chore(release)!: bump version.json 10.3 → 11.0 + add semver policy to CLAUDE.md by ChrisonSimtian · Pull Request #220 · Fallout-build/Fallout

ChrisonSimtian · 2026-05-27T09:14:23Z

Why

Three breaking changes shipped under 10.3.x patch releases over the past two days:

Commit	What
#206	`chore(globaltool)!: rename Fallout.GlobalTool → Fallout.Cli`
#204	`feat(globaltool)!: thin shims + local tool manifest, drop build.cmd`
#212	`fix(security)!: AES-GCM v2 secret format with per-secret salt+nonce, 600K PBKDF2`

CHANGELOG.md has had `[Unreleased] — 11.0` with extensive breaking-change entries since the takeover, but `version.json` stayed at 10.3 and every release shipped as 10.3.x. Consumers updating from `10.3.40` → `10.3.45` silently inherited a package rename and a secret-format change — exactly the failure mode semver exists to prevent.

CLAUDE.md described the mechanism of versioning (Nerdbank.GitVersioning, hand-bumped major+minor, patch from git-height) but had no rule for when to bump. Conventional-commit `!` markers were used on the breaking PRs, but nothing connected that to a major bump.

What this PR does

`version.json` 10.3 → 11.0. Next release becomes 11.0.x. The 10.3.4x releases on nuget.org stay published — can't be unpublished cleanly — this just stops more breaking changes from bleeding into 10.3.x.
Adds a "Semver policy" section to CLAUDE.md right after the existing Versioning section. The rule:
- Any `!` commit (or flagged breaking change) must bump the major in `version.json` in the same PR.
- Patch increments from git-height are reserved for non-breaking fixes.
- Reviewer responsibility: block merge until the bump is in.
- Record the breaking change under `[Unreleased] — ` in CHANGELOG.md as part of the PR.

Out of scope (follow-ups)

CHANGELOG.md entries for feat(globaltool)!: PR-B — thin shims + local tool manifest + workflow regen (#203) #204, chore(globaltool)!: rename Fallout.GlobalTool → Fallout.Cli #206, Security audit: pen-test EncryptionUtility (the existing 'v1:' secret format) #212 under `[Unreleased] — 11.0` — meatier writing, deserves its own PR.
Migration guide for `Fallout.GlobalTool` → `Fallout.Cli` for consumers on 10.3.40 → 11.0.x. README's install section already has the uninstall-old-CLI note (docs(readme): add Install section with uninstall-old-cli note #210), so the primary case is covered, but a dedicated migration page would help.
Tooling enforcement (e.g. a CI check that fails PRs with `!` whose `version.json` major doesn't change) — process rule for now; automate later if it slips again.

Verification

CI green.
Post-merge release ships as 11.0.x (not 10.3.x).
Spot-check: `fallout.cli@11.0.x` lists on nuget.org under the new major.

Refs

`!` PRs that should have triggered the bump: feat(globaltool)!: PR-B — thin shims + local tool manifest + workflow regen (#203) #204, chore(globaltool)!: rename Fallout.GlobalTool → Fallout.Cli #206, Security audit: pen-test EncryptionUtility (the existing 'v1:' secret format) #212
Existing `[Unreleased] — 11.0` heading in CHANGELOG.md (line 7)

… CLAUDE.md Three breaking changes shipped under 10.3.x patch releases over the past two days: - #206 chore(globaltool)!: rename Fallout.GlobalTool → Fallout.Cli - #204 feat(globaltool)!: thin shims + local tool manifest, drop build.cmd - #212 fix(security)!: AES-GCM v2 secret format with per-secret salt+nonce CHANGELOG.md has had an `[Unreleased] — 11.0` heading with extensive breaking-change entries since the takeover (STJ migration, schema rewrite, etc.), but `version.json` stayed pinned at 10.3 and every release shipped as 10.3.x. Net effect: consumers updating from 10.3.40 → 10.3.45 silently inherited a package rename and a secret- format change — exactly the failure mode semver exists to prevent. This PR bumps `version.json` to 11.0 so the next release becomes 11.0.x. The 10.3.x releases on nuget.org are already published and stay where they are; this PR stops the bleeding from this point forward. Also adds a **Semver policy** section to CLAUDE.md so the rule is explicit and reviewer-enforceable: - Any `!` commit (or flagged breaking change) requires bumping the major in `version.json` in the same PR. - Patch increments from git-height are reserved for non-breaking fixes. - Reviewer responsibility: block merge until the bump is in. - Add a CHANGELOG.md entry under `[Unreleased] — <next-major>`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Per-repo convention for operational helper scripts that aren't part of the build or release pipeline: - Not referenced by fallout.slnx / any .csproj — never built or packed. - Excluded from version.json's git-height via pathFilters — commits that only touch tools/ don't bump the patch version. (No more 11.0.<n+1> releases just because a script's docblock got tidied.) - PowerShell Core 7+ by convention (cross-platform). First inhabitant: Unlist-NugetPackage.ps1 — wraps `dotnet nuget delete` with two input modes: - Single: -Package Foo -Version 1.2.3 (or -Version 1.0,1.1,1.2) - Bulk: -JsonPath ./batch.json (array of {package, version}) API key from -ApiKey or $env:NUGET_API_KEY. Fails fast if neither. SupportsShouldProcess, so -WhatIf and -Confirm work for the mutating calls. Per-item ok/FAIL output; exit code = failure count. Built to address the 10.3.40-10.3.47 unlist work that surfaced after the semver-policy fix in #220 — but kept generic so it's reusable for any future unlist sweep without modification. Also adds tools/README.md documenting the conventions for future inhabitants of the directory.

