feat: auto-merge PRs when CI passes and maintainer approves

[qinqon]

Summary

Add an opt-in auto-merge feature that merges PRs when all conditions are met: CI passing, no conflicts, maintainer approval, and no unresolved review threads. This automates the final "click merge" step while keeping a human in the loop for approval.

Note: This changes the current safety guarantee: "Claude never merges; a human must approve and merge every PR." Auto-merge is strictly opt-in and disabled by default.

Proposed flags

Flag	Env var	Default	Description
--auto-merge	OOMPA_AUTO_MERGE	false	Enable auto-merge (disabled by default)
--auto-merge-approvers	OOMPA_AUTO_MERGE_APPROVERS	—	Comma-separated list of users whose APPROVED review triggers merge (required when auto-merge is enabled)
--auto-merge-label	OOMPA_AUTO_MERGE_LABEL	—	Only merge PRs with this label (optional extra gate)
--auto-merge-strategy	OOMPA_AUTO_MERGE_STRATEGY	squash	Merge strategy: squash, merge, or rebase
--auto-merge-cooldown	OOMPA_AUTO_MERGE_COOLDOWN	5m	Wait after last push before merging (ensures CI has time to complete)

Merge criteria

ALL conditions must be true for auto-merge to trigger:

1. --auto-merge flag is enabled
2. All required CI checks are passing
3. Mergeable state is clean (no conflicts)
4. At least one APPROVED review from a user in --auto-merge-approvers
5. No unresolved review threads
6. Cooldown period has elapsed since the last push
7. PR has the --auto-merge-label label (if configured)

Usage examples

# Auto-merge when maintainer approves and CI is green
oompa --repo myorg/myrepo \
  --auto-merge \
  --auto-merge-approvers=maintainer1,maintainer2 \
  --auto-merge-cooldown=5m

# With label gate — only merge PRs explicitly tagged for auto-merge
oompa --repo myorg/myrepo \
  --auto-merge \
  --auto-merge-approvers=maintainer1 \
  --auto-merge-label=auto-merge-ok

# Systemd unit example
ExecStart=... --auto-merge --auto-merge-approvers=qinqon --auto-merge-strategy=squash --auto-merge-cooldown=5m

Design considerations

Safety guardrails

• Disabled by default — must explicitly opt in with --auto-merge
• Requires human approval — --auto-merge-approvers is required, empty list is an error
• Cooldown period — prevents merging before CI finishes on a just-pushed commit
• Label gate (optional) — extra human control point, maintainer must apply the label
• Never force-merges — if merge fails (branch protection, required reviews), log and skip

Implementation

• Add a ProcessAutoMerge step to the poll loop, running after all other reactions
• Check merge conditions via GitHub API: GetPRReviews, GetCheckRuns, GetPRMergeable
• Use gh api repos/:owner/:repo/pulls/:number/merge to merge
• Log every merge decision (why it merged or why it skipped)

Open questions (to be decided before implementation)

• Should auto-merge work for watched PRs (--watch-prs) only, issue-resolver PRs only, or both?
• Should there be a maximum number of auto-merges per poll cycle?
• Should oompa delete the branch after merge?
• Should oompa post a comment before merging ("Auto-merging: all checks passed, approved by @maintainer")?
• How to handle repos with branch protection rules that require specific review counts?