[gitluis]

Bump type: patch (tooling). Independent PR: it branches from master and targets master.

Summary

Adds a GitHub Actions Version check to every PR into master. A red check means the PR isn't finalized and shouldn't be merged. This covers the case where Luis merges on GitHub himself without asking Claude to finalize first.

Requested by Luis in chat on 2026-11-03: "Add the check, thats smart." It enforces the versioning rules proposed in #52.

What it checks

.github/scripts/check-version.py, run by .github/workflows/version-check.yml:

1. Not finalized: CHANGELOG.md still has a ## [Unreleased] entry.
2. No new version: the top CHANGELOG version isn't higher than master's. That means nothing was bumped, or another PR merged first with the same number.
3. Version spots out of step: the sidebar footer in index.html, README (header and footer), Settings → General in views-settings.js, or CLAUDE.md §1 shows a different number from CHANGELOG.

Each failure says what to do next.

It also updates CLAUDE.md §17 (describes the check) and adds an [Unreleased] CHANGELOG entry.

How it was tested

The script was run locally against real files:

Case	Result
This branch as is ([Unreleased])	❌ "not finalized"
Simulated finalize to v1.10.6, CLAUDE.md §1 forgotten	❌ names CLAUDE.md §1
Simulated finalize to v1.10.6, complete	✅ passes
Same, but another PR already merged v1.10.6	❌ "not higher than master's v1.10.6"
Open PR #22 (v1.10.6, finalized the old way)	✅ passes

Not verified: a run on GitHub's own runners. That starts when this PR opens, and it should fail, because this PR isn't finalized yet.

Effect on open PRs

• v1.12.0: remove bank names from the app; neutral account codes with a data migration #16 and v1.10.6: Content Security Policy + SRI on every CDN script #22 (base master): GitHub runs the workflow from the merge of each PR with master, so they get the check on their next push or re-run after this merges. Both carry a real version, so they should pass, as v1.10.6: Content Security Policy + SRI on every CDN script #22 did locally.
• Stacked PRs (v1.17.0: Settings → Database tab (DB Inspector, DB Schema), rebuilt on the Clarity redesign #10, v1.13.0: Clarity redesign, part 1 — one-row app bar, theme in Settings, Clarity visual system #17–v1.18.1: add MIT license #51): their bases aren't master, so the check doesn't run on them. They aren't touched.
• Docs: independent PRs; renumber a taken version when syncing with master (v1.10.6) #52 also adds an [Unreleased] entry at the top of CHANGELOG. Whichever of the two merges second gets a small conflict there; resolve it by keeping both entries.

How to check

1. Checks tab on this PR: Version check ran and failed with the "not finalized" message. That's expected.
2. Files changed: two new files under .github/, plus CHANGELOG.md and CLAUDE.md §17.
3. Before merging: ask Claude to finalize. After the finalize commit, the check should turn green.
4. Optional: once the repo is public or on GitHub Pro, make Version check a required status check in branch protection. Then GitHub itself blocks the merge button.

---

Generated by Claude Code

[gitluis]

Closing without merging. Luis decided on a simpler approach (#52): each PR picks its version when opened, and a taken number is renumbered when the PR is synced with master. A CI check isn't needed for that. The version-check branch is kept in case it's useful later.

---

Generated by Claude Code