chore(release): v0.21.1 — fix version string, guard it with a test

[muqsitnawaz]

The bug

v0.21.0 shipped with linear:69 still reading __version__ = "0.20.0". Every 0.21.0 install runs the correct code — the owner guard is live — but the CLI self-reports the previous version.

Found immediately after rolling v0.21.0 out to nine fleet machines: the post-install verification sweep reported every box as still on 0.20.0, which is indistinguishable from a failed rollout.

$ shasum -a 256 $(which linear)
d68fe508cb19460d0f2a517062a7a66646525539a11caedaa4a15ae5b3717cbe   # correct v0.21.0 blob
$ linear --version
linear-cli 0.20.0                                                   # wrong

Root cause: __version__ is bumped in the feature commit, not the release commit (3811dfd did it for 0.20.0), so the release checklist never touches it and #44 missed it.

The fix

• __version__ → 0.21.1
• VersionMatchesChangelogTest — asserts __version__ equals the newest released ## [x.y.z] heading in CHANGELOG.md, so the suite fails the moment they drift. Verified it actually catches this: reverting __version__ to 0.20.0 fails the test with __version__ is '0.20.0' but the newest CHANGELOG entry is '0.21.1'. Bump __version__ in \linear` when you add the CHANGELOG entry, not at release time.`
• Re-pins install.sh and both README snippets to v0.21.1.

Because linear itself changed, the checksum is new:

$ shasum -a 256 linear
4055001dcdef84f21b30760a1a1e922dd4d0d7b4b9c936d3a6e5c4c143e7b465

v0.21.0 stays as published — tags aren't rewritten.

$ python3 -m unittest test_linear
Ran 146 tests in 0.024s
OK
$ ./linear --version
linear-cli 0.21.1

No behavior change beyond the version string. Follows #44 and #45.

[prix-cloud]

VERDICT: APPROVE

Code Reviewer

Verdict: Ready to merge

Build: No build step — single-file Python CLI, no compilation required.
Tests: 146 passed, 0 failed, 0 skipped in 0.025s

What was verified

• Version string: ./linear --version → linear-cli 0.21.1 ✅
• __version__ value: linear:69 reads "0.21.1" ✅
• install.sh pins: v0.21.1 with updated SHA-256 checksum (4055001dcdef84f21b30760a1a1e922dd4d0d7b4b9c936d3a6e5c4c143e7b465) ✅
• README snippets: both install examples pinned to v0.21.1 ✅
• CHANGELOG: ## [0.21.1] - 2026-09-05 entry with accurate description ✅
• Regression guard: The new VersionMatchesChangelogTest.test_version_matches_newest_released_changelog_entry test passes. Manually verified it catches the original bug: reverting __version__ to "0.20.0" produces a clear assertion failure ("0.20.0" ≠ "0.21.1") ✅

Diff review

All 5 changed files are scoped to the version bump and its documentation:

File	Change	Review
linear:69	__version__ → 0.21.1	Correct — one-line fix of the root cause
test_linear.py	New VersionMatchesChangelogTest class (21 lines)	Well-structured test that parses CHANGELOG.md headings via regex, asserts __version__ matches the newest released entry. Error message is actionable: it tells the developer exactly what to do. Pattern ## [Unreleased] is correctly excluded by the regex. No stubs, no TODOs.
CHANGELOG.md	New [0.21.1] entry	Accurate description linking the version string to the fleet-verification failure mode
install.sh:9-10	VERSION and EXPECTED_SHA256 bumped	SHA-256 correctly updated to match the new blob
README.md:33,38	Install snippet pins bumped	Consistent with install.sh

Things that were checked and are fine

• No new environment variables introduced
• No stubs, TODOs, or NotImplementedError — the new test is complete, the version string is the only behavior change
• No file pushed past size limits (this is a single-file ~2.7k-line Python CLI; no new files added)
• No duplication — the version source of truth remains __version__ in linear, and the test reads from it

Conclusion

Clean, minimal, well-documented fix for a real operational bug. The guard test prevents recurrence and is written to be understood months from now. Ready to merge.

