Switch autoversion to a GitHub App identity (#5)

* Switch autoversion to a GitHub App identity

The repo's `main` ruleset blocks direct pushes; default GITHUB_TOKEN
cannot be granted ruleset bypass. This wires autoversion.yml to:

- Mint an installation token from a GitHub App (see README setup)
- Check out with that token so `git push` uses the app identity
- Commit as <app-slug>[bot] with the verified noreply email format
  (<user_id>+<slug>[bot]@users.noreply.github.com)

Once the app is installed on the repo and added to the ruleset's
bypass actors, scheduled and dispatched runs can push directly.

Requires repo secrets HERMIT_APP_ID and HERMIT_APP_PRIVATE_KEY.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Scope autoversion job to hermit-autoversion environment

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mvgijssel

.github/workflows/autoversion.yml

@@ -6,15 +6,30 @@ name: Auto-version
 jobs:
   auto-version:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
+    environment: hermit-autoversion
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.HERMIT_APP_ID }}
+          private-key: ${{ secrets.HERMIT_APP_PRIVATE_KEY }}
+      - name: Get app user id
+        id: app-user
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          echo "id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          token: ${{ steps.app-token.outputs.token }}
       - name: Init Hermit
         run: ./bin/hermit env -r >> $GITHUB_ENV
       - name: Auto-version
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          APP_USER_ID: ${{ steps.app-user.outputs.id }}
         run: |
           set -xe
           hermit -d manifest auto-version --continue-on-error --update-digests $(ls -1 *.hcl | shuf)
@@ -23,7 +38,7 @@ jobs:
             echo "No change"
             exit 0
           fi
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
+          git config --global user.email "${APP_USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com"
+          git config --global user.name "${APP_SLUG}[bot]"
           git commit -am "Auto-versioned: $(git diff --name-only | paste -s -d ' ' -)"
           git push