fix: put the wiki version note in the lockstep check, and enforce it in CI

.github/wiki/Home.md

@@ -1,6 +1,6 @@
 # nself Admin Documentation
 
-Version 0.0.8 · MIT License · Docker-ready
+Version 1.3.6 · MIT License · Docker-ready
 
 **The web UI for the nself CLI. Manage your self-hosted backend stack from a browser.**
 
@@ -92,7 +92,7 @@ Version 0.0.8 · MIT License · Docker-ready
 
 ## Current Version
 
-**v0.0.8** - See [CHANGELOG](CHANGELOG) for details.
+**v1.3.6** - See [CHANGELOG](CHANGELOG) for details.
 
 ## License
 

.github/workflows/version-lockstep.yml

@@ -18,33 +18,16 @@ jobs:
       - name: Checkout admin
         uses: actions/checkout@v4
 
-      - name: Read admin package.json version
-        id: admin_version
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "Admin version: ${VERSION}"
-
-      - name: Read cli-version.ts expected CLI version
-        id: cli_version_ts
-        run: |
-          # Extract the CLI_VERSION string from src/lib/cli-version.ts
-          VERSION=$(grep -E "^export const CLI_VERSION" src/lib/cli-version.ts \
-            | sed "s/export const CLI_VERSION = '//;s/'.*//")
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "cli-version.ts CLI_VERSION: ${VERSION}"
-
-      - name: Assert package.json == cli-version.ts
-        run: |
-          ADMIN="${{ steps.admin_version.outputs.version }}"
-          CLI_TS="${{ steps.cli_version_ts.outputs.version }}"
-
-          if [ "${ADMIN}" != "${CLI_TS}" ]; then
-            echo "::error::Version lockstep violation:"
-            echo "::error::  admin/package.json version  = ${ADMIN}"
-            echo "::error::  src/lib/cli-version.ts CLI_VERSION = ${CLI_TS}"
-            echo "::error::These must be identical. Update both files atomically when bumping the version."
-            exit 1
-          fi
-
-          echo "Version lockstep OK: admin == CLI == ${ADMIN}"
+      # Delegates to scripts/check-version-lockstep.sh — the same script the
+      # pre-commit hook runs — so CI and local checks can never disagree about
+      # what lockstep means. This step previously re-implemented the
+      # package.json vs cli-version.ts comparison inline, which meant a source
+      # added to the script (the .github/wiki/Home.md version note, added
+      # 2026-09-13 after it sat at 0.0.8 against a 1.3.6 package) was silently
+      # not enforced in CI.
+      #
+      # The script's cli/internal/version/version.go cross-check is a warning
+      # and self-skips when the sibling repo is absent, which it always is on a
+      # single-repo checkout — so this stays a pure admin-side gate.
+      - name: Verify version lockstep (package.json, cli-version.ts, wiki)
+        run: bash scripts/check-version-lockstep.sh

scripts/check-version-lockstep.sh

@@ -95,7 +95,48 @@ else
   info "cli/internal/version/version.go not found at expected sibling path — skipping Go cross-check."
 fi
 
-# ── 5. Final result ───────────────────────────────────────────────────────────
+# ── 5. Wiki version note (.github/wiki/Home.md) ──────────────────────────────
+#
+# Home.md states the version twice — a subtitle line and a "Current Version"
+# entry — and nothing ever compared either against package.json. Both sat at
+# 0.0.8 while the package reached 1.3.6 (found 2026-09-13), i.e. the public
+# admin documentation advertised a pre-1.0 release for the whole 1.x line.
+# Blocking, not a warning: these two strings are the version a reader actually
+# sees, so a stale one is worse than a stale internal constant.
+
+WIKI_HOME="${ADMIN_ROOT}/.github/wiki/Home.md"
+
+if [ -f "${WIKI_HOME}" ]; then
+  WIKI_SUBTITLE=$(grep -oE '^Version [0-9]+\.[0-9]+\.[0-9]+' "${WIKI_HOME}" \
+    | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || true)
+  WIKI_CURRENT=$(grep -oE '^\*\*v[0-9]+\.[0-9]+\.[0-9]+\*\* - See' "${WIKI_HOME}" \
+    | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || true)
+
+  if [ -z "${WIKI_SUBTITLE}" ] || [ -z "${WIKI_CURRENT}" ]; then
+    error "Could not find both version strings in ${WIKI_HOME}."
+    error "Expected a 'Version X.Y.Z · ...' subtitle line and a"
+    error "'**vX.Y.Z** - See [CHANGELOG](CHANGELOG) for details.' line."
+    error "Removing either silently disables this check — restore it, don't delete it."
+    FAIL=1
+  else
+    info "wiki Home.md subtitle    : ${WIKI_SUBTITLE}"
+    info "wiki Home.md current     : ${WIKI_CURRENT}"
+
+    if [ "${PACKAGE_VERSION}" != "${WIKI_SUBTITLE}" ] || [ "${PACKAGE_VERSION}" != "${WIKI_CURRENT}" ]; then
+      error "Wiki version note is out of lockstep with admin/package.json (${PACKAGE_VERSION})."
+      error "  .github/wiki/Home.md subtitle       : ${WIKI_SUBTITLE}"
+      error "  .github/wiki/Home.md Current Version: ${WIKI_CURRENT}"
+      error "Bump both wiki strings in the same commit as the version bump."
+      FAIL=1
+    else
+      ok "wiki Home.md matches: ${PACKAGE_VERSION}"
+    fi
+  fi
+else
+  info "${WIKI_HOME} not found — skipping wiki version check."
+fi
+
+# ── 6. Final result ───────────────────────────────────────────────────────────
 
 if [ "${FAIL}" -eq 1 ]; then
   error "Version lockstep check FAILED. Fix the mismatch before committing."