ci: pin global.json and CI to the same SDK band

.github/workflows/ci.yml

@@ -20,7 +20,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Clean-room check
         shell: pwsh
@@ -164,7 +166,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Install Native AOT prerequisites
         if: runner.os == 'Linux'

.github/workflows/docs.yml

@@ -38,7 +38,7 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
 
       - name: Install DocFX
         run: dotnet tool update -g docfx

.github/workflows/release.yml

@@ -17,7 +17,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Derive version from tag
         id: version
@@ -121,7 +123,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Derive version from tag
         id: version

CHANGELOG.md

@@ -209,6 +209,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   every assembly, and all eleven symbol PDBs with their SourceLink document maps are byte-identical,
   so nothing that ships changes. The package's own MSBuild logic is byte-identical to the SDK's copy;
   only the compiled task assembly now floats with the SDK band instead of being pinned. (#202)
+- **`global.json` now pins the SDK feature band the workflows resolve, instead of trailing it.**
+  It named `10.0.204` with `latestFeature`, while every `actions/setup-dotnet` step asked for
+  `10.0.x` and landed on whatever band was newest at the time — `10.0.400` as of this change. With
+  `TreatWarningsAsErrors` and `AnalysisLevel latest`, a diagnostic new to that band is a CI failure
+  a developer on the older SDK cannot reproduce. `global.json` now reads `10.0.400` with
+  `latestPatch`, and all five `setup-dotnet` steps (`ci.yml` build and AOT smoke jobs, `release.yml`
+  library and tool jobs, `docs.yml`) point at `global-json-file: global.json` rather than repeating
+  the version inline, so the two can no longer drift apart. (#231)
 
 ### Fixed
 

CONTRIBUTING.md

@@ -5,7 +5,11 @@ build, test, and submit changes to VellumPdf.
 
 ## Prerequisites
 
-- **.NET 10 SDK** (the only required runtime dependency).
+- **.NET 10 SDK**, feature band 10.0.4xx — the exact pin is in `global.json`;
+  earlier feature bands are rejected.
+- Before tagging a release: merge and CI-validate any `global.json`
+  feature-band bump first. `release.yml` reads `global.json` from the tag's
+  tree, so a stale pin ships a release built on a superseded SDK band.
 - **Docker** — needed to run the veraPDF conformance gate locally.
 - **qpdf** and **poppler-utils** — needed to run the structural-validator,
   text-extraction, signature, and barcode-rasterization oracle tests locally

global.json

@@ -1,6 +1,8 @@
 {
   "sdk": {
-    "version": "10.0.204",
-    "rollForward": "latestFeature"
+    "version": "10.0.400",
+    // Required for CI to pick up 10.0.4xx patch releases; removing it pins CI to
+    // exactly 10.0.400 and drops patch servicing.
+    "rollForward": "latestPatch"
   }
 }