chore(ci): handle disabled auto-merge gracefully

Author: eschaar

.github/workflows/README.md

@@ -25,3 +25,4 @@ For the full CI/CD design and release model, see `docs/design/cicd.md`.
 4. `release.yml` is the only release orchestrator.
 5. `publish.yml` is publish-only and never computes versions.
 6. Ruleset on `main` should require `Commit`, `Check`, `Verify` (all jobs), and `Security` before merge.
+7. `automerge.yml` only auto-enables Dependabot squash merge when repository auto-merge is enabled; otherwise it emits a warning and leaves the PR for manual merge.

.github/workflows/automerge.yml

@@ -116,6 +116,19 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             try {
+              const repository = await github.rest.repos.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo
+              })
+
+              if (!repository.data.allow_auto_merge) {
+                core.warning(
+                  "Skipping auto-merge: repository auto-merge is disabled. " +
+                  "Enable repository auto-merge in Settings > General to restore this step."
+                )
+                return
+              }
+
               await github.graphql(
                 `mutation($pullRequestId: ID!) {
                   enablePullRequestAutoMerge(input: {pullRequestId: $pullRequestId, mergeMethod: SQUASH}) {
@@ -125,9 +138,18 @@ jobs:
                 { pullRequestId: context.payload.pull_request.node_id }
               )
             } catch (error) {
+              const msg = String(error.message || "")
+              if (msg.includes("Auto merge is not allowed for this repository")) {
+                core.warning(
+                  "Skipping auto-merge: repository auto-merge is disabled. " +
+                  "Enable repository auto-merge in Settings > General to restore this step."
+                )
+                return
+              }
+
               core.setFailed(
                 "Could not enable auto-merge. Ensure repository auto-merge is enabled and branch protections are satisfied.\n" +
-                error.message
+                msg
               )
             }
 

docs/design/cicd.md

@@ -162,7 +162,7 @@ sequenceDiagram
 1. `[4e]` `verify.yml / Artifact Install Verify`.
 1. `[4f]` `security.yml / Dependency and Secret Scan`.
 1. `[5]` `automerge.yml` job runs only when `github.actor == 'dependabot[bot]'`.
-1. `[6a]/[7a]` Eligible (pip patch or GHA patch/minor): auto-merge enabled with SQUASH method.
+1. `[6a]/[7a]` Eligible (pip patch or GHA patch/minor): auto-merge is enabled with SQUASH when repository auto-merge is enabled; otherwise the workflow logs a warning and leaves the PR on the manual merge path.
 1. `[6b]/[7b]` Not eligible: manual merge path stays active.
 1. `[8]` Merge requested against Ruleset.
 1. `[9a]/[10a]` Required checks green → merge to `main`.
@@ -213,7 +213,7 @@ Configure via **Settings → Actions → General**.
 
 Configure via **Settings → General**.
 
-- Enabled at repository level (required for Dependabot auto-merge path).
+- Enabled at repository level to activate the automatic merge path. If disabled, the workflow skips the enable step and warns instead of failing.
 
 ### PyPI environment