404
+
+ The action resolves the release binary by name and verifies it against the release’s
+ published SHA256SUMS{' '}
+ before running it.
+
+ Each distinct failure has its own code, so a caller branches on a number rather than
+ matching strings. --json{' '}
+ renders every command’s result — bumps and errors alike — from the same structured value
+ the human output comes from, so neither can carry information the other lacks.
+
+ Put the check first in the workflow and a bad tag is rejected in seconds, before a + runner has spent a minute on it. +
+ ++ Every failure mode has its own exit code, so a script branches on the number instead + of matching strings against an error message. +
+Version lives in
+{file.where}
+Never mistaken for it
+{file.guard}
+
+ .fsproj and{' '}
+ .vbproj are read exactly like{' '}
+ .csproj, and{' '}
+ Directory.Build.targets like{' '}
+ Directory.Build.props — except that a targets file
+ overrides a project’s own version, where a props file only supplies a default.
+
+ Cargo.lock and{' '}
+ package-lock.json record their
+ project’s own version, and{' '}
+ cargo build --locked and{' '}
+ npm ci both reject a tree where
+ a lock and its manifest disagree. vump writes them in the same run, so nothing is left
+ to finish afterwards. If a lock file records your version but is missing from the
+ configuration, it stops before writing anything and names it.
+
+ This is not vump running a package manager, which it never does. The test is whether the + result can be computed with no network and no knowledge of the dependency graph. +
++ A bump requires the tracked files to agree, and refuses when they do not — a source of + truth contradicting itself is something to look at, not to guess about. +
+One binary · macOS, Linux, Windows
++ vump moves every version number a repository records in lockstep, then fails the + build before a tag that disagrees with its source can cost you anything. +
+
+ vump init writes a configuration
+ tracking the version files it finds. After that, a bump is one word.
+
Download a binary
++ A signed universal binary for macOS, static musl builds for Linux, and Windows + including arm64. Every release publishes checksums, and both the installer and the + CI action verify against them. +
+ +Build from source
+Already have it
+
+ vump self update keeps the
+ binary current, and --channel{' '}
+ names the least mature release you will accept — a floor rather than an exact match,
+ so tracking release candidates never silently moves you onto the next minor’s first
+ alpha.
+
+ Projects moving independently need distinguishable tags, or they collide the moment two
+ reach the same version and nothing can say which project a pushed tag describes. One{' '}
+ tag_pattern covers every
+ project, or each overrides its own. If two would produce the same tag, vump says so
+ rather than guessing — and CI can then pass a pushed tag straight through without
+ knowing which project it names.
+
+ A second configuration deeper in the tree is what{' '}
+ [[project]] exists to prevent:
+ scattered configurations cannot be addressed by name, git operations still run against
+ the enclosing repository, and a pushed tag can no longer be traced back to what produced
+ it. vump refuses that rather than warning about it — a warning arrives too late to help
+ once a tag exists.
+
vump
+ asks, then confirms the whole plan
+ vump patch
+ never asks anything, ever
+ + Anything a subcommand would otherwise have to ask about is a required flag, or an error + that names what is missing. That is what makes vump safe to put in a script, a CI job, or + an agent’s toolbelt: a command either has everything it needs, or it fails saying what it + does not. +
+{guarantee.title}
+{guarantee.detail}
++ Releases carry keyless build provenance, signed with a short-lived certificate from the + workflow’s own identity and recorded in a public transparency log. There is no key to + store, rotate, or leak. +
+{refusal.title}
+{refusal.reason}
+
+
+ {lines.map((tokens, index) => {
+ const highlighted = marked.has(index + 1);
+ return (
+
+ {tokens.length === 0 ? ' ' : null}
+ {tokens.map((token, tokenIndex) => (
+
+ {token.text}
+
+ ))}
+
+ );
+ })}
+
+
+ + {lede} +
+ ) : null} +
+
+ {lines.map((line, index) => {
+ const revealed = index < cursor.line;
+ const active = index === cursor.line;
+ let budget = active ? cursor.char : revealed ? Number.POSITIVE_INFINITY : 0;
+
+ return (
+
+ {line.prompt ? (
+ $
+ ) : null}
+ {line.segs.map((seg, segIndex) => {
+ const shown = Math.max(0, Math.min(seg.text.length, budget));
+ budget -= seg.text.length;
+ return (
+
+ {seg.text.slice(0, shown)}
+ {seg.text.slice(shown)}
+
+ );
+ })}
+ {playing && active && line.prompt ? : null}
+
+ );
+ })}
+
+
+