From 56a3fa60c40841ef2a0210a4cc38cd96a978509e Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 11:03:20 -0500
Subject: [PATCH 01/11] Add next-version.sh to compute the next release version
 from tags

---
 .github/scripts/next-version.sh      | 66 +++++++++++++++++++
 .github/scripts/next-version.test.sh | 98 ++++++++++++++++++++++++++++
 2 files changed, 164 insertions(+)
 create mode 100755 .github/scripts/next-version.sh
 create mode 100755 .github/scripts/next-version.test.sh

diff --git a/.github/scripts/next-version.sh b/.github/scripts/next-version.sh
new file mode 100755
index 0000000..a711ce0
--- /dev/null
+++ b/.github/scripts/next-version.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BUMP="${1:?Usage: next-version.sh <patch|minor|major>}"
+
+case "$BUMP" in
+  patch|minor|major) ;;
+  *)
+    echo "Unknown bump type: $BUMP" >&2
+    exit 1
+    ;;
+esac
+
+LATEST_SEMVER=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' \
+  | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+  | sed 's/^v//' \
+  | sort -t. -k1,1n -k2,2n -k3,3n \
+  | tail -1 || true)
+
+if [ -n "$LATEST_SEMVER" ]; then
+  MAJOR=$(echo "$LATEST_SEMVER" | cut -d. -f1)
+  MINOR=$(echo "$LATEST_SEMVER" | cut -d. -f2)
+  PATCH=$(echo "$LATEST_SEMVER" | cut -d. -f3)
+
+  case "$BUMP" in
+    major)
+      MAJOR=$((MAJOR + 1))
+      MINOR=0
+      PATCH=0
+      ;;
+    minor)
+      MINOR=$((MINOR + 1))
+      PATCH=0
+      ;;
+    patch)
+      PATCH=$((PATCH + 1))
+      ;;
+  esac
+else
+  LATEST_FLOATING=$(git tag -l 'v[0-9]*' \
+    | grep -E '^v[0-9]+$' \
+    | sed 's/^v//' \
+    | sort -n \
+    | tail -1 || true)
+
+  if [ -z "$LATEST_FLOATING" ]; then
+    echo "No version tags found (neither vX.Y.Z nor vN)." >&2
+    exit 1
+  fi
+
+  echo "No vX.Y.Z tag found; bootstrapping from floating tag v${LATEST_FLOATING}. Ignoring requested bump '${BUMP}'." >&2
+  MAJOR="$LATEST_FLOATING"
+  MINOR=0
+  PATCH=0
+fi
+
+NEXT_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+
+if [ "$MAJOR" = "3" ]; then
+  IS_V3=true
+else
+  IS_V3=false
+fi
+
+echo "NEXT_VERSION=${NEXT_VERSION}"
+echo "IS_V3=${IS_V3}"
diff --git a/.github/scripts/next-version.test.sh b/.github/scripts/next-version.test.sh
new file mode 100755
index 0000000..8989098
--- /dev/null
+++ b/.github/scripts/next-version.test.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NEXT_VERSION_SH="$SCRIPT_DIR/next-version.sh"
+FAILURES=0
+
+assert_eq() {
+  local description="$1" expected="$2" actual="$3"
+  if [ "$expected" != "$actual" ]; then
+    echo "FAIL: $description (expected '$expected', got '$actual')" >&2
+    FAILURES=$((FAILURES + 1))
+  else
+    echo "PASS: $description"
+  fi
+}
+
