[bitbiter-dev]

Summary

#332 bumped EF Core to 10.0.14 but left dotnet-ef at 10.0.13. With mismatched versions, dotnet ef prints a version notice to stdout, the notice lands in docs/schema.sql, and derive-db-docs fails.

Dependabot reads a tool manifest only at ./.config/dotnet-tools.json, searching from the configured directory (/src) up to the repository root (MSBuildHelper.TryGetDotNetToolsJsonPath in dependabot-core). It never read ours, which sat at the root.

-dotnet-tools.json
+.config/dotnet-tools.json         # Dependabot finds it: dotnet-ef rides in the nuget group
 .github/dependabot.yml
+  ignore: dotnet-stryker          # an upgrade has its own procedure (docs/mutation-testing.md)
 .github/workflows/ci.yml
   Checks
+    scripts/tool-versions.sh      # first step, before setup-dotnet and the build
+    scripts/tool-versions.test.sh
 .husky/task-runner.json
+  pre-commit: scripts/tool-versions.sh
+scripts/tool-versions.sh          # dotnet-ef must equal Microsoft.EntityFrameworkCore

Evidence

• Before: Bump the nuget group with 16 updates #332's Checks job failed with 10 derive-db-docs test failures (dotnet ef emitted something that is not SQL as its first line).
  After: with the manifest set to 10.0.14 against EF Core 10.0.13, the guard fails in milliseconds with one line:

  dotnet-ef 10.0.14 does not match Microsoft.EntityFrameworkCore 10.0.13.
  Set dotnet-ef in .config/dotnet-tools.json to 10.0.13.
  

• scripts/tool-versions.test.sh passes 6 cases: equal versions, either side ahead, a similarly named package (.Design) not compared, dotnet-ef missing, manifest missing.
• dotnet tool restore and dotnet tool run dotnet-ef still resolve from .config/.
• Not yet proven: that Dependabot updates the manifest. To check after merge, comment @dependabot recreate on Bump the nuget group with 16 updates #332. Its diff should include .config/dotnet-tools.json at 10.0.14 and turn green. If the manifest is missing from that diff, the nuget entry also needs to cover /.

Merge Danger

Door: two-way

Moving the file back and dropping the step and task undoes it.

Blast Radius: tooling

Local checkouts need nothing new, since dotnet tool restore searches .config/. The pre-commit hook gains a step that needs jq, which the other scripts already use.

🤖 Generated with Claude Code