Floor the version check at the published release, not main

[lelia]

Ports the version-check fix from the Python CLI to the SDK for better enforcement and consistency.

Floor on PyPI, not main

The check required pr_ver > max(main_version, pypi_latest). The main term forbids the legitimate case where several PRs ship under one unreleased version: the first bumps main to the new version and the rest ride it without bumping again, which is what keeps them under a single changelog header. Every such PR failed, and the only way to green it was a throwaway bump that would strand a changelog header on a version that never ships.

PyPI is now the floor, since the real invariant is that a release cannot reuse a published version. main remains a floor in the direction that matters: a PR may leave the version alone or move it forwards, never back.

Stop checking out main to read its version

git checkout origin/main left the working tree detached on main, so the Require uv.lock update when pyproject changes step below it computed git diff --name-only origin/main...HEAD with HEAD at origin/main — an empty diff. That guard has never fired. Reading the version out of the ref with git show removes the side effect and revives it.

Only enforce a bump when the PR changes shipped content

This workflow is now in its own paths: filter, so an edit to the check is exercised by the PR that makes it rather than landing untested. That alone would demand a version bump from CI-only PRs, so the bump is enforced only when the PR touches socketdev/**, pyproject.toml or uv.lock. The comparison still runs and reports either way.

Note the CLI carries a fourth change that deliberately does not port: it asserts pyproject.toml and __init__.py agree, because it keeps the version as two hand-maintained literals. This repo sets dynamic = ["version"] with [tool.hatch.version] path = "socketdev/version.py", and __init__.py and core/api.py both import __version__ from it, so there is a single source and nothing to drift.

Validation

Extracted the embedded script and executed it against fixtures with a stubbed PyPI response, across both enforcement modes:

scenario	pr / main / pypi	pkg changed	exit
CI-only PR, version already published	3.6.0 / 3.6.0 / 3.6.0	no	0
CI-only PR, version unreleased	3.7.0 / 3.7.0 / 3.6.0	no	0
package PR, forgot to bump	3.6.0 / 3.6.0 / 3.6.0	yes	1
package PR, rides main's unreleased	3.7.0 / 3.7.0 / 3.6.0	yes	0
package PR, normal bump	3.7.0 / 3.6.0 / 3.6.0	yes	0
package PR, backwards vs main	3.6.5 / 3.7.0 / 3.6.0	yes	1
package PR, reuses old published	3.5.0 / 3.7.0 / 3.6.0	yes	1

Also verified the shell PACKAGE_CHANGED detection against representative paths (including a mixed workflow+package PR, which correctly enforces), confirmed the git checkout side effect empties the diff on a branch that is genuinely ahead of main, actionlint reports the same two pre-existing SC2086 infos as main with no new findings, and the YAML parses.

Public Changelog

N/A

---

Note

Low Risk
Changes are limited to GitHub Actions CI logic with no runtime or security impact on the published package.

Overview
Reworks the PR version-check workflow so release rules match how this repo actually ships (multiple PRs on one unreleased version) and so related guards work again.

Version rules: Enforcement no longer requires PR > max(main, PyPI). The hard floor is latest PyPI (no reusing a published version). Main only blocks moving the version backwards; matching main’s unreleased version is allowed (“riding” one changelog release). Failures apply only when the PR touches packaged paths (socketdev/**, pyproject.toml, uv.lock); CI-only PRs still run the check but exit successfully with an informational message.

Bugfixes: MAIN_VERSION is read via git show origin/main:… instead of checking out main, which had left HEAD on main and made the uv.lock vs pyproject.toml diff step always empty.

Workflow trigger: The workflow’s paths filter now includes .github/workflows/version-check.yml so changes to the check run on their own PR.

^{Reviewed by Cursor Bugbot for commit f3f9853. Configure here.}