+new_temp_repo() {
+  local tmp
+  tmp=$(mktemp -d)
+  git init -q "$tmp"
+  git -C "$tmp" config user.email "test@example.com"
+  git -C "$tmp" config user.name "Test"
+  git -C "$tmp" commit -q --allow-empty -m "init"
+  echo "$tmp"
+}
+
+# Test: no tags at all -> non-zero exit
+repo=$(new_temp_repo)
+if (cd "$repo" && bash "$NEXT_VERSION_SH" patch) >/dev/null 2>&1; then
+  echo "FAIL: expected failure with no tags present" >&2
+  FAILURES=$((FAILURES + 1))
+else
+  echo "PASS: fails with no tags present"
+fi
+rm -rf "$repo"
+
+# Test: bootstrap from floating v3 tag, ignoring the requested bump
+repo=$(new_temp_repo)
+git -C "$repo" tag v3
+OUTPUT=$(cd "$repo" && bash "$NEXT_VERSION_SH" patch)
+assert_eq "bootstrap ignores bump, uses floating major" "$(printf 'NEXT_VERSION=3.0.0\nIS_V3=true')" "$OUTPUT"
+rm -rf "$repo"
+
+# Test: patch bump from full semver tag
+repo=$(new_temp_repo)
+git -C "$repo" tag v3.2.1
+OUTPUT=$(cd "$repo" && bash "$NEXT_VERSION_SH" patch)
+assert_eq "patch bump" "$(printf 'NEXT_VERSION=3.2.2\nIS_V3=true')" "$OUTPUT"
+rm -rf "$repo"
+
+# Test: minor bump resets patch
+repo=$(new_temp_repo)
+git -C "$repo" tag v3.2.1
+OUTPUT=$(cd "$repo" && bash "$NEXT_VERSION_SH" minor)
+assert_eq "minor bump resets patch" "$(printf 'NEXT_VERSION=3.3.0\nIS_V3=true')" "$OUTPUT"
+rm -rf "$repo"
+
+# Test: major bump resets minor/patch and flips IS_V3 to false
+repo=$(new_temp_repo)
+git -C "$repo" tag v3.2.1
+OUTPUT=$(cd "$repo" && bash "$NEXT_VERSION_SH" major)
+assert_eq "major bump resets minor/patch" "$(printf 'NEXT_VERSION=4.0.0\nIS_V3=false')" "$OUTPUT"
+rm -rf "$repo"
+
+# Test: a full semver tag takes priority over an existing floating tag
+repo=$(new_temp_repo)
+git -C "$repo" tag v3
+git -C "$repo" tag v3.2.1
+OUTPUT=$(cd "$repo" && bash "$NEXT_VERSION_SH" patch)
+assert_eq "full semver tag wins over floating tag" "$(printf 'NEXT_VERSION=3.2.2\nIS_V3=true')" "$OUTPUT"
+rm -rf "$repo"
+
+# Test: numeric sort, not lexicographic (v3.10.0 > v3.2.1)
+repo=$(new_temp_repo)
+git -C "$repo" tag v3.2.1
+git -C "$repo" tag v3.10.0
+OUTPUT=$(cd "$repo" && bash "$NEXT_VERSION_SH" patch)
+assert_eq "numeric sort picks v3.10.0 over v3.2.1" "$(printf 'NEXT_VERSION=3.10.1\nIS_V3=true')" "$OUTPUT"
+rm -rf "$repo"
+
+# Test: invalid bump type is rejected
+repo=$(new_temp_repo)
+git -C "$repo" tag v3.2.1
+if (cd "$repo" && bash "$NEXT_VERSION_SH" bogus) >/dev/null 2>&1; then
+  echo "FAIL: expected failure for invalid bump type" >&2
+  FAILURES=$((FAILURES + 1))
+else
+  echo "PASS: rejects invalid bump type"
+fi
+rm -rf "$repo"
+
+if [ "$FAILURES" -gt 0 ]; then
+  echo "$FAILURES test(s) failed" >&2
+  exit 1
+fi
+
+echo "All next-version.sh tests passed"

