[kmokstad]

Summary

Closes #61.

The versioning job currently fails with GH006: Changes must be made through a pull request. Giving GITHUB_TOKEN Contents write permission does not authorize bypassing that protection.

• Create a short-lived GitHub App installation token scoped to this repository and Contents write; use it for checkout and the subsequent Git push. Pin the token action to v3.3.0's immutable commit.
• Reduce the built-in token to Contents read.
• Inspect the pushed head commit rather than the first commit in the push to suppress recursive version bumps. App-authenticated pushes can trigger workflows, unlike GITHUB_TOKEN pushes.
• Parenthesize the last-field awk increment to avoid an observed mawk parsing difference while preserving the intended patch/build increment.
• Document setup and limitations in .github/CONTRIBUTING.md under Automated Version Bumps.

Administrator setup required before merging

This PR is deliberately a draft. The session can edit repository files, but its installation token receives HTTP 403 for branch-protection, Actions secrets, and Actions variables APIs. No protection settings or secrets have been changed, and an App has not been registered or installed.

• Register a dedicated organization-owned GitHub App, with webhooks disabled and only repository Contents: Read and write permission (Metadata read is automatic).
• Install the App only on openfedem/fedem-foundation.
• Set repository Actions variable VERSION_BUMP_APP_CLIENT_ID to the App Client ID.
• Set repository Actions secret VERSION_BUMP_APP_PRIVATE_KEY to its private-key PEM. Do not post the key in this PR.
• Keep main's PR requirement enabled; add the installed App under Allow specified actors to bypass required pull requests in the applicable classic branch protection rule. If push restrictions are enabled, also allow the App to push.
• Review any additional protections: the classic PR bypass does not bypass required checks or signed commits. Any blocking rulesets need an explicit App bypass with Always allow, not PR-only. Keep exemptions narrow and preserve protections for ordinary contributors.

The App bypass is not file-scoped: protect the private key and review workflows that can access it. The App does not need Administration or Workflows write permission for its version-file push.

Validation

• git diff --check passed.
• actionlint v1.7.12 passed on the updated workflow.
• Executed the actual versioning shell steps against a temporary local bare Git remote: confirmed 3.1.3 -> 3.1.4, successful push, only cfg/VERSION changed, and the bump author matches the recursion guard.
• Live token minting/protected-main push remains unverified until the administrator setup above is complete.

After setup and merge, verify that the version commit is pushed successfully, that its resulting versioning run skips the bump job, and that ordinary contributors still cannot push directly to main. Re-running the old failed run will use the old workflow; use a new push containing the updated workflow.