ci(auto-merge): consume reusable workflow from renovate-config

[ANcpLua]

Summary

Replaces the local auto-merge workflow with a thin caller delegating to the new reusable workflow at ANcpLua/renovate-config (PR #5 there).

Why

When the Owner / AI Agent / CodeRabbit tier calls gh pr merge --auto under GITHUB_TOKEN identity, GitHub records the eventual native-auto-merge as performed by github-actions[bot]. Per GitHub docs, events triggered by GITHUB_TOKEN (other than workflow_dispatch / repository_dispatch) do NOT trigger new workflow runs — anti-loop protection. So the resulting push: main is silently dropped and downstream publish workflows never fire.

Symptom seen on 2026-05-04: ANcpLua.NET.Sdk PR #99 merged at 20:22:30 UTC. The push: main event for the merge commit produced ZERO workflow runs. SDK had to be manually dispatched via gh workflow run to ship v3.4.16.

The fix uses a GitHub App installation token. The App becomes the merge actor; events fire normally.

Required setup

This PR is draft until two repo secrets exist:

• AUTOMERGE_APP_ID — the numeric App ID
• AUTOMERGE_APP_PRIVATE_KEY — full PEM contents of the App's private key

Setup is a one-time 5-min manual step:

1. https://github.com/settings/apps/new — permissions: Contents (Write), Pull requests (Write)
2. Generate private key, download .pem
3. Install the App on this repo
4. Add the two secrets

Once the secrets are in place this PR can be marked ready and merged.

Test plan

• Once secrets exist, mark this PR ready
• Verify Auto-merge workflow fires correctly via the reusable workflow
• Open a follow-up Owner-tier PR, confirm downstream publish workflow triggers on merge

Summary by CodeRabbit

• Chores
  • Streamlined internal GitHub Actions workflow configuration for improved maintainability and centralized auto-merge handling.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

The auto-merge workflow has been refactored to centralize logic. Five actor-specific jobs handling Dependabot, Renovate, AI-agent bots, CodeRabbit, and owner PRs have been consolidated into a single job that calls a reusable workflow from an external repository. Event triggers and permissions remain unchanged. Secrets are inherited to support the delegated workflow execution. This reduces code duplication and maintains the same functional scope with a net reduction of 130 lines.

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Title follows conventional commit format (ci scope), is under 72 characters (62 chars), contains no trailing period, and accurately describes the main change: replacing the local auto-merge workflow with a reusable one.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Datetime.Now/Utcnow	✅ Passed	PR modifies only .github/workflows/auto-merge.yml (YAML workflow). Check requires C# files; no C# files were added/modified in this PR. Check not applicable.
No .Result/.Wait() Blocking Async	✅ Passed	No C# files were modified in this PR. Check scans for blocking async patterns in added/modified C# only. Not applicable.
No Isourcegenerator	✅ Passed	PR modifies only .github/workflows/auto-merge.yml (GitHub Actions YAML). No C# files added/modified. Check not applicable.
No Null-Forgiving Operator Without Justification	✅ Passed	No C# files modified. PR changes only .github/workflows/auto-merge.yml (GitHub Actions workflow YAML). Custom check (null-forgiving operator in C#) is not applicable.
Sources Public Types Must Be Internal	✅ Passed	PR contains no C# file modifications in src/ANcpLua.Roslyn.Utilities.Sources/. Only GitHub Actions workflow YAML and config files changed. Check is not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[github-actions]

@coderabbitai autofix

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa865d850c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin reusable workflow to immutable ref

Reference the reusable workflow by a commit SHA (or at least a version tag) instead of @main. With secrets: inherit and write permissions enabled, any future push to ANcpLua/renovate-config's main branch immediately changes privileged behavior in this repository without a local PR review, which can unexpectedly alter merge policy or expose inherited secrets like AUTOMERGE_APP_PRIVATE_KEY during pull_request_target runs.

Useful? React with 👍 / 👎.