From faafeea34beaf14a9b54d1b6f5538d361e8d4864 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 11:19:08 -0500
Subject: [PATCH 02/11] Add bump-major-version.sh to update version.txt on
 major releases

---
 .github/scripts/bump-major-version.sh      |  8 ++++
 .github/scripts/bump-major-version.test.sh | 43 ++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100755 .github/scripts/bump-major-version.sh
 create mode 100755 .github/scripts/bump-major-version.test.sh

diff --git a/.github/scripts/bump-major-version.sh b/.github/scripts/bump-major-version.sh
new file mode 100755
index 0000000..53c25be
--- /dev/null
+++ b/.github/scripts/bump-major-version.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION="${1:?Usage: bump-major-version.sh <version> [version_file]}"
+VERSION_FILE="${2:-.github/workflows/version.txt}"
+MAJOR="${VERSION%%.*}"
+
+echo "$MAJOR" > "$VERSION_FILE"
diff --git a/.github/scripts/bump-major-version.test.sh b/.github/scripts/bump-major-version.test.sh
new file mode 100755
index 0000000..70e0dbe
--- /dev/null
+++ b/.github/scripts/bump-major-version.test.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BUMP_MAJOR_SH="$SCRIPT_DIR/bump-major-version.sh"
+FAILURES=0
+
+assert_eq() {
+  local description="$1" expected="$2" actual="$3"
+  if [ "$expected" != "$actual" ]; then
+    echo "FAIL: $description (expected '$expected', got '$actual')" >&2
+    FAILURES=$((FAILURES + 1))
+  else
+    echo "PASS: $description"
+  fi
+}
+
+# Test: writes the major version number to the given file
+tmp_file=$(mktemp)
+bash "$BUMP_MAJOR_SH" "4.0.0" "$tmp_file"
+assert_eq "writes major version" "4" "$(cat "$tmp_file")"
+rm -f "$tmp_file"
+
+# Test: multi-digit major version
+tmp_file=$(mktemp)
+bash "$BUMP_MAJOR_SH" "12.3.4" "$tmp_file"
+assert_eq "writes multi-digit major version" "12" "$(cat "$tmp_file")"
+rm -f "$tmp_file"
+
+# Test: missing version argument fails
+if bash "$BUMP_MAJOR_SH" >/dev/null 2>&1; then
+  echo "FAIL: expected failure with no version argument" >&2
+  FAILURES=$((FAILURES + 1))
+else
+  echo "PASS: fails with no version argument"
+fi
+
+if [ "$FAILURES" -gt 0 ]; then
+  echo "$FAILURES test(s) failed" >&2
+  exit 1
+fi
+
+echo "All bump-major-version.sh tests passed"

From 84164d0066792dc7f759143971aac8a3d5f4798f Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 12:42:13 -0500
Subject: [PATCH 03/11] Run release script tests in CI

---
 .github/workflows/ci.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 43ce8c3..1a7353b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,3 +58,19 @@ jobs:
         id: npm-ci-test
         working-directory: ${{ matrix.working-directory }}
         run: npm run ci-test
+
+  test-shell-scripts:
+    name: Shell Script Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Run next-version.sh tests
+        run: bash .github/scripts/next-version.test.sh
+
+      - name: Run bump-major-version.sh tests
+        run: bash .github/scripts/bump-major-version.test.sh

From e2fd7850aa5cbf9366979a2c88e9e357b5e2c6a5 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 13:07:58 -0500
Subject: [PATCH 04/11] Add release workflow for patch/minor/major version
 bumps

