Standardize version bumping and the release process #5

	name: Version check

	# Guards against the drift this repository is prone to: the version lives in several
	# files, and bumping only some of them is easy to miss in review.
	on:
	pull_request:
	push:
	branches:
	- main

	# Only the newest run per ref matters; a superseded one is reporting on stale code.
	concurrency:
	group: version-check-${{ github.ref }}
	cancel-in-progress: true

	# This job runs a script from the pull request branch, so it is treated as untrusted:
	# read-only, with no credentials left behind for it to pick up.
	permissions:
	contents: read

	jobs:
	version-check:
	name: Versions in sync
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v5
	with:
	# Nothing here talks to git, and the checked-out script is PR-authored. Without
	# this the job's token stays in `.git/config` for that script to read.
	persist-credentials: false

	- uses: actions/setup-node@v5
	with:
	node-version: 24

	# The check script uses only Node built-ins, so nothing is installed here.
	# Without this, setup-node detects `pnpm-lock.yaml`, tries to prime a pnpm
	# cache, and fails because pnpm is not on the runner.
	package-manager-cache: false

	- name: Check that every file records the changelog version
	run: node ./scripts/release/syncversions.js --check

Provide feedback