verctl 0.7.2

verctl 0.7.2

Added

• vendored.<name> in .ctl/ver.yaml declares release assets built from someone else's source at its own version, and verctl assets --vendored <name> (VERCTL_VENDORED) plans, builds, and uploads them. --upload creates the set's Release when it is missing, never marked latest, and attaches each archive with a .sha256 written from the digest GitHub reports. A config that vendors may declare no packages. assets without --vendored is unchanged (#232).

Changed

• The reusable release.yml installs mise 2026.10.25 when a caller passes no mise-version, the version verctl's own mise.toml requires (#233).
• verctl no longer arms auto-merge on the Version PR: a release starts only when a person merges it. prepare drops --auto-merge and VERCTL_AUTO_MERGE, and the reusable release.yml and actions/version-pr drop their auto-merge input, so a caller that still passes auto-merge must remove it when it moves to this release (#230).

verctl 0.7.1

verctl 0.7.1

• The release workflow's asset jobs install tools one at a time. On macOS runners rustup failed to rename a component download when two Rust toolchains installed at once, which left a release without its darwin-arm64 asset (#223).

verctl 0.7.0

verctl 0.7.0

• check --versions skips in a merge queue run (a merge_group event). Each entry's pull request already compared its own versions, and the queue run of the Version PR, or of any entry behind it, carries the new versions, so without the skip the check would fail every release that lands through a queue.

The library's public versions::Skip enum gains a MergeQueue variant, so a crate that matches on it exhaustively needs a new arm (#220).

verctl 0.6.0

verctl 0.6.0

• The reusable release workflow publishes to crates.io through trusted publishing with crates-io-trusted-publishing: true, so a caller keeps no registry token. Its publish job now requests id-token: write, which every caller grants in the same change that moves its pin, because GitHub checks a called job's permissions when the run starts (#218).

verctl 0.5.5

verctl 0.5.5

• The release binary no longer carries octocrab's unused JWT crypto, which RUSTSEC-2026-0387 flagged in crypto-bigint. verctl authenticates with a personal token only (#212).

verctl 0.5.4

verctl 0.5.4

• verctl publish --plan and verctl publish leave out a package at 0.0.0, before any registry or GitHub lookup, publish asks no changelog section of it, and it gets no tag, so a new package beside a released one no longer breaks a shared v{version} tag. A crate that adopted the release workflow at 0.0.0 had its placeholder planned as a release, so every push to its default branch ran the publish job on the commit where 0.0.0 first appeared, and the Version PR job never ran (#204).

verctl 0.5.3

verctl 0.5.3

• verctl semver leaves out a crate with no library target, or a proc-macro, which cargo-semver-checks does not check. It ran cargo semver-checks --package <crate> on a binary-only crate, which cargo-semver-checks refuses, so a workspace package with a binary member failed (#197).

verctl 0.5.2

verctl 0.5.2

• The shared verify runs the version guard from ctl-core's Rust tasks at 0.6.27, through this checkout's ver task, in place of a local copy of the same check (#196).

verctl 0.5.1

verctl 0.5.1

• verctl check --versions works in the depth-1 pull request checkout of actions/checkout. On Actions it first fetches VERCTL_DEFAULT_BRANCH, the event's default branch, and GITHUB_BASE_REF with their whole history when the checkout lacks them or is shallow, HEAD's parents included, so the merge-base can be computed. A full clone that has them fetches nothing (#194).

verctl 0.5.0

verctl 0.5.0

• verctl semver checks the API of each crates.io crate whose next release is a patch with cargo semver-checks --release-type minor, so only a break fails. It skips a crate whose package has a pending minor fragment or whose minor the Version PR already moved, and fails on a crate at 1.0 or later (#183).
• check --versions knows a Version PR by its head repository, its head branch verctl/release/<base>, and its current base, read through the API, and no longer reads the verctl:version label. The Version PR's first CI run passes without a labeled trigger; when a version differs, the CI job needs GITHUB_TOKEN with pull-requests: read, and a pull request that changes no version reads no API. A version the default branch carries at its merge-base with HEAD is not a hand edit, so merging the default branch into another branch passes. Skip::from_env takes no config and returns a Result, report_with and require_with take the default-branch candidates, VersionRow gains released, and the payload label readers are removed (#188).