ci: only auto-merge self-authored PRs, drop custom review check

[getappz]

Summary

Simplification after discussion — replaces the closed #241 (a custom required-status-check that re-implemented author-conditional review) with the standard practice popular solo/small-team repos actually use:

• auto-merge.yml now only auto-enables merge for TRUSTED_PR_AUTHORS (default: just getappz), on top of the existing fork exclusion
• Devin (or any future external contributor) opening a PR directly into this repo just doesn't get auto-merge enabled — the PR sits mergeable-when-ready, reviewed and merged by hand
• No new enforcement logic, no required check that a PR could self-modify to bypass (the exploit gap ci: require an approving review for non-self-authored PRs #241 had under pull_request triggers), no branch-protection review-count deadlock

Test plan

• Same if: condition shape as the fork-exclusion already proven working in production (ci: auto-enable merge-when-ready on every PR open #240)

Summary by CodeRabbit

• Chores
  • Updated automatic pull request merging to allow only authors on a configurable trusted-author list.
  • Preserved existing safeguards requiring auto-merge to be enabled, the pull request to be non-draft, and the source repository to match the destination repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

The auto-merge workflow now requires pull request authors to match the configurable TRUSTED_PR_AUTHORS allowlist, defaulting to getappz, in addition to existing auto-merge, draft, and same-repository checks.

Changes

Auto-merge gating

Layer / File(s)	Summary
Trusted-author condition .github/workflows/auto-merge.yml	The job condition checks the pull request author against the comma-delimited TRUSTED_PR_AUTHORS variable and updates comments describing trusted-author and fork exclusions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• getappz/agentflare#240: Modifies the same auto-merge workflow gating condition.
• getappz/agentflare#241: Uses the same TRUSTED_PR_AUTHORS allowlist in related review enforcement logic.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	Issue #241 required a review-enforcement workflow for non-trusted authors; this PR only changes auto-merge gating and does not add that check.	Add the required-status-check workflow that verifies an approving review for non-trusted authors, or revise the linked issue if the approach changed.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: restricting auto-merge to trusted/self-authored PRs and removing the custom review check.
Description check	✅ Passed	The PR description covers the summary and test plan from the template, though the reviewer notes section is omitted.
Out of Scope Changes check	✅ Passed	The changes stay within the CI auto-merge workflow and don't introduce unrelated code or broader workflow edits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/auto-merge-self-only

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/auto-merge.yml (1)

30-34: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

TRUSTED_PR_AUTHORS parsing is whitespace-sensitive.

The comma-wrapping technique format(',{0},', ...) correctly prevents substring false positives (e.g., getappz matching getappz2), but it does not tolerate spaces after commas. If someone sets TRUSTED_PR_AUTHORS to "getappz, some-other-login", the lookup string becomes ",getappz, some-other-login," and the search for ",some-other-login," will fail, silently excluding that author from auto-merge.

The inline example on line 29 uses no spaces, which is correct, but a user following common comma-separator conventions might add spaces. Consider adding a brief note in the comment (e.g., "no spaces after commas") or stripping spaces in the expression.

💡 Optional: document the no-spaces requirement in the comment

-    #   gh variable set TRUSTED_PR_AUTHORS --body "getappz,some-other-login"
+    #   gh variable set TRUSTED_PR_AUTHORS --body "getappz,some-other-login"
+    #   (no spaces after commas — the match is comma-delimited and exact)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-merge.yml around lines 30 - 34, Update the
TRUSTED_PR_AUTHORS handling in the auto-merge condition to tolerate whitespace
after comma separators, while preserving exact author matching and preventing
substring matches. Alternatively, document the required no-spaces format in the
nearby workflow comment and example if parsing remains unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/auto-merge.yml:
- Around line 30-34: Update the TRUSTED_PR_AUTHORS handling in the auto-merge
condition to tolerate whitespace after comma separators, while preserving exact
author matching and preventing substring matches. Alternatively, document the
required no-spaces format in the nearby workflow comment and example if parsing
remains unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4e6b70f4-acd6-4a37-9cc8-f1445fa94b32

📥 Commits

Reviewing files that changed from the base of the PR and between 6e15f48 and 84e38dd.

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yml