ci(auto-merge): consume reusable workflow + keep Governance tier local

[ANcpLua]

Summary

Replaces the local auto-merge workflow with a thin caller delegating common tiers to ANcpLua/renovate-config (PR #5 there). Keeps the qyl-specific Governance bot tier local since it's not part of the framework-wide pattern.

Why

When the Owner / AI Agent / CodeRabbit tier calls gh pr merge --auto under GITHUB_TOKEN identity, GitHub records the eventual native-auto-merge as performed by github-actions[bot]. Per GitHub docs, events triggered by GITHUB_TOKEN (other than workflow_dispatch / repository_dispatch) do NOT trigger new workflow runs — anti-loop protection. So the resulting push: main is silently dropped and downstream publish workflows never fire.

The fix uses a GitHub App installation token. The App becomes the merge actor; events fire normally.

Required setup

This PR is draft until two repo secrets exist:

• AUTOMERGE_APP_ID — the numeric App ID
• AUTOMERGE_APP_PRIVATE_KEY — full PEM contents of the App's private key

Setup is a one-time 5-min manual step:

1. https://github.com/settings/apps/new — permissions: Contents (Write), Pull requests (Write)
2. Generate private key, download .pem
3. Install the App on this repo
4. Add the two secrets

Once the secrets are in place this PR can be marked ready and merged.

Test plan

• Once secrets exist, mark this PR ready
• Verify Auto-merge workflow fires correctly via the reusable workflow + local Governance tier
• Open a follow-up Owner-tier PR, confirm downstream workflow triggers on merge

[coderabbitai]

📝 Walkthrough

Walkthrough

The workflow consolidates auto-merge logic for Dependabot, Renovate, AI Agent, CodeRabbit, and Owner tiers into a single reusable workflow call, removing duplicated job definitions. The governance-auto-merge job now authenticates using a GitHub App token (created via actions/create-github-app-token) instead of the default GITHUB_TOKEN, applied to all subsequent gh command invocations. Additionally, SpectreConsoleVersion is updated from 0.55.0 to 0.55.2.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commits format (ci prefix with auto-merge scope), clearly summarizes the main change of delegating common tiers to a reusable workflow while keeping Governance tier local, and stays under 72 characters at 70 characters.
Description check	✅ Passed	Description is directly related to the changeset, explaining both the workflow refactoring and the GitHub App token mechanism needed to fix GITHUB_TOKEN cascade-blocking issues, with clear setup requirements and test plan.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[claude]

Claude finished @ANcpLua's task in 1m 57s —— View job

---

Code review

• Read changed workflow file
• Compare against origin/main
• Check repo invariants (CLAUDE.md / .coderabbit.yaml)
• Verify reusable workflow contract (ANcpLua/renovate-config)
• Post review

The motivation is correct — gh pr merge --auto running under GITHUB_TOKEN identity does silently break push: main triggers downstream, and a GitHub App installation token is the right fix. Deletion of the five tiers in favor of the reusable caller is also clean and the Governance tier correctly stays local since it gates on head.ref == 'chore/action-governance'.

Two structural concerns worth resolving before this leaves draft, both compounding each other:

---

1. Reusable workflow pinned to @main — .github/workflows/auto-merge.yml:27

uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main

The repo's .coderabbit.yaml has an explicit path_instruction for .github/**: "action version pinning (use SHA not tags)". The other action introduced in the same diff — actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v2.1.4 (line 38) — gets SHA-pinned. The reusable workflow should follow the same rule: pin to a commit SHA, optionally with a # vX.Y.Z trailing comment. Pinning to @main means a force-push or compromise upstream silently rewires every Dependabot / Renovate / AI agent / CodeRabbit / Owner auto-merge in this repo with no review signal.

---

2. secrets: inherit forwards every repo secret to an external workflow — auto-merge.yml:28

secrets: inherit

This is the more material risk. secrets: inherit hands the entire secret set (NPM tokens, Railway creds, NuGet API keys, dashboard deploy creds, etc.) to a workflow living in another repo. Combined with pull_request_target (which runs on every PR open) and the @main pin, any future change in ANcpLua/renovate-config could read those secrets on the next PR — without a single commit landing in this repo.

