releaselisted

# Cutting a release CI's Version guard fails any push that changes `CODE_PATHS` without a version bump. `CODE_PATHS` is `crates/ Cargo.toml Cargo.lock vendor/ scripts/`. Everything else — `.github/`, `docs/`, `README.md`, `CHANGELOG.md`, `CONTRIBUTING.md` — is exempt and needs no bump. **Never run a bare `git tag -a vX.Y.Z`.** It tags whatever HEAD happens to be, which across git worktrees is frequently a different branch. That is how v0.13.1 landed on v0.13.0's commit: the release shipped `.deb` and `.rpm` packages declaring the previous version, and CI then failed four times with a message about a bump that had already been made. Use the script; it passes an explicit sha and verifies where the tag landed. ## The sequence ```sh scripts/bump-version.py patch # or minor / major # add a `## [<new>] — <date>` section to CHANGELOG.md git add -A && git commit # bump + changelog + the change, one commit scripts/bump-version.py --tag # tags HEAD, refuses if HEAD is not the bump git push origin main --follow-tags ``` `--tag` refuses unless HEAD's own `Cargo.toml` declares the version being tagged, then re-reads the tag to confirm it landed where intended. ## Choosing the level Pre-1.0 semantics, per `CONTRIBUTING.md`: | Level | When | |---|---| | `major` | not used before 1.0 | | `minor` | features, new report fields, new modules, anything breaking | | `patch` | fixes, performance, dependency upgrades, test-only changes | A dependency upgrade that closes