From f772b2b5839df8551f288475152eea3941a9c360 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 29 Jun 2026 08:04:34 -0700 Subject: [PATCH] Sharpen the nbgv @master rationale to the accurate cause Reword the inline comment and AGENTS note added in #223 to the established cause (WORKFLOW.md D9.1 / 79-83): nbgv's tag stream lags master, so Dependabot tag-tracking would only propose downgrades to stale tags. Converges wording with the sibling repos. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/build-release-task.yml | 4 ++-- AGENTS.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-release-task.yml b/.github/workflows/build-release-task.yml index f66254a..ee50cf9 100644 --- a/.github/workflows/build-release-task.yml +++ b/.github/workflows/build-release-task.yml @@ -54,8 +54,8 @@ jobs: with: fetch-depth: 0 - # Floated on `master` (not SHA-pinned): upstream tags lag `master`, so a - # pin would only draw spurious Dependabot downgrade PRs. + # Float nbgv on `master`, not SHA-pinned: its tag stream lags `master`, so Dependabot + # tag-tracking would only propose downgrades to stale tags (WORKFLOW.md D9.1). - name: Run Nerdbank.GitVersioning tool step id: nbgv uses: dotnet/nbgv@master diff --git a/AGENTS.md b/AGENTS.md index 3f76e5d..f7fba31 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -29,7 +29,7 @@ Versioning is the one release rule that is a **human process**, not a workflow o - The `version` (major.minor) in [`version.json`](./version.json) is the version floor; NBGV appends the git height (the SemVer patch position). `main` builds a stable `X.Y.`; `develop` builds a prerelease `X.Y.-g`. The maintainer edits `version.json`; dependency bumps, codegen refreshes, CI/workflow fixes, and doc edits leave it untouched. - **Bump `version.json` only for functional changes, by maintainer instruction.** Raise the major/minor when the work warrants a new semantic version - a new feature, a behavior or API change, a breaking change - in the PR that introduces it (typically on `develop`). Do not bump on a fixed cadence or mechanically after a release. - **No post-release bump; no develop-ahead requirement.** NBGV advances the patch (git height) on every commit, so a release always gets a fresh build version with no `version.json` edit and there is no `bump-version-X.Y` PR after a release. A `develop -> main` promotion carries whatever `version.json` is current: a promotion with a functional bump releases that new version on `main`; a maintenance-only promotion (dependency/codegen bumps, CI/doc fixes) carries the unchanged `version.json` and `main` advances only its NBGV height. -- **`dotnet/nbgv` is consumed via `@master`, never SHA-pinned.** Its upstream tag stream lags `master` substantially, so a SHA pin would only draw spurious Dependabot downgrade PRs; the rationale is documented inline in [`build-release-task.yml`](./.github/workflows/build-release-task.yml). Do not convert it to a SHA pin. +- **`dotnet/nbgv` is consumed via `@master`, never SHA-pinned.** Its tag stream lags `master` such that Dependabot tag-tracking would only propose downgrades to stale tags; this is the sole WORKFLOW.md D9.1 exception (rationale inline in the workflow). Do not SHA-pin it. ## Pull Request Title and Commit Message Conventions