The reusable side only needs AUTOMERGE_APP_ID and AUTOMERGE_APP_PRIVATE_KEY per the PR description. Tighten to:

auto-merge:
  uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<sha>
  secrets:
    AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
    AUTOMERGE_APP_PRIVATE_KEY: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}

This requires the upstream workflow to declare matching on.workflow_call.secrets: inputs — likely a small follow-up to ANcpLua/renovate-config#5. Worth landing both together.

---

Why I'm flagging instead of fixing: (a) GitHub Apps don't grant me .github/workflows/ write — so even the mechanical @main → @<sha> swap needs a human commit; (b) the secrets: change is cross-repo and depends on the upstream PR's workflow_call shape, which I can't modify from here.

Everything else in the diff is fine. The Governance tier reads cleanly: App token is wired through all three steps consistently (lines 47, 60, 68), the set -euo pipefail + grep -qvE '^\.github/' gate is correct (the grep returning non-zero in the all-.github/ case is suppressed by being inside the if test), and dropping the per-tier docstring in favor of pointing at the upstream README is reasonable now that those tiers live elsewhere.
· branch

[github-actions]

@coderabbitai autofix

[claude]

Claude finished @ANcpLua's task in 1m 49s —— View job

---

Code review (re-review on synchronize)

• Read changed workflow file
• Compare against origin/main
• Check repo invariants (CLAUDE.md / .coderabbit.yaml)
• Verify if previously-flagged concerns still apply
• Post review

Synchronize delta: the only thing new since my 05:42Z review is Version.props:35 — Spectre.Console 0.55.0 → 0.55.2. Clean patch bump, no review concern.

auto-merge.yml is byte-identical to what I reviewed before, so both prior structural concerns still stand and remain blockers for marking this PR ready:

---

1. @main pin violates .coderabbit.yaml:139 — auto-merge.yml:27

uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main

The repo's CodeRabbit config explicitly requires "action version pinning (use SHA not tags)" for .github/**. The other action introduced in the same diff (actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v2.1.4, line 38) follows that rule; the reusable-workflow uses: should too. @main means an upstream force-push silently rewires every Dependabot / Renovate / AI agent / CodeRabbit / Owner auto-merge in this repo with no review signal.

2. secrets: inherit over-shares to a cross-repo workflow — auto-merge.yml:28

secrets: inherit

Hands the entire repo secret set (NPM tokens, Railway creds, NuGet API keys, dashboard deploy creds, etc.) to a workflow living in ANcpLua/renovate-config. Combined with pull_request_target (runs on every PR open) and the @main pin from #1, any future change in that external repo could read those secrets on the next PR — without a single commit landing here.

The reusable side only needs AUTOMERGE_APP_ID and AUTOMERGE_APP_PRIVATE_KEY. Tighten to:

auto-merge:
  uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<sha>  # vX.Y.Z
  secrets:
    AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
    AUTOMERGE_APP_PRIVATE_KEY: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}

Requires the upstream workflow to declare matching on.workflow_call.secrets: inputs — likely a small follow-up to ANcpLua/renovate-config#5. Worth landing both together.

---

Why I'm not committing the fix

GitHub App installation tokens used by this action don't grant .github/workflows/ write — pushes to that path return refusing to allow a GitHub App to create or update workflow .github/workflows/auto-merge.yml without workflows permission. Both fixes need a human commit (or a PAT with workflow scope on a different runner). I'd commit them in a heartbeat if the token allowed it.

The Governance tier itself reads cleanly — App token threaded consistently (lines 47, 60, 68), the set -euo pipefail + grep -qvE '^\.github/' gate is correct, and dropping the per-tier docstrings in favor of pointing at the upstream README is reasonable now that those tiers live elsewhere.
· branch

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[claude]

Claude finished @ANcpLua's task in 2m 4s —— View job

---

Claude finished re-reviewing on synchronize

---

Code review (re-review on synchronize)

• Read auto-merge.yml — byte-identical to the version reviewed at 09:03Z
• Inspect synchronize delta — only 521281a (AGENTS.md doc cleanup)
• Verify the new AGENTS.md call-sites actually exist
• Re-evaluate prior auto-merge.yml concerns

---

Synchronize delta — 521281a

Pure docs cleanup in AGENTS.md. Spot-checked all six new call-sites — every one resolves to live code:

Line in AGENTS.md	Verified at
QylLoomAgentsBuilder.cs:82-85 (Agent — standalone)	.AsAIAgent → .AsBuilder → .UseQylAgentTelemetry → .Build chain present ✓
HypothesisExecutor.cs:38-40 (Agent — non-streaming)	await agent.RunAsync<T>(prompt, ...) shape ✓
LoomAutofixRunner.cs:182-188 (Workflow — run / streaming)	InProcessExecution.RunStreamingAsync + WatchStreamAsync(ct) ✓
AutofixContextToolFactories.cs:9-15 (Tools — local)	Two-arg AIFunctionFactory.Create(method, options) with qyl.autofix.<verb> naming ✓
CollectorClient.cs:148-178 (HTTP error handling)	Exact IsSuccessStatusCode branching documented ✓

The HTTP-client section rewrite is a strict improvement — old text described a defensive-pattern that wasn't actually in the code; new text matches CollectorClient.cs and explicitly mentions the AOT-mandatory JsonTypeInfo overload, which is also baked into the repo's CLAUDE.md. Drop of the two ~/.claude/skills/microsoft-agent-framework{,-qyl}/SKILL.md references is correct — those files don't exist on the agent runner. report.md deletion is fine; it was a personal audit artefact that shouldn't have been in tree.

The Spectre.Console 0.55.0 → 0.55.2 bump on Version.props:35 is a clean patch bump — verified no breaking changes in the 0.55.x line.

---

auto-merge.yml — both prior concerns still stand

The file hasn't changed since 09:03Z, so my two structural blockers carry over verbatim:

1. @main pin on the reusable workflow (auto-merge.yml:27) violates .coderabbit.yaml's .github/** SHA-pinning rule — the sibling actions/create-github-app-token@67e27a7eb7db372a1c61a7f9bdab8699e9ee57f7 # v2.1.4 (line 38) already follows it.
2. secrets: inherit (auto-merge.yml:28) over-shares every repo secret to a cross-repo workflow. Combined with pull_request_target (runs on every PR open) and the @main pin, any future commit in ANcpLua/renovate-config could read NPM / Railway / NuGet / dashboard-deploy creds on the next PR — without a single commit landing here. Tighten to:

   auto-merge:
     uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<sha>  # vX.Y.Z
     secrets:
       AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
       AUTOMERGE_APP_PRIVATE_KEY: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}

Both fixes need a human commit — the GitHub App token used for autofixes lacks the workflows permission to write to .github/workflows/**, so I can't push them myself. The upstream secrets: change also depends on ANcpLua/renovate-config#5 declaring matching on.workflow_call.secrets: inputs — worth landing both together.

---

Net: AGENTS.md / Version.props / report.md changes are clean and ready to merge. auto-merge.yml remains a draft-blocker on the two cross-repo concerns above plus the secret-setup checklist in the PR description.
· branch

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/auto-merge.yml:
- Around line 26-28: The reusable workflow reference under the "auto-merge" job
is pinned to a branch
(ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main); update
that reference to a specific commit SHA instead (replace `@main` with
@<commit-sha>) so the job is SHA-pinned, and keep the existing secrets: inherit
setting; fetch the exact commit SHA from the ANcpLua/renovate-config repo (e.g.,
using git ls-remote or the GitHub UI) and use it in the uses: value to lock the
external workflow to that commit.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: db78b4b6-eecc-4f98-86fe-216cd70c4fd9

📥 Commits

Reviewing files that changed from the base of the PR and between 2f81ee6 and 521281a.

⛔ Files ignored due to path filters (2)

• AGENTS.md is excluded by none and included by none
• report.md is excluded by none and included by none

📒 Files selected for processing (2)

• .github/workflows/auto-merge.yml
• Version.props

📜 Review details

🧰 Additional context used

📓 Path-based instructions (2)

**/*.{csproj,props}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.NET code must use nullable enabled and central package management via Directory.Packages.props, with Version.props as the single owner of versions — never edit <Version> lines directly

Files:

• Version.props

.github/**

⚙️ CodeRabbit configuration file

GitHub Actions workflows. Review for: action version pinning (use SHA not tags), proper secret handling (no secrets in logs), unnecessary workflow triggers, and job dependency correctness. Flag missing concurrency groups on push-triggered workflows.

