fix(ci): enable auto-merge directly from release outputs

[skevetter]

Release Please can create a release PR before GitHub's PR search returns it, leaving automatic merging disabled. Use the action's returned PR number directly, validate that exactly one release PR was returned, and refresh the merge guard after updating its base. Squash merges keep the generated Conventional Commit title and an explicitly empty body.

The lint job checks every generated release head for version/changelog-only changes, and a CI Success check collects all validation jobs so automatic merging can wait for the complete CI result. Branch protection requires both Lint and CI Success, preserving the existing signed-commit and linear-history requirements.

AGENTS.md now records that generated version/changelog-only release PRs merge after applicable CI without Greptile or CodeRabbit review gates. Code and workflow changes retain their review requirements.

Validation: all pre-commit hooks, actionlint, and 17 functional workflow cases passed: eight auto-merge cases (including current/behind branches, invalid output and exact subject/body/head), five release-file guard cases (including unexpected and newline-containing paths), and four CI aggregate outcomes.

Summary by CodeRabbit

• Chores
  • Release pull requests are checked to ensure they contain only version and changelog updates, and must pass all required validation jobs before merging.
  • Automatic merging now applies only when a release pull request is created. If its branch is behind the main branch, it is updated and the latest revision is verified before merging.
• Documentation
  • Guidance now clarifies review expectations for generated release pull requests and distinguishes them from code changes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 47ca5dd5-57f9-4698-a7fd-a98cf6155d55

📥 Commits

Reviewing files that changed from the base of the PR and between 640e32f and c897bef.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• AGENTS.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 552a6c11-7455-443a-ad77-d60aa66a5212

📥 Commits

Reviewing files that changed from the base of the PR and between 640e32f and c897bef.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• AGENTS.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CI workflow validates release PR contents, requires successful validation jobs before release processing, and auto-merges a newly created release PR after validating its number and head SHA. Repository guidance now describes review expectations for these PRs.

Changes

Release PR flow

Layer / File(s)	Summary
Release PR content validation .github/workflows/ci.yml	The lint job requires release-please PRs to contain at least one changed file, limited to .release-please-manifest.json and CHANGELOG.md.
Aggregate CI gate .github/workflows/ci.yml	The new ci-success job succeeds only when every job in its needs results succeeds. The release-please job now depends on ci-success.
Guarded release PR auto-merge .github/workflows/ci.yml, AGENTS.md	Auto-merge runs only when release-please creates a PR. The script validates one positive-integer PR number, updates a branch behind main, refreshes its head SHA, and requires that SHA for the merge. AGENTS.md documents review expectations for release PRs.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to c897b

No actionable merge-blocking issue is established; the release automation is ready for normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to c897b

The workflow adds useful file-validation and current-head safeguards without expanding its configured credentials. However, the release review exemption depends on repository protections and branch-access controls that could not be verified, so the assessment remains qualified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The sensitive outcome is modification and merging of this repository's release PR. The workflow continues to mint an App token for the current repository and uses it for release processing and merge operations; neither the credential sources nor configured job permissions expand in this PR. Actual App installation permissions remain unverified.

Trust Boundaries and Controls

• observed — Privileged release processing runs only on pushes to main after CI Success. PR numbers are parsed as data, and the title is passed as a quoted argument with an explicitly empty squash body. The merge command supplies a head-match guard rather than an administrative bypass option.
• inferred — The file allowlist is a useful normal-path control, but it lives in the PR-modifiable workflow and is selected by branch name rather than an ownership check. Its effectiveness as an independent authorization boundary therefore depends on external workflow-write, branch-access, and merge protections. The available evidence does not establish those protections or a successful bypass.

Resilience and Maintainability Implications

• inferred — Malformed PR output, failed validation, or failure before the merge command does not provide an alternative merge path in this script. The head-match guard addresses concurrent changes when requesting the merge, but required-check enforcement and later changes while auto-merge is pending remain dependent on GitHub's deployed configuration.

Hardening Proposals

• proposed — Verify and record the deployed required checks, App bypass permissions, and release-branch writers. If the review exemption relies on the file allowlist as an authorization boundary, protect that enforcement independently from changes in the exempt PR.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main CI change: enabling auto-merge using Release Please outputs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[skevetter]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Adds auto-merge gate and release workflow changes to CI.

The PR appears safe to merge; no actionable issue was established.

What we checked:

• Release PRs changing code: On the configured release branch, Lint rejects every path except .release-please-manifest.json and CHANGELOG.md. It reads paths separated by null bytes, so filenames containing newlines cannot bypass the check.

Summary

The workflow uses the PR number returned by release-please instead of searching for it.

• It requires exactly one returned PR and rereads its head after a branch update.
• Squash merges preserve the generated title and use an empty body.
• Lint checks release files, and CI Success requires every validation job to pass.
• AGENTS.md exempts generated version/changelog-only release PRs from review gates.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Main push] --> B[Validation jobs]
  B --> C[CI Success]
  C --> D[Release Please]
  D --> E[Read returned PR number]
  E --> F[Update branch if behind]
  F --> G[Read current head]
  G --> H[Enable squash auto-merge]
  D --> I[Release PR CI]
  I --> J[Lint checks allowed files]
  I --> K[Other validation jobs]
  J --> L[CI Success]
  K --> L

Loading

_{Reviews (1) · Last reviewed commit: "fix(ci): enable auto-merge directly from..." · Reviewed by Greptile}

[skevetter]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 49 minutes.