Auto-bump version in build workflow

[Copilot]

VERSION file and README.md are never updated during builds, so OCI images get stale version info baked into /VERSION (and thus /etc/motd).

Changes to .github/workflows/build.yaml

• contents: write permission — needed to push the version commit back
• Checkout with full history — uses ref: ${{ github.ref }} and fetch-depth: 0 to avoid detached HEAD issues
• Patch version bump step — parses VERSION (name major.minor.patch channel), validates semver format with regex, increments patch, writes back to VERSION and updates the matching line in README.md using Python for safer string replacement
• Commit + push step — commits as github-actions[bot], with guards for no-op changes and explicit push to origin HEAD:${{ github.ref }}

The bump runs before the existing "VERSION file to CI envvars" step, so Docker image tags and the container's /VERSION reflect the new version.

[Copilot]

Pull request overview

Adds automatic patch-version bumping to the manual build workflow so the repo’s VERSION (and corresponding README version line) are updated before building/publishing OCI images, keeping /VERSION and /etc/motd in the resulting images current.

Changes:

• Grant workflow contents: write permission to allow committing back to the repo.
• Add a step to parse VERSION, increment the patch component, and update VERSION + the matching line in README.md.
• Add a commit-and-push step to persist the bumped version before exporting VERSION into CI env vars and tagging images.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

actions/checkout@v4 checks out a specific commit and typically leaves the repo in a detached HEAD state (and by default with fetch-depth: 1). In that state, git pull --rebase and especially git push can fail because there’s no local branch/upstream configured and history may be too shallow to rebase. Update the workflow to check out the triggering branch with full history (e.g., set ref and fetch-depth: 0) and push explicitly to that branch (or otherwise ensure a tracking branch exists) before relying on git pull/push.

[Copilot]

read -r name ver channel < VERSION || true suppresses failures and allows empty/invalid values to flow into version math. If VERSION is missing or malformed, this can write an invalid version (e.g., ..1) or bump the wrong thing. Prefer failing fast when parsing doesn’t match the expected name major.minor.patch channel format, and validate that major/minor/patch are numeric before incrementing.

Suggested change

	read -r name ver channel < VERSION || true
	IFS='.' read -r major minor patch <<< "$ver"
	if ! read -r name ver channel < VERSION; then
	echo "Error: failed to read VERSION file or file is missing" >&2
	exit 1
	fi
	if [ -z "$name" ] || [ -z "$ver" ] || [ -z "$channel" ]; then
	echo "Error: VERSION must be in the format: <name> <major.minor.patch> <channel>" >&2
	echo "Got: name='${name}', ver='${ver}', channel='${channel}'" >&2
	exit 1
	fi
	if ! [[ "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
	echo "Error: version '${ver}' is not a valid semantic version (expected major.minor.patch)" >&2
	exit 1
	fi
	IFS='.' read -r major minor patch <<< "$ver"
	if [ -z "$major" ] || [ -z "$minor" ] || [ -z "$patch" ]; then
	echo "Error: failed to parse version components from '${ver}'" >&2
	exit 1
	fi

[Copilot]

The sed -i "s/> ${name} ${ver} ${channel}/.../" replacement is brittle: it treats name/ver/channel as a regex replacement pattern (so special characters can break matching) and it doesn’t verify that README was actually updated (a no-match will silently leave stale version text). Consider using a safer delimiter/escaping strategy or a small script that does an exact match and fails the step if the expected line isn’t found/updated.

Suggested change

	sed -i "s/> ${name} ${ver} ${channel}/> ${name} ${new_ver} ${channel}/" README.md
	old="> ${name} ${ver} ${channel}"
	new="> ${name} ${new_ver} ${channel}"
	python - "$old" "$new" << 'PY'
	import sys
	from pathlib import Path
	old, new = sys.argv[1], sys.argv[2]
	path = Path("README.md")
	text = path.read_text(encoding="utf-8")
	if old not in text:
	raise SystemExit(f"Old version string not found in README.md: {old!r}")
	text = text.replace(old, new, 1)
	path.write_text(text, encoding="utf-8")
	PY

[mobileskyfi]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied all three review comments in commit 17b4521:

1. Checkout fix: Added ref: ${{ github.ref }} and fetch-depth: 0 to avoid detached HEAD state
2. Version validation: Added semver regex validation (^[0-9]+\.[0-9]+\.[0-9]+$) and empty field checks, with proper error messages
3. README update: Replaced brittle sed with Python script that uses exact string matching and fails if the version string isn't found
4. Push fix: Changed to explicit git push origin HEAD:${{ github.ref }}