ci: open the Version PR as github-actions[bot] with no CI (#1407)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/version-pr.yml

@@ -6,6 +6,17 @@ name: Version PR
 # the deliberate act that cuts a release — release.yml takes over from there.
 #
 # This workflow only ever opens/updates the PR; it never tags or deploys.
+#
+# The PR is opened with GITHUB_TOKEN, so it is authored by github-actions[bot]
+# and carries no CI: events created with that token don't trigger workflows.
+# That is deliberate — the PR only bumps a version string and rewrites
+# CHANGELOG.md, and it is re-pushed on every merge to main, so running the full
+# matrix (Docker builds included) on it would burn CI on every merge without
+# validating anything. The real validation happens after the merge: main runs
+# the full suite and release.yml only cuts a release if that run succeeded.
+# `ls1intum/hephaestus-maintainers` bypasses the branch ruleset, so the missing
+# required checks do not block merging the Version PR.
+#
 # Contributor guide: docs/contributor/release-management.mdx
 
 on:
@@ -28,9 +39,6 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-          # PAT (not GITHUB_TOKEN) so the Version PR's own checks run and, once
-          # merged, its CI/CD run can trigger release.yml.
-          token: ${{ secrets.GH_PAT }}
 
       - name: Setup pnpm + Node.js
         uses: ./.github/actions/setup-pnpm-node
@@ -49,4 +57,4 @@ jobs:
           title: "chore(release): version packages"
           commit: "chore(release): version packages"
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

docs/contributor/release-management.mdx

@@ -40,7 +40,12 @@ sequenceDiagram
    is the explicit opt-out for changes with no user-facing effect; write why in the file body.
 2. **The Version PR accumulates.** On every push to `main`, the release workflow maintains a PR
    titled `chore(release): version packages` that previews the next version and the assembled
-   `CHANGELOG.md` section. It is safe to leave open — it updates itself.
+   `CHANGELOG.md` section. It is safe to leave open — it updates itself. It is opened by
+   `github-actions[bot]` and deliberately runs **no CI**: it only bumps a version string and
+   rewrites the changelog, and it is re-pushed on every merge to `main`, so running the full matrix
+   on it would burn CI without validating anything. Validation happens after the merge — `main` runs
+   the full suite and a release is only cut if that run succeeds. Maintainers bypass the branch
+   ruleset, so the absent required checks don't block the merge.
 3. **Merging the Version PR cuts the release.** The release workflow tags `vX.Y.Z` at the merge
    commit, creates the GitHub Release from the new changelog section, retags the CI-built Docker
    images as `X.Y.Z`, `X.Y`, and `latest`, publishes the signed release-pin asset, and starts the