ci: stabilize bot automerge workflow

[ANcpLua]

Summary\n- pin the stable bot automerge workflow branch changes\n- prevent local npm package-lock churn where npm is only incidental tooling\n\n## Validation\n- git diff --check

Summary by CodeRabbit

• Chores
  • Updated auto-merge workflow to use the latest version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9c79b703-446c-4b47-af74-04f1d6d020c4

📥 Commits

Reviewing files that changed from the base of the PR and between f1389b0 and dacf0c7.

⛔ Files ignored due to path filters (2)

• .gitignore is excluded by none and included by none
• .npmrc is excluded by none and included by none

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout of 180000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: Agent
• GitHub Check: build (windows-latest)
• GitHub Check: build (ubuntu-latest)

🧰 Additional context used

📓 Path-based instructions (1)

.github/workflows/**

⚙️ CodeRabbit configuration file

.github/workflows/**: Pin third-party actions to SHA. First-party (actions/*) tag-pin OK.
Concurrency groups required on push-triggered workflows.
Secrets via env: not inline. No secrets in logs.
Auto-bump pattern: pushes to main can trigger publish via
compute_version — flag changes that affect that path.

Files:

• .github/workflows/auto-merge.yml

🔇 Additional comments (2)

.github/workflows/auto-merge.yml (2)

22-22: SHA pin update follows security best practices.

The commit-SHA pin ensures reproducible workflow execution and prevents unexpected behavior from upstream changes. Good defensive practice for workflow stability.

As per coding guidelines: "Pin third-party actions to SHA."

---

22-22: SHA pin is valid and properly references the stable bot dependency version. Commit references PR #12 as indicated in the code comment.

---

📝 Walkthrough

Walkthrough

The auto-merge GitHub Actions workflow updates its reusable workflow reference to a newer pinned commit SHA. The workflow calls an external reusable workflow from a pinned commit; this change advances that pinned reference to a later revision. Job configuration, permissions, trigger events, and secret inheritance remain intact. This is a straightforward dependency pin update with no structural changes to the workflow itself.

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Title follows conventional commit format (ci:), is under 72 characters (36 chars), lacks trailing period, and accurately describes the workflow pin update.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Datetime.Now/Utcnow	✅ Passed	No C# files modified in this PR—only a YAML workflow configuration file (.github/workflows/auto-merge.yml). Check is not applicable.
No .Result/.Wait() Blocking Async	✅ Passed	PR modifies only .github/workflows/auto-merge.yml (YAML workflow configuration). Check scans for blocking async in C# files. No C# files added/modified—check not applicable.
No Isourcegenerator	✅ Passed	No : ISourceGenerator patterns found in added/modified C# files. All generator implementations correctly use IIncrementalGenerator (AotReflectionGenerator, ExtensibleEnumMirrorGenerator).
No Null-Forgiving Operator Without Justification	✅ Passed	No C# files added or modified in this PR. Only .gitignore and .npmrc were changed. The null-forgiving operator check applies only to C# files, so it trivially passes.
Sources Public Types Must Be Internal	✅ Passed	PR only modifies GitHub Actions workflow file (.github/workflows/auto-merge.yml). No C# files in src/ANcpLua.Roslyn.Utilities.Sources/ were added or modified, so the check is not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.