ci: auto-enable merge-when-ready on every PR open

.github/workflows/auto-merge.yml

@@ -0,0 +1,47 @@
+name: auto-merge
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+
+jobs:
+  enable-auto-merge:
+    name: Enable auto-merge
+    # Toggle repo-wide without touching this file:
+    #   gh variable set AUTO_MERGE_ENABLED --body false   (disable)
+    #   gh variable set AUTO_MERGE_ENABLED --body true    (re-enable, or just delete the variable — unset defaults to enabled)
+    #
+    # head.repo.full_name == repository excludes forks explicitly — CI
+    # passing is not the same as a human having reviewed what an external
+    # PR's code actually does, so third-party contributions never get
+    # auto-merge auto-enabled here regardless of check status. (GitHub also
+    # blocks secrets from fork-triggered pull_request runs by default, so
+    # AUTOMERGE_TOKEN wouldn't be reachable from a fork either way — this
+    # check makes that explicit instead of relying on it silently.)
+    if: >-
+      vars.AUTO_MERGE_ENABLED != 'false' &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      # Doesn't merge anything itself — just flips the PR into GitHub's
+      # native auto-merge state. Branch protection's required status checks
+      # (build/clippy/fmt/etc., all "strict") still gate the actual merge,
+      # and GitHub re-syncs a BEHIND branch on its own before merging, so
+      # this replaces the manual "remember to pass --auto" step entirely.
+      #
+      # Needs a real PAT, not the default token: GitHub's Actions-issued
+      # GITHUB_TOKEN is rejected by the enablePullRequestAutoMerge mutation
+      # ("Resource not accessible by integration") regardless of declared
+      # permissions — confirmed 2026-07-18. Create a fine-grained PAT scoped
+      # to this repo with Pull requests: read/write, then:
+      #   gh secret set AUTOMERGE_TOKEN --body <token>
+      - name: gh pr merge --auto
+        env:
+          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
+        run: gh pr merge --auto --squash --delete-branch "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}"