---
 .github/workflows/release.yml | 119 ++++++++++++++++++++++++++++++++++
 1 file changed, 119 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..06deeea
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,119 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Version part to bump
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+      dry_run:
+        description: Whether this is a dry run
+        required: true
+        type: boolean
+        default: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    environment: release
+    if: github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+
+      - uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          fetch-depth: 0
+          # Needed to push the tag and version bump commit in later steps.
+          persist-credentials: true
+
+      - name: Setup
+        uses: $/setup
+        with:
+          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
+          aws_region_name: ${{ vars.AWS_REGION_NAME }}
+          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
+
+      - name: Determine next version
+        shell: bash
+        run: bash .github/scripts/next-version.sh "${{ inputs.bump }}" >> "$GITHUB_ENV"
+
+      - name: Bump the major version file
+        if: inputs.bump == 'major'
+        uses: $/bump-version
+        with:
+          version: ${{ env.NEXT_VERSION }}
+          version_bump_script: "bash .github/scripts/bump-major-version.sh"
+          push_commit: ${{ inputs.dry_run == false }}
+
+      - name: Tag the version
+        uses: $/tag-version
+        with:
+          version: ${{ env.NEXT_VERSION }}
+          tag_template: "v${VERSION}"
+          push_tag: ${{ inputs.dry_run == false }}
+
+      - name: Report floating v3 tag update (dry run)
+        if: env.IS_V3 == 'true' && inputs.dry_run == true
+        shell: bash
+        run: |
+          echo "[dry-run] Would move floating tag v3 to $(git rev-parse HEAD)" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Remove the existing v3 tag
+        if: env.IS_V3 == 'true' && inputs.dry_run == false
+        shell: bash -eux {0}
+        run: |
+          git push origin ":v3" || true
+
+      - name: Create a new signed v3 tag
+        if: env.IS_V3 == 'true' && inputs.dry_run == false
+        uses: $/git-sign
+        with:
+          command: git tag -a "v3" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
+
+      - name: Push the v3 tag
+        if: env.IS_V3 == 'true' && inputs.dry_run == false
+        shell: bash -eux {0}
+        run: |
+          git push origin --tags
+
+      - name: Warn about floating tag retirement
+        if: env.IS_V3 != 'true'
+        shell: bash
+        run: |
+          MESSAGE="Release v${NEXT_VERSION} does not use floating tags. Remove the floating-tag-update steps (Remove/Create/Push v3 tag, and this warning) from .github/workflows/release.yml."
+          echo "::warning::$MESSAGE"
+          echo "$MESSAGE" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Create GitHub Release
+        if: inputs.dry_run == false
+        shell: bash
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          gh release create "v${NEXT_VERSION}" --title "v${NEXT_VERSION}" --generate-notes
+          echo "Created release v${NEXT_VERSION}" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Report release (dry run)
+        if: inputs.dry_run == true
+        shell: bash
+        run: |
+          echo "[dry-run] Would create tag v${NEXT_VERSION} and GitHub Release v${NEXT_VERSION}" >> "$GITHUB_STEP_SUMMARY"

From a8c63ee8934659620820c730db8d05da48b1f3bb Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 14:33:42 -0500
Subject: [PATCH 05/11] Fix release.yml v3 tag race and surface next-version
 diagnostics

- Replace delete-then-recreate v3 tag handling with force-tag +
  force-push to avoid a window where the remote v3 tag is deleted
  but recreation can fail (local v3 already exists due to
  fetch-depth: 0), which would leave v3 consumers broken.
- Capture next-version.sh stderr separately and surface it in the
  job summary so the bootstrap-mode notice (major bump silently
  ignored when no vX.Y.Z tags exist yet) is visible to the operator.
---
 .github/workflows/release.yml | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 06deeea..2eca5a5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,12 @@ jobs:
 
       - name: Determine next version
         shell: bash
-        run: bash .github/scripts/next-version.sh "${{ inputs.bump }}" >> "$GITHUB_ENV"
+        run: |
+          bash .github/scripts/next-version.sh "${{ inputs.bump }}" > /tmp/next-version.out 2> /tmp/next-version.err
+          cat /tmp/next-version.out >> "$GITHUB_ENV"
+          if [ -s /tmp/next-version.err ]; then
+            cat /tmp/next-version.err >> "$GITHUB_STEP_SUMMARY"
+          fi
 
       - name: Bump the major version file
         if: inputs.bump == 'major'
@@ -77,29 +82,23 @@ jobs:
         run: |
           echo "[dry-run] Would move floating tag v3 to $(git rev-parse HEAD)" >> "$GITHUB_STEP_SUMMARY"
 
-      - name: Remove the existing v3 tag
-        if: env.IS_V3 == 'true' && inputs.dry_run == false
-        shell: bash -eux {0}
-        run: |
-          git push origin ":v3" || true
-
       - name: Create a new signed v3 tag
         if: env.IS_V3 == 'true' && inputs.dry_run == false
         uses: $/git-sign
         with:
-          command: git tag -a "v3" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
+          command: git tag -a "v3" -f -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
 
       - name: Push the v3 tag
         if: env.IS_V3 == 'true' && inputs.dry_run == false
         shell: bash -eux {0}
         run: |
-          git push origin --tags
+          git push --force origin refs/tags/v3:refs/tags/v3
 
       - name: Warn about floating tag retirement
         if: env.IS_V3 != 'true'
         shell: bash
         run: |
-          MESSAGE="Release v${NEXT_VERSION} does not use floating tags. Remove the floating-tag-update steps (Remove/Create/Push v3 tag, and this warning) from .github/workflows/release.yml."
+          MESSAGE="Release v${NEXT_VERSION} does not use floating tags. Remove the floating-tag-update steps (Create/Push v3 tag, and this warning) from .github/workflows/release.yml."
           echo "::warning::$MESSAGE"
           echo "$MESSAGE" >> "$GITHUB_STEP_SUMMARY"
 

From 60edc5ef661b54f1beba4768a362bfec52e4d01f Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 14:43:04 -0500
Subject: [PATCH 06/11] Replace update-action-tag workflow with the release
 workflow

---
 .github/workflows/update-action-tag.yml | 52 -------------------------
 CONTRIBUTING.md                         |  8 ++--
 README.md                               |  6 +++
 3 files changed, 11 insertions(+), 55 deletions(-)
 delete mode 100644 .github/workflows/update-action-tag.yml

diff --git a/.github/workflows/update-action-tag.yml b/.github/workflows/update-action-tag.yml
deleted file mode 100644
index 3dd4902..0000000
--- a/.github/workflows/update-action-tag.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: Update Tag
-
-on:
-  workflow_dispatch:
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-jobs:
-  update-tag:
-    name: Update Tag
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: write
-      id-token: write
-
-    steps:
-      - uses: actions/create-github-app-token@v3
-        id: app-token
-        with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          permission-contents: write
-
-      - uses: actions/checkout@v7
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          # Needed to push the tag in the final step
-          persist-credentials: true
-
-      - name: Setup
-        uses: $/setup
-        with:
-          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
-          aws_region_name: ${{ vars.AWS_REGION_NAME }}
-          aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
-
-      - name: Remove the existing tag
-        run: |
-          export VERSION=$(cat .github/workflows/version.txt)
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
-          git push origin ":v${VERSION}" || true
-
-      - name: Create a new signed tag
-        uses: $/git-sign
-        with:
-          command: git tag -a "v${{ env.VERSION }}" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
-
-      - name: Push the tag
-        run:
-            git push origin --tags
\ No newline at end of file
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e8f4212..52cc052 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -26,10 +26,12 @@ pre-commit run --all-files --hook-stage manual shellcheck
 
 ## Version Tag
 
-To bump the version tag, run the "Update Tag" [workflow](https://github.com/mongodb-labs/drivers-github-tools/actions/workflows/update-action-tag.yml).
+To cut a release, run the [Release workflow](https://github.com/mongodb-labs/drivers-github-tools/actions/workflows/release.yml)
+with the desired `bump` input (`patch`, `minor`, or `major`). Use `dry_run: true` first to preview
+the computed version before pushing anything.
 
-To change the major version, update `.github/workflows/version.txt`. Internal
+A `major` bump also updates `.github/workflows/version.txt` automatically. Internal
 action-to-action references use `$/` and do not need updating on a version bump.
 Update the example `mongodb-labs/drivers-github-tools/...@vX` references in
 `README.md` and `node/release_template.yml`, both of which document or use the
-tag external consumers should pin to.
\ No newline at end of file
+tag external consumers should pin to — this remains a manual step after a major bump.
\ No newline at end of file
diff --git a/README.md b/README.md
index 32a5a79..fcaa416 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,12 @@ latest tagged version. For example, pinning `full-report` to an old sha means
 it also calls that old sha's `sbom`, `authorized-pub`, `code-scanning-export`,
 and `compliance-report`. Bump your pin to pick up sub-action updates too.
 
