[thirtytwobits]

SonarCloud has labeled every analysis since February 2026 as version "2.3", including the latest one of the 3.1.0 release commit (cce94a9).

Cause: the sonar job's set-environment step runs ./src/nunavut/_version.py --major-minor-only, but the file is mode 100644 in git. The run log shows ./src/nunavut/_version.py: Permission denied. echo still succeeds, so the step passes, NUNAVUT_MAJOR_MINOR_VERSION ends up empty, and the scanner receives -Dsonar.projectVersion= with no value. SonarCloud then reuses the last version it was given.

-Dsonar.buildString=${{ env.GITHUB_RUN_ID }} was empty for a similar reason: GITHUB_RUN_ID is a runner environment variable and isn't exposed through the env context.

Changes

• Run the script as python3 ./src/nunavut/_version.py --major-minor-only, matching release.yml. Locally this prints 3.1.
• Use ${{ github.run_id }} for sonar.buildString in both the release and PR scan steps.

The PR scan from this branch should show the new arguments in the sonar job log. The project version on the SonarCloud dashboard should switch to 3.1 after the first main analysis once this merges.

CMake package version literals (#423)

NunavutConfigVersion.cmake hard-coded the version in three places, and only PACKAGE_VERSION was updated for 3.1. The major-version check still read "3.0", and NunavutConfig.cmake also set NUNAVUT_VERSION "3.0".

• NunavutConfigVersion.cmake now reads "${PACKAGE_VERSION}" in the MATCHES check and the CVF_VERSION_MAJOR fallback, so set(PACKAGE_VERSION "3.1") is the only place to update.
• Removed set(NUNAVUT_VERSION "3.0") from NunavutConfig.cmake. execute_process overwrites it before anything reads it.
• New test test_cmake_package_version_matches_version in test/gentest_versions/test_versions.py requires exactly one quoted version literal across both files, on the PACKAGE_VERSION line, matching the major.minor of __version__. It failed on main (listing the three stale "3.0" literals) and passes with this change on Python 3.11 and 3.14.
• A cmake -P probe gives the same COMPATIBLE/EXACT results before and after for requests 3.0, 3.1, 3.2, 4.0 and 2.9, plus several version ranges. In a copy bumped to 4.0, the old file rejects find_package(Nunavut 4.0) (it still computes major 3); the new file accepts it.

The test only counts double-quoted literals. An unquoted stale version, such as set(X 3.0), would not be caught.

Closes #423

CI modernization (#420)

Dependabot: new .github/dependabot.yml checks github-actions weekly and groups every update into one PR. The toxic/toolshed container images named in the workflows aren't covered and still need manual bumps.

Node 24 actions: checkout v4→v7, upload-artifact v4→v7, download-artifact v4→v8, setup-python v5→v7, sonarqube-scan-action v6.0.0→v8.3.0. I read the release notes for each skipped major. None of the breaking changes affect how this repo uses these actions:

• download-artifact v8 now fails on a digest mismatch.
• setup-python v7 removes pip-install, which isn't used here.
• Sonar v8 verifies the scanner signature by default.

No second test run at release time: release.yml no longer lints, tests and builds the tagged commit again. It now:

1. checks the tag against __version__ (unchanged);
2. finds the newest successful push run of test.yml for the tagged commit;
3. downloads that run's pypi-package artifact;
4. uploads it with twine.

What gets published is exactly what CI built and tested. One side effect: the wheel's build number is now the test.yml run ID (noxfile.py reads GITHUB_RUN_ID).

Situation	Result
No push run of test.yml for the commit (tag not on main/*.preview)	Fails, lists the commit's runs
That run is still going or failed	Fails; re-run the release job once CI succeeds
Artifact expired (kept 90 days; runs can only be re-run for 30)	Fails; release from a newer tested commit
Tag doesn't match __version__	Fails, as before
Prerelease	Skipped, as before

Dry run: the Run workflow button (workflow_dispatch with a tag input) runs every step except the upload.

Concurrency: test.yml cancels a pull request run when a newer push supersedes it. Branch-push runs each get their own group (keyed by run ID), so every main run finishes and leaves a package for the release.

Checks:

• actionlint (with shellcheck) passes on both workflows.
• I ran the lookup step locally in three cases:
  • tag 3.1.0 found run 40213769476, and its pypi-package artifact contains nunavut-3.1.0-py3-none-any.whl and nunavut-3.1.0.tar.gz at the root;
  • tag 3.0.1b1 failed because its artifact has expired;
  • an untested branch commit failed because there is no push run.
• An independent review found no correctness problems. It corrected the expired-artifact message, which used to suggest a re-run that GitHub no longer allows.

Not verifiable until after merge:

• the dry run, which only exists on main — run it against 3.1.0;
• Dependabot's first PR;
• the cancellation of superseded PR runs, which needs a second push to a PR.

Closes #420

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[thirtytwobits]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T20:30:27.548666Z	778bafc	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 778bafceff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".