---

Reviewed by Code Reviewer — actually ran the build and tests on this branch.

[prix-cloud]

VERDICT: APPROVE

Code Reviewer

Verdict: Ready to merge

Build: Clean (syntax check: exit 0)
Tests: 146 passed, 0 failed, 0 skipped in 0.026s

What was verified

Check	Result
./linear --version	linear-cli 0.21.1 ✓
__version__ in linear:69	"0.21.1" ✓
Newest CHANGELOG heading	## [0.21.1] - 2026-09-05 ✓
VersionMatchesChangelogTest.test_version_matches_newest_released_changelog_entry	Passes (would fail if __version__ were still 0.20.0) ✓
install.sh version pin	v0.21.1 ✓
install.sh SHA-256	4055001dcdef... ✓
README install snippet (both variants)	v0.21.1 ✓

The fix addresses the root cause

The old process bumped __version__ in the feature commit rather than the release commit, so the release checklist never caught it. The new VersionMatchesChangelogTest now asserts __version__ matches the newest ## [x.y.z] heading in CHANGELOG.md — so the test suite itself fails the moment they drift, regardless of which commit bumps which. This is a better guard than a checklist item because it's automated and runs on every change.

No issues found

• All three pin targets (install.sh, README curl, README manual) updated consistently to v0.21.1
• CHANGELOG entry is well-written and explains the bug clearly
• No stubs, no env vars, no scope creep
• No files touched outside the release scope

---

Reviewed by Code Reviewer — actually ran the build and tests on this branch.

[muqsitnawaz]

Non-author review — verdict: READY TO MERGE

Reviewed by the code-reviewer subagent (non-author), all values computed independently rather than read from the PR body.

Checksum — correct, and taken from the post-change file. Unlike #45, this PR does modify linear, so the pin had to be recomputed:

$ shasum -a 256 linear
4055001dcdef84f21b30760a1a1e922dd4d0d7b4b9c936d3a6e5c4c143e7b465

Matches install.sh:11. The reviewer also cross-checked the previous pin — git show origin/main:linear | shasum -a 256 = d68fe508…, matching origin/main's install.sh — confirming neither pin is stale or swapped.

No hidden behavior change. git diff origin/main...HEAD -- linear touches exactly one line in the 213 KB file: the __version__ constant. PATCH bump is correct.

Byte-identical at the future tag. Single commit ahead of origin/main, merge-base == origin/main tip, no divergence.

The new test holds up. ^## \[(\d+\.\d+\.\d+)\] correctly skips ## [Unreleased] (no digits), CHANGELOG is newest-first per its own Keep-a-Changelog contract so versions[0] is the newest entry, and assertTrue(versions, ...) guards against a vacuous pass. _HERE is __file__-based — confirmed by running the suite from /tmp via unittest discover: 146 tests, OK. The reviewer independently mutated __version__ to 0.21.0, saw the test fail, restored it, and verified git status clean and the checksum back to 4055001d….

Version references. install.sh:9 and both README snippets (README.md:33,39) are on v0.21.1. Repo-wide grep found the only remaining 0.21.0/0.20.0 strings are historical CHANGELOG headings and prose narrating this incident — correctly left alone.

CI green: Analyze (actions), Analyze (python), CodeQL, unittest ×2.

One extra commit since the review

The reviewer burned time on a false "the version test is flaky" lead: macOS system python3 caches the extensionless linear as linearcpython-39.pyc, and "0.20.0" → "0.21.1" is a same-length edit, so a stale cache reads as a real failure. Added that as a note in test_linear.py's module docstring so the next person doesn't repeat it. Docs-only, doesn't touch linear, checksum re-verified unchanged after the commit.

v0.21.0 stays published as-is — tags aren't rewritten.