+> [!NOTE]
+> Through `v3`, this repo maintains floating major-version tags (e.g. `v3`) that move to the
+> latest commit on `main`. Starting with `v4`, only immutable `vX.Y.Z` release tags are produced;
+> there is no floating `v4` tag. Pin to an exact `vX.Y.Z` tag (or its resolved commit SHA) once you
+> move to `v4`.
+
 Example `dependabot.yml`:
 
 ```yaml

From 982c7d9a89e08b0781526f345bf5bf1477902113 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 15:11:36 -0500
Subject: [PATCH 07/11] Rename shell-script test job to test-release-scripts

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1a7353b..e8cd893 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,8 +59,8 @@ jobs:
         working-directory: ${{ matrix.working-directory }}
         run: npm run ci-test
 
-  test-shell-scripts:
-    name: Shell Script Tests
+  test-release-scripts:
+    name: Release Scripts Tests
     runs-on: ubuntu-latest
 
     steps:

From 9d8986f9d2d33d55e0aa721a707a9c71095a081a Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 15:16:29 -0500
Subject: [PATCH 08/11] Pin actions/checkout and
 actions/create-github-app-token to commit SHAs

---
 .github/workflows/ci.yml      | 2 +-
 .github/workflows/release.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e8cd893..b8660fc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2eca5a5..1d989f9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,14 +31,14 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/create-github-app-token@v3
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0

From e820b8bd543ab0199f44945a6b3e367555e10d6d Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 15:18:19 -0500
Subject: [PATCH 09/11] Use exact version numbers in SHA-pin comments

---
 .github/workflows/ci.yml      | 2 +-
 .github/workflows/release.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b8660fc..a45623f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d989f9..c98bba6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,14 +31,14 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0

From fef4e090fa4eaceaf8296f937accbbc2219c6771 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 16:12:25 -0500
Subject: [PATCH 10/11] Fix release.yml v3 tag race and surface next-version
 diagnostics

---
 .github/workflows/release.yml | 9 ++++++++-
 CONTRIBUTING.md               | 8 +++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c98bba6..06ddbff 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,11 +55,18 @@ jobs:
       - name: Determine next version
         shell: bash
         run: |
+          set +e
           bash .github/scripts/next-version.sh "${{ inputs.bump }}" > /tmp/next-version.out 2> /tmp/next-version.err
-          cat /tmp/next-version.out >> "$GITHUB_ENV"
+          STATUS=$?
+          set -e
           if [ -s /tmp/next-version.err ]; then
+            cat /tmp/next-version.err
             cat /tmp/next-version.err >> "$GITHUB_STEP_SUMMARY"
           fi
+          if [ "$STATUS" -ne 0 ]; then
+            exit "$STATUS"
+          fi
+          cat /tmp/next-version.out >> "$GITHUB_ENV"
 
       - name: Bump the major version file
         if: inputs.bump == 'major'
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 52cc052..981ce20 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -34,4 +34,10 @@ A `major` bump also updates `.github/workflows/version.txt` automatically. Inter
 action-to-action references use `$/` and do not need updating on a version bump.
 Update the example `mongodb-labs/drivers-github-tools/...@vX` references in
 `README.md` and `node/release_template.yml`, both of which document or use the
-tag external consumers should pin to — this remains a manual step after a major bump.
\ No newline at end of file
+tag external consumers should pin to — this remains a manual step after a major bump.
+
+Before the first `vX.Y.Z` tag exists, the workflow bootstraps from the current floating
+major tag (e.g. `v3` becomes `v3.0.0`) and ignores the requested `bump` input for that one
+run — don't be surprised if a first-time `major`/`minor` bump doesn't change the version the
+way you'd expect. Every release after that first one bumps normally from the latest `vX.Y.Z`
+tag.
\ No newline at end of file

From 424b3ab3e83430e8b2726990a6127427c87b245f Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Wed, 5 Aug 2026 16:17:03 -0500
Subject: [PATCH 11/11] Remove bootstrap-behavior doc note, covered by this
 ticket's first release

---
 CONTRIBUTING.md | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 981ce20..52cc052 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -34,10 +34,4 @@ A `major` bump also updates `.github/workflows/version.txt` automatically. Inter
 action-to-action references use `$/` and do not need updating on a version bump.
 Update the example `mongodb-labs/drivers-github-tools/...@vX` references in
 `README.md` and `node/release_template.yml`, both of which document or use the
-tag external consumers should pin to — this remains a manual step after a major bump.
-
-Before the first `vX.Y.Z` tag exists, the workflow bootstraps from the current floating
-major tag (e.g. `v3` becomes `v3.0.0`) and ignores the requested `bump` input for that one
-run — don't be surprised if a first-time `major`/`minor` bump doesn't change the version the
-way you'd expect. Every release after that first one bumps normally from the latest `vX.Y.Z`
-tag.
\ No newline at end of file
+tag external consumers should pin to — this remains a manual step after a major bump.
\ No newline at end of file