Lockstep versioning

.github/workflows/publish-python.yml

@@ -3,6 +3,10 @@ name: Publish Python Packages
 on:
   workflow_dispatch:
     inputs:
+      version:
+        description: "Release version to publish. Leave empty when running on a tag ref."
+        required: false
+        type: string
       target:
         description: "Package set to publish"
         required: true
@@ -20,7 +24,57 @@ permissions:
   contents: read
 
 jobs:
+  resolve-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.resolve.outputs.version }}
+    steps:
+      - name: Resolve release version
+        id: resolve
+        shell: bash
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+          REF_NAME: ${{ github.ref_name }}
+          REF_TYPE: ${{ github.ref_type }}
+        run: |
+          version="${INPUT_VERSION}"
+          if [ -z "$version" ]; then
+            if [ "$REF_TYPE" = "tag" ]; then
+              version="$REF_NAME"
+            else
+              echo "::error::Set the version input or run this workflow on a tag ref."
+              exit 1
+            fi
+          fi
+
+          version="${version#refs/tags/}"
+          version="${version#v}"
+          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Expected semantic version like 0.1.1, got: $version"
+            exit 1
+          fi
+
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  version-check:
+    needs: resolve-version
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Sync lockstep versions to release version
+        run: python3 scripts/manage_versions.py set "${{ needs.resolve-version.outputs.version }}"
+
+      - name: Validate lockstep package versions
+        run: python3 scripts/manage_versions.py check --tag "${{ needs.resolve-version.outputs.version }}"
+
   build-package:
+    needs:
+      - resolve-version
+      - version-check
     strategy:
       matrix:
         include:
@@ -43,6 +97,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release version
+        run: python3 scripts/manage_versions.py set "${{ needs.resolve-version.outputs.version }}"
+
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -68,6 +125,9 @@ jobs:
           path: dist/*
 
   build-bindings-wheels:
+    needs:
+      - resolve-version
+      - version-check
     if: ${{ github.event.inputs.target == 'all' || github.event.inputs.target == 'bootstrap-1' }}
     strategy:
       matrix:
@@ -91,6 +151,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release version
+        run: python3 scripts/manage_versions.py set "${{ needs.resolve-version.outputs.version }}"
+
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:
@@ -132,6 +195,9 @@ jobs:
           path: dist/*
 
   build-bindings-sdist:
+    needs:
+      - resolve-version
+      - version-check
     if: ${{ github.event.inputs.target == 'all' || github.event.inputs.target == 'bootstrap-1' }}
     runs-on: ubuntu-latest
     permissions:
@@ -140,6 +206,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release version
+        run: python3 scripts/manage_versions.py set "${{ needs.resolve-version.outputs.version }}"
+
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:

.github/workflows/publish-rust.yml

@@ -8,19 +8,40 @@ on:
 permissions:
   contents: read
 
+env:
+  RELEASE_VERSION: ${{ github.ref_name }}
+
 concurrency:
   group: publish-rust-${{ github.ref_name }}
   cancel-in-progress: false
 
 jobs:
+  version-check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Sync lockstep versions to release tag
+        run: python3 scripts/manage_versions.py set "${{ env.RELEASE_VERSION }}"
+
+      - name: Validate lockstep versions against tag
+        run: python3 scripts/manage_versions.py check --tag "${{ env.RELEASE_VERSION }}"
+
   package-check:
+    needs: version-check
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release tag
+        run: python3 scripts/manage_versions.py set "${{ env.RELEASE_VERSION }}"
+
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@1.94.0
 
@@ -38,6 +59,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release tag
+        run: python3 scripts/manage_versions.py set "${{ env.RELEASE_VERSION }}"
+
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@1.94.0
 
@@ -57,6 +81,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release tag
+        run: python3 scripts/manage_versions.py set "${{ env.RELEASE_VERSION }}"
+
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@1.94.0
 
@@ -79,6 +106,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release tag
+        run: python3 scripts/manage_versions.py set "${{ env.RELEASE_VERSION }}"
+
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@1.94.0
 
@@ -98,6 +128,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Sync lockstep versions to release tag
+        run: python3 scripts/manage_versions.py set "${{ env.RELEASE_VERSION }}"
+
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@1.94.0
 

.github/workflows/release-check.yml

@@ -12,7 +12,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  version-check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Validate lockstep package versions
+        run: python3 scripts/manage_versions.py check
+
   verify-package-distributions:
+    needs: version-check
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -43,6 +55,7 @@ jobs:
         run: uvx twine check dist/*
 
   verify-bindings-wheels:
+    needs: version-check
     strategy:
       matrix:
         include: