From a51ac8b653eb4106d702cf70abc0433d8d166f34 Mon Sep 17 00:00:00 2001
From: Pete Crocker <pete@petecrocker.com>
Date: Tue, 28 Jul 2026 12:47:56 +0100
Subject: [PATCH 1/2] ci: auto-merge compatibility matrix PRs once CI is green

The compatibility matrix PR is generated by the Infrahub release pipeline
and contains nothing but regenerated docs, so it should not need a human
to click merge.

Add a `ci-gate` rollup job that reports a single pass/fail for the whole
CI workflow. Several CI jobs are conditional and `unit-tests` fans out
over a moving Python matrix, so requiring individual checks in branch
protection would be brittle; one rollup check is stable.

Add a workflow that enables auto-merge on the bot's PR. It authenticates
as opsmill-bot because auto-merge merges as whoever enabled it, and that
is the identity allowed to bypass the approval requirement on stable.

Waiting for CI is enforced by making `ci-gate` a required status check on
stable, which is a repository setting applied separately.
---
 .../auto-merge-compatibility-docs.yml         | 33 +++++++++++++++++++
 .github/workflows/ci.yml                      | 28 ++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 .github/workflows/auto-merge-compatibility-docs.yml

diff --git a/.github/workflows/auto-merge-compatibility-docs.yml b/.github/workflows/auto-merge-compatibility-docs.yml
new file mode 100644
index 00000000..fa332d6c
--- /dev/null
+++ b/.github/workflows/auto-merge-compatibility-docs.yml
@@ -0,0 +1,33 @@
+---
+# yamllint disable rule:truthy rule:line-length
+name: "Auto-merge compatibility matrix updates"
+
+# The compatibility matrix PR is generated by the Infrahub release pipeline and
+# contains nothing but regenerated docs, so it merges itself once CI is green.
+# Waiting for CI is enforced by the `ci-gate` required status check on `stable`,
+# not by this workflow.
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+jobs:
+  enable-auto-merge:
+    if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.head.ref == 'automated/update-compatibility-docs' &&
+      github.event.pull_request.base.ref == 'stable' &&
+      github.event.pull_request.user.login == 'opsmill-bot' &&
+      github.event.pull_request.draft == false
+    runs-on: "ubuntu-latest"
+    timeout-minutes: 5
+    steps:
+      - name: "Enable auto-merge"
+        # Authenticate as opsmill-bot: it is the identity allowed to bypass the
+        # approval requirement on `stable`, and auto-merge merges as whoever enabled it.
+        env:
+          GH_TOKEN: ${{ secrets.GH_UPDATE_PACKAGE_OTTO }}
+        run: gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 57555d57..c8073f6d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -422,3 +422,31 @@ jobs:
   #         codecov --flags integration-tests
   #       env:
   #         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  # ------------------------------------------ Gate  ------------------------------------------
+  # Single rollup check, so branch protection can require CI without naming every
+  # job (several are conditional, and unit-tests fans out over a moving matrix).
+  ci-gate:
+    name: ci-gate
+    if: always()
+    needs:
+      - prepare-environment
+      - files-changed
+      - yaml-lint
+      - python-lint
+      - markdown-lint
+      - action-lint
+      - uv-lock-check
+      - documentation
+      - validate-generated-documentation
+      - validate-documentation-style
+      - unit-tests
+      - integration-tests-latest-infrahub
+    runs-on: "ubuntu-latest"
+    timeout-minutes: 5
+    steps:
+      - name: "Fail if any job did not succeed or skip"
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "One or more CI jobs failed or were cancelled."
+          exit 1

From 69c8a313dc984009259d8931d947339b5886a7c7 Mon Sep 17 00:00:00 2001
From: Pete Crocker <pete@petecrocker.com>
Date: Wed, 29 Jul 2026 12:36:53 +0100
Subject: [PATCH 2/2] ci: enable auto-merge on draft-to-ready transition

`types:` is an allowlist, so a draft-to-ready transition emitted only
`ready_for_review` and nothing re-evaluated the job. The `draft == false`
guard never got a second chance, and the bot pushes its branch once per
release, so there was no guaranteed `synchronize` to recover.

The guard itself stays: GitHub refuses to enable auto-merge on a draft,
so the step would fail rather than skip without it.
---
 .github/workflows/auto-merge-compatibility-docs.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/auto-merge-compatibility-docs.yml b/.github/workflows/auto-merge-compatibility-docs.yml
index fa332d6c..cd92c5d8 100644
--- a/.github/workflows/auto-merge-compatibility-docs.yml
+++ b/.github/workflows/auto-merge-compatibility-docs.yml
@@ -13,6 +13,8 @@ on:
       - opened
       - reopened
       - synchronize
+      # Auto-merge cannot be enabled on a draft, so re-evaluate on the transition out of one.
+      - ready_for_review
 
 jobs:
   enable-auto-merge: