ci: release versions follow the org versioning policy

.github/workflows/release.yml

@@ -14,6 +14,13 @@ name: Release
 #   - a `v*` tag push, for releasing a commit that is not main's head;
 #   - a dispatch, which rehearses by default and publishes only with
 #     dry_run explicitly false.
+#
+# The version follows the org versioning policy (nyuchi/.github#80): a release
+# to main is the next MINOR above the highest released tag (x.y.z -> x.y+1.0);
+# merges into staging are tagged as patches by staging-version.yml; a MAJOR is
+# only released by hand (dispatch with bump: major). Each segment holds
+# 0..999. The shared next-version action refuses any other version in the
+# verify job, before anything is built or published.
 on:
   push:
     branches: ["main"]
@@ -24,6 +31,11 @@ on:
         description: "Build and check everything, publish nothing"
         type: boolean
         default: true
+      bump:
+        description: "Override the release bump (major is manual only)"
+        type: choice
+        options: [minor, patch, major]
+        default: minor
 
 permissions:
   contents: write        # create the release and upload assets
@@ -45,7 +57,9 @@ jobs:
       prerelease: ${{ steps.v.outputs.prerelease }}
       publish: ${{ steps.decide.outputs.publish }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - id: v
         name: Read and cross-check the version
@@ -88,6 +102,16 @@ jobs:
           echo "npm_tag=$npm_tag"  >> "$GITHUB_OUTPUT"
           echo "npm dist-tag: $npm_tag"
 
+      - name: Check the version against the versioning policy
+        # Pre-release tags (v0.2.0-beta.1) are not releases here: the first
+        # plain version is a first release, then each is the next minor.
+        uses: nyuchi/.github/.github/actions/next-version@de909ab7468d998ba2cf87416ac2042616eba75d  # main, 2026-10-04
+        with:
+          channel: main
+          bump: ${{ inputs.bump || '' }}
+          manual: ${{ github.event_name == 'workflow_dispatch' }}
+          proposed: ${{ steps.v.outputs.version }}
+
       - id: decide
         name: Decide whether this run publishes
         # One place, so a reader does not have to assemble the answer from

.github/workflows/staging-version.yml

@@ -0,0 +1,34 @@
+name: Staging version
+
+# Org versioning policy (nyuchi/.github#80): every merge into `staging`
+# (the live beta) is released as the next PATCH, tagged on the merged
+# commit; releasing staging to main is the next MINOR; a MAJOR is only ever
+# made by hand (run this or the main release workflow with bump: major).
+# Each segment holds 0..999: patch 999 rolls into the next minor; minor 999
+# stops and asks for a manual major.
+#
+# The tag is pushed with GITHUB_TOKEN, so tag-triggered publish workflows do
+# not ship beta builds. The logic is nyuchi/.github's
+# reusable-staging-release.yml and its next-version action.
+
+on:
+  push:
+    branches: [staging]
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Override the patch bump (a major is only ever made by hand).
+        type: choice
+        options: [patch, minor, major]
+        default: patch
+
+permissions:
+  contents: read
+
+jobs:
+  version:
+    uses: nyuchi/.github/.github/workflows/reusable-staging-release.yml@924e5b4d0983d31379aedbec02b990793f29c792  # main, 2026-10-04
+    with:
+      bump: ${{ inputs.bump || '' }}
+    permissions:
+      contents: write

CONTRIBUTING.md

@@ -121,6 +121,21 @@ Use conventional commits:
 - `ci:` CI/CD changes
 - `chore:` maintenance
 
+## Versioning
+
+From 2026-10-04 releases follow the org versioning policy
+([nyuchi/.github#80](https://github.com/nyuchi/.github/issues/80)):
+
+- A merge into `staging` is a patch (x.y.z → x.y.z+1), tagged automatically.
+- A release to `main` is a minor (x.y.z → x.y+1.0). The releasing PR sets the
+  version in `Cargo.toml`, `npm/ntl-cli/package.json` and
+  `mcp/ntl-postgres-mcp-server/package.json` to the next minor above the
+  highest released tag. The release workflow refuses any other version.
+- A major is only released by hand: run the Release workflow with
+  `bump: major`. Each segment holds 0–999.
+
+Versions released before then are not renumbered.
+
 ## Code of Conduct
 
 All participants are expected to treat each other with respect, kindness, and good faith. We are building infrastructure for everyone.