build: single-source the version in a VERSION file

.github/workflows/release.yml

@@ -39,6 +39,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # VERSION is the single source of truth (CMakeLists.txt and package.nix both
+      # read it). The git tag and debian/changelog carry the number independently,
+      # so fail the release if either drifts from VERSION rather than shipping a
+      # mislabeled artifact.
+      - name: Version consistency
+        run: |
+          ver="$(cat VERSION)"
+          if [ "v$ver" != "$GITHUB_REF_NAME" ]; then
+            echo "::error::git tag $GITHUB_REF_NAME does not match VERSION (v$ver)"; exit 1
+          fi
+          deb="$(sed -n '1s/.*(\([^-)]*\).*/\1/p' debian/changelog)"
+          if [ "$deb" != "$ver" ]; then
+            echo "::error::debian/changelog version $deb does not match VERSION $ver"; exit 1
+          fi
+
       # mithril is stdlib-only C++20: just a compiler, CMake, and python3 for the
       # test gate. No compression or other libraries.
       - name: Install build dependencies (apt)

CMakeLists.txt

@@ -1,5 +1,8 @@
 cmake_minimum_required(VERSION 3.20)
-project(mithril VERSION 0.2.1 LANGUAGES CXX)
+# The version lives once, in the top-level VERSION file. package.nix reads the
+# same file; debian/changelog and the git tag are checked against it in CI.
+file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/VERSION" VERSION_STRING)
+project(mithril VERSION ${VERSION_STRING} LANGUAGES CXX)
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)

VERSION

@@ -0,0 +1 @@
+0.2.1

package.nix

@@ -6,7 +6,8 @@
 }:
 stdenv.mkDerivation {
   pname = "mithril";
-  version = "0.2.1";
+  # Single source of truth: the top-level VERSION file (CMakeLists.txt reads it too).
+  version = lib.fileContents ./VERSION;
   src = ./.;
 
   nativeBuildInputs = [