#224) 102-entry bulk-input for Unlist-NugetPackage.ps1, covering the 10.3.40-10.3.47 range across all 17 affected Fallout.* packages. These are the patch versions that shipped breaking changes before the v11 semver-policy fix in #220 — keeping the batch under source control so the cleanup is reproducible / auditable. Also amends tools/README.md to point at this file as the live example of an "operation worth keeping as a historical record."

…l→Cli migration guide (#225) Closes the two follow-ups noted in #220's PR body — the v11 record now covers every breaking change that shipped under 10.3.x and were catalysed by the semver-policy fix. CHANGELOG.md — three new entries under [Unreleased] — 11.0, most-recent first: - #214 AES-GCM v2 secret format - #206 Fallout.GlobalTool → Fallout.Cli package rename - #204 thin shims + dotnet-tools manifest + GitHubActions generator regen (PR-B of #203) docs/migration/from-globaltool-to-cli.md — focused migration guide covering the three consumer scenarios (global install, local manifest, shims) plus the affected-versions table noting both the renamed Fallout.GlobalTool freeze at 10.3.40 and the 10.3.41-47 Fallout.Cli unlist done via tools/Unlist-NugetPackage.ps1.

…13) (#298) While v11 churns through the rebrand + plugin-foundation work, nothing should reach the nuget.org userbase. This routes v11 releases to the GH Packages feed instead: - Build.cs: IPublish.NuGetSource -> GitHub Packages feed (defensive — the Publish target itself can no longer reach nuget.org), NuGetApiKey fed the GITHUB_TOKEN. - release.yml: NuGetApiKey -> secrets.GITHUB_TOKEN; drop the nuget-org Environment binding (no nuget.org secret in play). Flags the lost approval gate + how to re-add one for GH Packages. Also lands tools/unlist-v11.0.1-18.json — the record of the 199 existing 11.0.x (package,version) pairs being unlisted from nuget.org (cleanup of what auto-published between the #220 major bump and the #268 stopgap). nuget.org stays reserved for the maintenance 10.x line and a future stabilised v11. Revisit the feed when v11 stabilises. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ChrisonSimtian force-pushed the chore/bump-v11-and-semver-policy branch from e02728e to 887a054 Compare May 27, 2026 09:16

ChrisonSimtian added the breaking-change Change is breaking — requires major version bump per CLAUDE.md semver policy. label May 27, 2026

ChrisonSimtian merged commit e478489 into main May 27, 2026
2 checks passed

ChrisonSimtian deleted the chore/bump-v11-and-semver-policy branch May 27, 2026 09:22

This was referenced May 27, 2026

docs(claude): document milestone/target-label scheme + extend PR-creation flow #221

Merged

chore(tools): add tools/ directory + Unlist-NugetPackage.ps1 #223

Merged

ChrisonSimtian mentioned this pull request May 27, 2026

chore(tools): commit unlist-10.3.40-47.json batch as historical record #224

Merged

1 task

ChrisonSimtian mentioned this pull request May 27, 2026

docs: backfill CHANGELOG entries for v11 breaking changes + GlobalTool→Cli migration guide #225

Merged

2 tasks

This was referenced May 27, 2026

RFC: Release management strategy — backports, release branches, version-locked support #227

Open

chore(tools): complete 10.3 contaminated-version unlist batch (10.3.24-47) #294

Merged

chore(tools): record of the v11 (11.0.x) nuget.org unlist batch #298

Merged

ChrisonSimtian added documentation Improvements or additions to documentation and removed breaking-change Change is breaking — requires major version bump per CLAUDE.md semver policy. labels Jul 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(release)!: bump version.json 10.3 → 11.0 + add semver policy to CLAUDE.md - #220

chore(release)!: bump version.json 10.3 → 11.0 + add semver policy to CLAUDE.md#220
ChrisonSimtian merged 1 commit into
mainfrom
chore/bump-v11-and-semver-policy

ChrisonSimtian commented May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

ChrisonSimtian commented May 27, 2026

Why

What this PR does

Out of scope (follow-ups)

Verification

Refs

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant