verctl 0.3.11

Stack-agnostic version PRs from Changesets-format fragments
Documentation
# Validation jobs come from `[ci]`. Omit that table and this runs
# one `verify` on ubuntu-latest.
#
# runs-on must be known before a job exists, so the machine cannot come from
# a tool running inside that job. `plan` reads the config on a fixed runner
# and hands the labels down — the same bootstrap the publish lane uses for
# asset targets. verctl comes from the pinned release tarball, so `plan`
# installs a binary rather than compiling anything.
name: CI

on:
  # The Version PR is opened, then labeled. The version check reads the
  # label from the event, so adding or removing a label starts a run too.
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  plan:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.plan.outputs.matrix }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
        with:
          version: 2026.8.2
          cache: true
      - run: mise install --locked
      - id: plan
        run: verctl ci --github-output "$GITHUB_OUTPUT"

  verify:
    name: ${{ matrix.name }}
    needs: plan
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.plan.outputs.matrix) }}
    runs-on: ${{ matrix.labels }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
        with:
          version: 2026.8.2
          cache: true
      - run: mise install --locked
      - run: mise run verify