Check semver compliance on release bump PRs

[spacebear21]

Integrates cargo-semver-checks into the release flow. The only API gate at release time today is cargo publish --dry-run, which can't tell whether the declared bump is large enough for the API changes it ships.

Design

• Runs on bump PRs only, as part of check-bump.sh, which already computes the changed release crates and their base versions. This is how the tool is designed to run: the bump PR declares the actual new version, so the tool compares the required bump against the declared one with no configuration overrides. A continuous per-PR check was considered and rejected: between releases the workspace version equals the published baseline, so the tool would demand a version bump for any public API addition, and bumping payjoin/Cargo.toml in a feature PR would itself trigger this release workflow.
• Explicit baseline: the crate's version at the PR base SHA is passed as --baseline-version instead of relying on the tool's default "latest on crates.io" lookup, so the comparison stays correct even if crates.io carries a newer release (e.g. a bump on a maintenance branch).
• Pre-release comparisons are skipped: semver classifies any comparison involving a pre-release as a major bump, which permits every change, so running the tool there proves nothing. Concretely, rc-to-rc bumps (and the rc-to-1.0.0 bump) skip with a log message; enforcement begins with the first stable-to-stable payjoin bump after 1.0.0, with no config change needed at that point.
• Scope is payjoin only: payjoin-cli has no library API, and payjoin-mailroom can be added by widening the guard once its API stabilizes.
• Feature coverage: the tool's default heuristic enables all features except _-prefixed ones, so it checks v1/v2/io/directory (which transitively enable _core, where the public API lives) and correctly excludes the unstable _manual-tls. No feature configuration needed.
• The tool comes from the release devshell, sourced from the existing nixpkgs-unstable input rather than the 25.11 branch: the release-branch version (0.45.0) predates the rustdoc JSON format (v57) emitted by rust-overlay's current stable toolchain, while unstable's 0.48.0 reads it. If this check ever errors with "unsupported rustdoc format", the fix is a flake input bump.

Verified locally by running check-bump.sh against a pre-rc.8 base SHA (detects the bump, takes the pre-release skip path) and by adding a variant to an exhaustive public enum, which the tool correctly rejects as requiring a major bump. Note the tool has known false negatives (some generic/lifetime/type-position changes), so it complements the changelog's **Breaking:** markers rather than replacing them.

Disclosure: co-authored by Claude Code

[coveralls]

Coverage Report for CI Build 31412812872

Coverage remained the same at 86.718%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	16458
Covered Lines:	14272
Line Coverage:	86.72%
Coverage Strength:	343.51 hits per line

---

💛 - Coveralls

[spacebear21]

The last commit (DISCARD: Bump payjoin to 1.0.1) is a scaffold to trigger the release workflow's check-bump job on this PR and will be dropped before merge.

Since payjoin 1.0.0 is merged but not yet published, the job currently demonstrates the unpublished-baseline guard (Skipping payjoin semver check; baseline 1.0.0 not on crates.io). Once the payjoin-1.0.0 tag publishes to crates.io, re-running the job will exercise the full check; simulated locally with --baseline-rev master it runs 223 checks as a patch change and passes.

[benalleng]

CACK 6d1dc3b

Though we should probably still re-run after 1.0 is public

[benalleng]

Re-ACK 6d1dc3b