fix(ci): respect repository auto-merge policy

[MisterWanted]

Summary

Respect the repository's existing auto-merge policy before attempting Dependabot auto-merge. The repository currently reports allow_auto_merge=false; runs on #84/#85 failed by unconditionally requesting a prohibited mutation.

• Disabled: emit an explicit policy notice and do not call the mutation.
• Enabled: retain the existing squash auto-merge behavior.
• Missing/malformed setting, API failure or mutation failure: propagate the error.
• No repository setting, credential or permission changes. The existing separate review step is unchanged; its approval is not independent merge authorization.

Verification

• uv run ruff check .: passed.
• uv run mypy: passed, 114 source files.
• uv run pytest --no-cov tests/test_automerge_repository_policy.py tests/test_ci_workflow_changes.py: 27 passed.
• Eleven new cases execute the actual workflow JavaScript against mocked APIs.
• Separate source review of 6a8c38d0c7973264c4a9f1f36f294b48e9e7b599: no actionable findings.

No live mutation used during validation. Full application suite was not rerun for this workflow-only change. Exact-head CI and valid independent approval remain required before landing.

CI handoff

Run 34084682491 was deliberately cancelled: its full suite executes migration tests, which require an explicit exception to the operator's standing SQL restriction. This is not a failing policy-guard test. Targeted SQL-free verification above passed. Do not weaken or bypass the full CI gate; resume it only with the missing test-only authorization.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: aef82f41-c904-4a5f-a3b0-c7c2341eb11b

📥 Commits

Reviewing files that changed from the base of the PR and between 771985b and 6a8c38d.

📒 Files selected for processing (3)

• .github/workflows/automerge.yml
• .reviews/sessions/2026-09-07-dependabot-automerge-policy.md
• tests/test_automerge_repository_policy.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dependabot auto-merge workflow now validates the repository allow_auto_merge policy before running its GraphQL mutation. New end-to-end tests cover policy, error, and no-op paths. A review-session record documents the repair and verification.

Changes

Dependabot auto-merge policy

Layer / File(s)	Summary
Policy gate and end-to-end validation .github/workflows/automerge.yml, tests/test_automerge_repository_policy.py, .reviews/sessions/...	The workflow reads allow_auto_merge, skips with a notice when it is false, and fails when metadata is invalid or unavailable. Enabled repositories retain the SQUASH mutation. Tests execute the real workflow script with mocked APIs and cover error and no-op paths. The review record documents verification and handoff status.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 6a8c3

Dependabot auto-merge now respects disabled repository policy, retains squash auto-merge when enabled, and fails safely when policy metadata is unavailable or invalid. No current merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant RepositoryAPI
  participant GraphQLAPI
  GitHubActions->>RepositoryAPI: Read allow_auto_merge
  alt Policy is disabled
    GitHubActions->>GitHubActions: Log notice and stop
  else Policy is enabled
    GitHubActions->>GraphQLAPI: Enable SQUASH auto-merge
  else Metadata is invalid or unavailable
    GitHubActions->>GitHubActions: Fail the step
  end

Loading

Suggested reviewers: onlinechef

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 1 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating CI to respect the repository auto-merge policy.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 1 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-automerge-policy-20260907

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}