Files:

• .github/workflows/auto-merge.yml

🧠 Learnings (1)

📓 Common learnings

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: Sealed by default — non-public classes must be sealed unless a subclass exists in the same assembly. This is enforced by ANcpLua.NET.Sdk analyzers

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: Fix all diagnostics at source — do not suppress warnings via `#pragma`, `[SuppressMessage]`, `<NoWarn>`, or `null!`. If a diagnostic fires, the code wants a real change

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: No runtime reflection as control flow — `dynamic`, `ExpandoObject`, `.Result`, `.Wait()` do not appear in qyl. Use `await` for all async operations

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: Before claiming a change is complete, run `dotnet build qyl.slnx --nologo /clp:ErrorsOnly` and verify 0 errors are reported

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: UI work requires a Playwright screenshot of the actual feature in a browser to verify rendering — type-checks alone do not verify visual correctness

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: Top-level orchestration uses Nuke targets defined in `./eng/build.sh` or the global `nuke` tool. Sub-targets are `.Unlisted()` so `nuke --help` shows only user-facing commands; use `nuke --plan` for the full list

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: Source change and regenerated output must ship in the same commit. Codegen sources live in `core/specs/**/*.tsp`, `eng/semconv/model/qyl/*.yaml`, and Roslyn source generators; outputs end in `.g.cs`, `.g.ts`, `.g.sql`, `.g.tsp`

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: Add missing semantic convention attributes to `eng/semconv/model/qyl/<namespace>.yaml`, then run `./eng/semconv/run-weaver.sh` and `nuke GenerateSemconv` to regenerate `QylAttr.<Namespace>.<Name>` and `QylAttributes.<PascalName>` constants

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: Do not hand-roll agent observability code — use the GenAiInstrumentation facade and compose via `IChatClient.WithQylTelemetry()` + `AIAgent.AsBuilder().UseQylAgentTelemetry()`. Wrap both layers; wrapping one halves the OTel attributes

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: When working with MAF, reach for `MAF.Advanced.Patterns.*` PackageReference facades rather than hand-rolling patterns in qyl. Audit existing code for `keep-in-qyl` (qyl-domain-specific), `move-to-MAF.Advanced.Patterns` (provider-agnostic, reusable), or `delete` (duplicate). Tracked in qyl `#173` + MAF.Advanced.Patterns `#1`

Learnt from: CR
Repo: Alexander-Nachtmann/qyl

Timestamp: 2026-05-05T16:45:25.291Z
Learning: The `ANcpLua.Agents` → `MAF.Advanced.Patterns` consolidation is 70% complete and blocked pending a user decision on how to wire qyl to consume MAF.Advanced.Patterns. Three options: (1) publish to nuget.org + PackageReference, (2) local NuGet feed + PackageReference, (3) submodule + ProjectReference. When picked, Phases 4-5-8-9-10 must land in order with both `dotnet build qyl.slnx` and `dotnet build MAF.Advanced.Patterns.slnx` green at each step

🔇 Additional comments (2)

Version.props (1)

35-35: Patch bump to Spectre.Console 0.55.2 — no concerns.

.github/workflows/auto-merge.yml (1)

30-69: Governance job correctly implemented.

SHA-pinned action, token passed via environment variable, defensive shell options, proper scope check before auto-approve. No concerns.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Reusable workflow pinned to @main violates SHA-pinning requirement.

External workflow at ANcpLua/renovate-config is referenced by branch, not commit SHA. Combined with secrets: inherit, any upstream change to that workflow immediately receives all repo secrets. The local action on line 38 is correctly SHA-pinned—apply the same discipline here.

Pin to a specific commit:

-    uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main
+    uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<commit-sha> # vX.Y.Z

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-merge.yml around lines 26 - 28, The reusable workflow
reference under the "auto-merge" job is pinned to a branch
(ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main); update
that reference to a specific commit SHA instead (replace `@main` with
@<commit-sha>) so the job is SHA-pinned, and keep the existing secrets: inherit
setting; fetch the exact commit SHA from the ANcpLua/renovate-config repo (e.g.,
using git ls-remote or the GitHub UI) and use it in the uses: value to lock the
external workflow to that commit.

[ANcpLua]

Both suggestions land on lines that are deleted by this PR — the entire ai-agent-auto-merge block is replaced by the reusable-workflow call. If we want to harden the trust check (github.actor → pull_request.user.login) and add the draft guard, the right place is ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml. Resolving both as not-applicable here.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[ANcpLua]

@claude

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

@coderabbitai autofix

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

⛔ CodeRabbit does not have permission to push changes to this repository. Please ensure CodeRabbit has Contents: Read and write permission.