feat(auto-merge): reusable workflow with App token

[ANcpLua]

Summary

Refactors the auto-merge workflow into a reusable workflow. Single source of truth for the framework's auto-merge tiers — fixes the GITHUB_TOKEN cascade-block bug that silently prevents downstream publish workflows from triggering after auto-merge.

Changes

• NEW `.github/workflows/auto-merge-reusable.yml` — `workflow_call` entrypoint with all 5 tiers (Dependabot, Renovate, AI Agent, CodeRabbit, Owner). Uses `actions/create-github-app-token@v2` to mint an installation token. Declares required secrets: `AUTOMERGE_APP_ID` and `AUTOMERGE_APP_PRIVATE_KEY`.
• MODIFIED `.github/workflows/auto-merge.yml` — now a thin caller (16 lines) that delegates to the reusable workflow via `secrets: inherit`. This repo eats its own dog food.
• MODIFIED `README.md` — documents the reusable workflow consumption pattern, required secrets, and one-time GitHub App setup.

The bug this fixes

When the Owner / AI Agent / CodeRabbit tier calls `gh pr merge --auto` under `GITHUB_TOKEN` identity, GitHub records the eventual native-auto-merge as performed by `github-actions[bot]`. Per GitHub docs, events triggered by `GITHUB_TOKEN` (other than `workflow_dispatch` / `repository_dispatch`) do NOT trigger new workflow runs — anti-loop protection. So the resulting `push: main` is silently dropped and the publish workflow never runs.

Symptom seen on 2026-05-04: ANcpLua.NET.Sdk PR #99 (chore/naming-runtime-aligned-2026) merged via Owner tier at 20:22:30 UTC. `push: main` for the merge commit `3894a06` produced ZERO workflow runs. SDK had to be manually dispatched via `gh workflow run` to ship v3.4.16.

Renovate / Dependabot tier merges aren't affected because those bots merge with their own bot tokens (visible in PR #100 `merged_by: renovate[bot]`), which DO trigger downstream workflows.

The fix: use a GitHub App installation token. The App becomes the merge actor; events fire normally.

Required follow-up

Each consumer repo (ANcpLua.NET.Sdk, .Roslyn.Utilities, .Analyzers, .Agents, qyl) needs a thin caller workflow + the two secrets. PRs for those will follow this one.

One-time GitHub App creation is the only manual step:

1. https://github.com/settings/apps/new — permissions: Contents (Write), Pull requests (Write).
2. Generate private key (.pem).
3. Install on all 6 repos.
4. Set `AUTOMERGE_APP_ID` + `AUTOMERGE_APP_PRIVATE_KEY` secrets (per repo or org-level).

Test plan

• `renovate-config-validator --strict --no-global default.json` still passes
• `assert-maf-config.mjs` still passes
• Validate workflow CI passes
• Once secrets exist, this repo's own Owner-tier auto-merge fires correctly via the reusable workflow

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 51798b36-2f55-4430-b16a-3ea85e984095

📥 Commits

Reviewing files that changed from the base of the PR and between 5bdeead and 6ed2d5b.

⛔ Files ignored due to path filters (1)

• README.md is excluded by none and included by none

📒 Files selected for processing (2)

• .github/workflows/auto-merge-reusable.yml
• .github/workflows/auto-merge.yml

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

---

Summary by CodeRabbit

• Chores
  • Introduced a new reusable GitHub Actions workflow template to standardize pull request automation logic and enable consistent handling across different scenarios.
  • Refactored the existing pull request automation workflow to leverage the new reusable template, reducing code duplication and improving code organization and overall maintainability for ongoing development and future enhancements.

Walkthrough

This PR extracts auto-merge logic into a reusable GitHub Actions workflow and refactors the main workflow to delegate to it. The reusable workflow defines five job types—Dependabot, Renovate, AI agents, CodeRabbit, and owner PRs—using a GitHub App token instead of GITHUB_TOKEN to bypass anti-loop filtering.

Changes

GitHub Actions Auto-Merge Refactoring

Layer / File(s)	Summary
Reusable Workflow Definition .github/workflows/auto-merge-reusable.yml	New reusable workflow with workflow_call trigger. Requires AUTOMERGE_APP_ID and AUTOMERGE_APP_PRIVATE_KEY secrets. Defines five conditional job variants: Dependabot (auto-approve/merge for patch/minor; comment Claude review request for semver-major), Renovate (auto-approve/merge), AI agents (copilot/jules/claude branches auto-approve with agent ID message then merge), CodeRabbit (auto-merge on approved review event), and owner (auto-merge non-draft PRs). All use gh pr merge --auto --squash.
Main Workflow Refactoring .github/workflows/auto-merge.yml	Removed all inline job definitions and replaced with single auto-merge job that calls the reusable workflow via uses: ./.github/workflows/auto-merge-reusable.yml with secrets: inherit.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested labels

area:infra

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}