ci(auto-merge): consume reusable workflow from renovate-config

[ANcpLua]

Summary

Replaces the local auto-merge workflow with a thin caller delegating to the new reusable workflow at ANcpLua/renovate-config (PR #5 there).

Why

When the Owner / AI Agent / CodeRabbit tier calls gh pr merge --auto under GITHUB_TOKEN identity, GitHub records the eventual native-auto-merge as performed by github-actions[bot]. Per GitHub docs, events triggered by GITHUB_TOKEN (other than workflow_dispatch / repository_dispatch) do NOT trigger new workflow runs — anti-loop protection. So the resulting push: main is silently dropped and downstream publish workflows never fire.

Symptom seen on 2026-05-04: ANcpLua.NET.Sdk PR #99 merged at 20:22:30 UTC. The push: main event for the merge commit produced ZERO workflow runs. SDK had to be manually dispatched via gh workflow run to ship v3.4.16.

The fix uses a GitHub App installation token. The App becomes the merge actor; events fire normally.

Required setup

This PR is draft until two repo secrets exist:

• AUTOMERGE_APP_ID — the numeric App ID
• AUTOMERGE_APP_PRIVATE_KEY — full PEM contents of the App's private key

Setup is a one-time 5-min manual step:

1. https://github.com/settings/apps/new — permissions: Contents (Write), Pull requests (Write)
2. Generate private key, download .pem
3. Install the App on this repo
4. Add the two secrets

Once the secrets are in place this PR can be marked ready and merged.

Test plan

• Once secrets exist, mark this PR ready
• Verify Auto-merge workflow fires correctly via the reusable workflow
• Open a follow-up Owner-tier PR, confirm downstream publish workflow triggers on merge

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

Validation error: String must contain at most 250 character(s) at "tone_instructions"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Summary by CodeRabbit

• Chores
  • Optimized internal automation configuration for improved efficiency in dependency updates and code review processes.

Walkthrough

Two GitHub Actions workflow adjustments: auto-merge jobs consolidated into a reusable workflow delegation, and PR history fetch depth increased for deeper clone.

Changes

Auto-merge Workflow Delegation

Layer / File(s)	Summary
Workflow Documentation .github/workflows/auto-merge.yml (header)	Workflow header updated to reference the reusable workflow (ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main) and required secrets (AUTOMERGE_APP_ID, AUTOMERGE_APP_PRIVATE_KEY).
Job Delegation .github/workflows/auto-merge.yml (jobs section)	Five inlined jobs (dependabot-auto-merge, renovate-auto-merge, ai-agent-auto-merge, coderabbit-auto-merge, owner-auto-merge) replaced with single auto-merge job that calls the reusable workflow via uses: and propagates secrets with secrets: inherit.

PR History Fetch Configuration

Layer / File(s)	Summary
Checkout Depth .github/workflows/claude-code-review.yml	actions/checkout fetch-depth parameter increased from 20 to 100 for deeper PR history cloning.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

area:infra

🚥 Pre-merge checks | ✅ 8

✅ Passed checks (8 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commits format with ci scope, is concise (62 chars), and accurately describes the main change: replacing local workflow with reusable one.
Description check	✅ Passed	Description clearly explains the change, motivation (GITHUB_TOKEN event loop bug), required setup (two secrets), and test plan; directly related to changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Otel Instrumentation Required	✅ Passed	PR modifies only GitHub Actions workflow files; no injectable service classes or DI registrations are added. Check passes under the "no new services added" criterion.
No Unbounded Mcp Responses	✅ Passed	No MCP tool changes detected. PR modifies only .github/workflows/ files (auto-merge.yml and claude-code-review.yml). src/qyl.mcp/ directory does not exist and no MCP-related files were touched.
Duckdb Backpressure On Write Paths	✅ Passed	No new DuckDB write paths added. PR modifies only GitHub Actions workflow files (.github/workflows/auto-merge.yml and claude-code-review.yml); no application code changes present.
Cancellationtoken Threading	✅ Passed	No C# files modified. Only GitHub Actions workflows changed. No public async methods in C# were added, so check is not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

@coderabbitai autofix

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 435243aee0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin reusable workflow to an immutable ref

Use an immutable commit SHA instead of @main for the called workflow. Referencing a moving branch means auto-merge behavior can change without any change in this repository, and because this job runs with contents: write/pull-requests: write on PR events, an unintended or compromised upstream change can immediately affect merge decisions here. GitHub's workflow syntax guidance explicitly calls SHA refs the safest option for stability and security.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pass only required secrets to reusable workflow

Replace secrets: inherit with an explicit secret map for just the two app secrets this workflow needs. inherit forwards all repository/organization/environment secrets accessible to this workflow, which unnecessarily broadens secret exposure to the called workflow and increases blast radius if that workflow is modified or compromised.

Useful? React with 👍 / 👎.