From 09ca4e19e11f6556ca46172966caf82e9d623ff3 Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Thu, 22 Oct 2026 09:19:47 -0700
Subject: [PATCH] ci: gate tines-core 1.x changes against the published 1.0.0

cargo-semver-checks with a pinned 1.0.0 baseline in scripts/ci.sh (skipped
where the tool is absent); the GitHub Actions ci job installs a prebuilt
binary so the gate is enforced there.
---
 .github/workflows/ci.yml | 8 ++++++++
 scripts/ci.sh            | 7 +++++++
 2 files changed, 15 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a6090791..dc7ed3e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,6 +42,14 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends libdbus-1-dev pkg-config
 
+      # The semver gate in scripts/ci.sh compares tines-core against the
+      # published 1.0.0; a prebuilt binary keeps this fast (a from-source
+      # install would dominate the job).
+      - name: Install cargo-semver-checks
+        run: |
+          curl -LsSf https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar xzf - -C "$HOME/.cargo/bin"
+          cargo binstall --no-confirm cargo-semver-checks
+
       - name: Run CI gate
         run: sh scripts/ci.sh
 
diff --git a/scripts/ci.sh b/scripts/ci.sh
index b548da19..e972103d 100755
--- a/scripts/ci.sh
+++ b/scripts/ci.sh
@@ -24,3 +24,10 @@ sh scripts/check-no-std.sh
 # compiling on the pinned stable toolchain, or the scheduled job rots unseen.
 cargo fmt --manifest-path fuzz/Cargo.toml -- --check
 cargo clippy --locked --manifest-path fuzz/Cargo.toml --all-targets -- -D warnings
+# Post-1.0.0 release gate: every 1.x change to tines-core must stay
+# semver-compatible with the published 1.0.0. Skipped where the tool is not
+# installed (`cargo install cargo-semver-checks --locked`); the GitHub Actions
+# `ci` job installs a prebuilt binary so the gate is enforced there.
+if command -v cargo-semver-checks >/dev/null 2>&1; then
+    cargo semver-checks check-release -p tines-core --baseline-version 1.0.0
+fi