fix: add repository block to settings.yml for allow_auto_merge

[don-petry]

Summary

• Adds repository block to .github/settings.yml with allow_auto_merge: true so the setting is declaratively managed via probot/settings
• Also adds delete_branch_on_merge: true and has_wiki: false to match the full standard defaults
• Re-applied the setting via GitHub API for immediate effect

Root Cause

The compliance audit has been finding allow_auto_merge: null periodically. While the API-level setting gets patched to true, without it being declared in .github/settings.yml, probot/settings can reset it on subsequent runs. This PR makes the setting authoritative and prevents future drift.

Note: PR #185 contains the identical fix but has not been merged. This supersedes it.

Closes #163

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 51 minutes and 24 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 34f7011d-ef32-4029-96c1-fcc2ec6aca13

📥 Commits

Reviewing files that changed from the base of the PR and between 1f31eeb and cc2bf7f.

📒 Files selected for processing (1)

• .github/settings.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-163-20260419-2233

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review complete - change adds the repository block to .github/settings.yml with allow_auto_merge: true, delete_branch_on_merge: true, and has_wiki: false. Format is correct for probot/settings. CI is passing. Note: PR 185 contains the identical fix but has been waiting for merge since 2026-04-14, this PR supersedes it. @don-petry as CODEOWNER, please review and merge to resolve the recurring compliance audit finding.

[Copilot]

Pull request overview

This PR makes allow_auto_merge (and related standard repository settings) declaratively managed via probot/settings by adding a repository block to .github/settings.yml, preventing the setting from drifting back to null on subsequent runs.

Changes:

• Added a repository section to .github/settings.yml with allow_auto_merge: true
• Also set delete_branch_on_merge: true and has_wiki: false to match the referenced standard defaults

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 37fe951741882577f9d0ef4a6f3acc960f2363c8
Review mode: triage-approved (single reviewer)

Summary

Confirms the triage assessment. This is a 7-line additive change to .github/settings.yml that introduces a repository block declaring three standard defaults (allow_auto_merge: true, delete_branch_on_merge: true, has_wiki: false) so probot/settings manages them declaratively. The change is config-only, non-functional with respect to runtime code, and aligns with the org-wide standard referenced in the comment block.

Linked issue analysis

Closes #163 — the weekly compliance audit was repeatedly flagging allow_auto_merge: null because the API-level patch wasn't sticking across probot/settings runs. Adding allow_auto_merge: true to the source-of-truth settings file makes the setting authoritative and prevents future drift, which is exactly what the issue calls for. The two additional keys (delete_branch_on_merge, has_wiki) bring the file in line with the linked standard defaults document.

Findings

No blocking issues.

Observations (non-blocking):

• The PR description notes that #185 contains an identical fix; this PR supersedes it. Closing/abandoning #185 after merge would be a tidy follow-up but isn't required.
• YAML structure matches the probot/settings schema (repository: top-level key with snake_case GitHub API field names).
• No security-sensitive surface: no secrets, no workflow changes, no permissions changes.

CI status

All required checks green: CodeQL (actions, javascript-typescript, python) SUCCESS, CodeRabbit SUCCESS, SonarQube Cloud quality gate passed (0 new issues, 0 hotspots).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[don-petry]

@dev-lead - please fix this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud