fix(version): single source of truth via lib/version.ml + tag-time bake

[hyperpolymath]

Summary

Closes #297 — the five-site 0.1.0 drift that left the v0.1.1 release binary self-reporting 0.1.0.

Mechanism

Single source of truth in lib/version.ml:

let value = "0.1.1"

Five hardcoded "0.1.0" strings collapsed onto it:

Site	Before	After
bin/main.ml	let version = "0.1.0"	let version = Affinescript.Version.value
lib/repl.ml	print_endline "AffineScript REPL v0.1.0"	Printf.printf "AffineScript REPL v%s\n" Version.value
lib/lsp_server.ml	("version", \String "0.1.0")`	("version", \String Version.value)`
lib/onnx_codegen.ml	m_producer_version = "0.1.0"	m_producer_version = Version.value
dune-project	(version 0.1.0)	(version 0.1.1)

affinescript.opam was auto-regenerated by dune from dune-project (version: "0.1.1").

Release pipeline bake step

New step in .github/workflows/release.yml, between Install dependencies and Build release:

- name: Bake release version into source (#297)
  run: |
    v="${GITHUB_REF_NAME#v}"
    sed -i "s/^let value = .*/let value = \"$v\"/" lib/version.ml
    sed -i "s/^(version .*)/(version $v)/" .build/dune-project

Future tag bumps need zero hand-edits — cut vX.Y.Z and the binary self-reports X.Y.Z.

Why option (1), not (2)

Issue #297 proposed two shapes. I went with (1) (generated module + CI substitution) because it doesn't add an opam-package dependency (dune-build-info), keeps the runtime path trivial (one string literal), and doesn't tie semantics to any particular install method.

Verification

$ opam exec -- dune build --release         # clean
$ _build/default/bin/main.exe --version
0.1.1

$ grep '^version'   affinescript.opam       # 0.1.1
$ grep '^let value' lib/version.ml          # 0.1.1
$ grep '^(version'  .build/dune-project     # 0.1.1

All four sites coherent.

Test plan

• Local dune build --release clean
• Built binary --version reports 0.1.1
• CI: regular checks green
• On next v* tag push, the release.yml bake step rewrites lib/version.ml + .build/dune-project from the tag, and the resulting binary self-reports the tag.

Closes #297. Refs #282 (the closure-PR smoke that surfaced the drift).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	13
🟠 High	17
🟡 Medium	12

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence