ci(actions): make mergeraptor auto-merge actually fire on main

[castrojo]

What does this change?

The mergeraptor review-bypass allowance is already live on main's branch protection, but nothing could ever use it. This repo had no workflow_run caller for reusable-renovate-automerge.yml, so qualifying Renovate/MergeRaptor PRs sat green and unmerged, waiting for a human approval. Tasks 2–4 of docs/superpowers/plans/2026-08-04-renovate-automerge-review-exception.md were never implemented.

Add the caller (.github/workflows/renovate-automerge.yml), triggered by every CI workflow in this repo, passing base_branch: main, require_auto_merge: true, and the MergeRaptor app credentials.

Harden the reusable workflow:

• Mint a MergeRaptor installation token. The bypass allowance applies only to that app identity, so github-actions[bot] could never have merged. Credential presence is mirrored into job-level env because the secrets context is unavailable in step-level if:.
• Fix the author matcher. GraphQL reports a GitHub App author as the bare slug mergeraptor; REST/gh pr list reports app/mergeraptor; a legacy bot user reports renovate[bot]. The previous filter matched none of these reliably. Now normalised.
• Gate merges on a genuinely complete rollup. An absent check is not a passing check: gh pr checks reports only check-runs that already exist, so a queued workflow is missing from the rollup rather than PENDING, and a re-run removes its check-runs while they re-queue. Observed live on chore(deps): update taiki-e/install-action digest to 05a4690 #394, where 3 of 7 checks were absent and a naive gate would have merged with them never having run. Since this workflow is triggered by one CI workflow completing while siblings may still be queued, that race is the normal case. Now cross-checks in-flight runs via gh run list --commit. An empty rollup or unreadable run list also keeps waiting rather than failing terminally.
• Gate merges on a complete check rollup. SKIPPED/NEUTRAL are non-blocking per GitHub's own merge semantics. PENDING is waited out (bounded by the new check_timeout_seconds input) rather than skipped — a consumer triggering from a single CI workflow would otherwise stall permanently when sibling checks finish later. Anything else blocks.
• Respect a merge queue. main is governed by a merge queue, which rejects any explicit strategy flag (gh pr merge --squash → "merge strategy for main is set by the merge queue"). The original hardcoded --squash would therefore have failed every merge on main. Added a merge_method input (default squash, or queue) plus automatic retry without the flag when that error is detected. Found while a review subagent was merging the open dependency PRs.
• Never infer the merge outcome from stderr or exit code. A plain gh pr merge enqueues while printing nothing and exiting 0 — so the merge_method: queue path, the one actually used on a queued branch, reported every enqueue as "Merged". gh also writes its success line (including the PR title) to stderr, so a PR titled "…merge queue…" could be misread. Now queries the real PR state.
• Skip drafts and conflicting PRs, and let a failed gh pr merge surface as a job failure instead of a swallowed warning.

renovate.json stays the single source of truth for what may merge unattended: require_auto_merge: true means only PRs Renovate marked auto-mergeable qualify. Major bumps still need a human.

Consumer validation

Consumer PR: projectbluefin/bluefin#976
Consumer CI run: https://github.com/projectbluefin/bluefin/actions/runs/31131080663
Out-of-org consumer impact: N/A — ublue-os/aurora and ublue-os/bazzite do not call reusable-renovate-automerge.yml. In-org consumers (bluefin, bluefin-lts, dakota) all pass only head_sha; both new inputs (require_auto_merge, check_timeout_seconds) default to the previous behaviour, so the change is additive. No input was removed or renamed.

• Opened a draft consumer PR pinned to this branch SHA
• Linked a passing consumer CI run that exercised this change
• Evaluated out-of-org consumers (ublue-os/aurora, ublue-os/bazzite) and documented the impact above

Verification

• actionlint clean on both workflows (exit 0).
• Author matcher validated against live GraphQL data for the open PRs on main — correctly selects only the MergeRaptor PRs with autoMergeRequest set.
• Merge-strategy fallback exercised against five scenarios (plain squash, queue-rejects-flag, merge_method: queue, genuine merge failure, invalid input) — only the genuine failure exits non-zero.
• Check-rollup gate exercised against all five state combinations (all-green, one failure, empty rollup, pending, all-skipped) and against live gh pr checks output for real PRs on this repo.

Skill update

docs/skills/factory-operations.md §4 rewritten: it documented a packageRules block that does not exist in renovate.json. Now describes the actual policy, the three merge gates, the bypass verification command, a troubleshooting table, and the three gotchas found here (REST-vs-GraphQL bot login, --auto not honouring bypass_pull_request_allowances, secrets unavailable in step-level if:).

Checklist

• I am using an agent and I take responsibility for this PR (if AI-assisted)
• Conventional commit message (feat:, fix:, chore:, etc.)
• No hardcoded secrets or credentials

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None