Merge gate                              |\n| ------------------------- | ------ | --------------------------------- | --------------------------------------- |\n| Working branch            | `main` | Squash                            | All applicable required checks pass     |\n| Release Please version PR | `main` | Squash (`release_merge_strategy`) | Validation gate and release policy pass |\n',
     ],
     [
       'Draft pull requests do not start runner-heavy validation. Marking a pull request ready for review starts the applicable validation tier; converting it back to draft cancels in-flight validation, and no replacement starts until it is ready again.',

package/src/lib/validation-policy.mjs

@@ -19,9 +19,9 @@ export const RELEASE_PLEASE_PREFIX = 'release-please--branches--main'
 
 /** Stable aggregate check name emitted by the validation orchestrator's gate job. */
 export const AGGREGATE_CHECK_NAME = 'Validation / Gate'
-/** Job ids owned by the validation orchestrator. The release tier runs no
- * suite jobs: its policy executes as a conditional step inside the gate, so
- * no release-policy job id exists. */
+/** Job ids owned by the validation orchestrator. Release runs the full audit
+ * suite and validates its generated diff inside the gate, so no separate
+ * release-policy job id exists. */
 export const VALIDATION_JOBS = ['ci', 'test', 'security', 'codeql']
 
 /** Events that may trigger canonical validation. */
@@ -82,12 +82,10 @@ export function classifyValidationMode(input) {
 const REQUIRED_JOBS_BY_MODE = {
   fast: ['ci', 'test'],
   audit: ['ci', 'test', 'security', 'codeql'],
-  // The release tier skips the CI/test/security suites (the generated release
-  // diff check runs as a conditional step inside the gate itself) but still
-  // runs CodeQL: repository rulesets that require code scanning results need
-  // a CodeQL analysis of the release pull request's commit, and Release
-  // Please pull requests must not deadlock against that requirement.
-  release: ['codeql'],
+  // Release Please pull requests run the full audit suite so every registered
+  // validation check succeeds rather than appearing as an expected skip. The
+  // gate additionally validates the generated release diff.
+  release: ['ci', 'test', 'security', 'codeql'],
 }
 
 /**