What

Establish semantic versioning (SemVer) with Git tagged releases for all internal ecosystem libraries, enabling downstream projects to pin specific versions instead of tracking main branch.

• Current: Internal dependencies (common_system, thread_system, container_system, logger_system, monitoring_system, network_system) are referenced by branch name (main) in FetchContent and CI workflows
• Expected: Each project publishes tagged releases (e.g., v0.2.0), and downstream consumers reference specific tags
• Scope: Release process, CI tagging, vcpkg overlay port versioning, FetchContent GIT_TAG references

Why

• Referencing main branch makes builds non-reproducible; the same build config can produce different results on different days
• SOUP traceability (IEC 62304) requires exact version identification for all components
• Breaking changes in upstream libraries can silently propagate to downstream projects
• Impact: Build reproducibility and SOUP compliance are compromised for all internal dependencies

Where

• All ecosystem repositories: common_system, thread_system, container_system, logger_system, monitoring_system, network_system, database_system
• Affected files per repo: CMakeLists.txt (project version), .github/workflows/ (release workflow), vcpkg.json (version field)
• Downstream references: FetchContent GIT_TAG, vcpkg overlay ports REF/SHA512, CI checkout

How

Technical Approach

1. Define version policy: SemVer (MAJOR.MINOR.PATCH)
2. Create release workflow per repository (GitHub Actions)
3. Update all FetchContent declarations to use tagged versions
4. Update vcpkg overlay ports with tagged refs and SHA512 hashes
5. Add version compatibility checks in CMake

Sub-Tasks

• Define ecosystem-wide versioning policy document
• Create release workflow template (reusable across repos)
• Tag initial releases for all 7 projects
• Update all FetchContent GIT_TAG from main to tagged versions
• Update vcpkg overlay ports with tagged refs and SHA512
• Add CMake version compatibility in downstream projects

Acceptance Criteria

• All 7 ecosystem projects have at least one tagged release
• Release workflow generates changelog from conventional commits
• No FetchContent declaration references main branch
• vcpkg overlay ports use tagged refs with valid SHA512 hashes
• DEPENDENCY_MATRIX.md updated with pinned internal versions