ci: call the central auto-merge sweep instead of carrying a copy

.github/workflows/auto-merge.yml

@@ -1,19 +1,20 @@
 # Auto-merge — nobody is in the merge loop.
 #
-# Green, ready PRs merge themselves and deploy themselves. The owner does not
-# review PRs, and background-job agent sessions are barred from merging by hand,
-# so the policy lives in scripts/ci/auto-merge-sweep.sh (read it — it defines
-# exactly what "ready" means and how a PR is held back).
+# Green, ready PRs merge themselves and deploy themselves. The policy lives in
+# ONE place for the whole fleet — maonakamoto/dotfiles,
+# scripts/ci/auto-merge-sweep.sh — and this file only says "run it, with these
+# settings".
 #
-# Two triggers, deliberately:
-#   workflow_run — merges within seconds of CI going green (the common path).
-#   schedule     — a safety net. Catches PRs whose checks finished while this
-#                  workflow was failing/disabled, and PRs whose last check was
-#                  an external status that reported after CI. Without it, a PR
-#                  that went green "off-cycle" waits forever.
+# It used to be a copy of that script. Twenty-two repos held such a copy and
+# they drifted into EIGHT versions: fixes written for real outages (a cancelled
+# CI run stranding the queue; a red base trapping the very PR that repairs it)
+# reached only the repo that wrote them, because nothing could carry them
+# across. That is what a copy costs.
+#
+# The triggers stay here on purpose — they are genuinely per-repo: workflow_run
+# must name the CI workflow exactly, and that name differs across the fleet.
 #
 # To stop all of this: delete this file, or add a `hold` label to a PR.
-
 name: Auto-merge
 
 on:
@@ -24,31 +25,25 @@ on:
     - cron: '*/10 * * * *'
   workflow_dispatch: {}
 
+# Declared on the CALLER as well as inside the reusable workflow: a called
+# workflow's token is capped by what the caller grants, so relying on the
+# callee's block alone can hand it a read-only token — and the sweep would then
+# merge nothing while still exiting 0, which is indistinguishable from having
+# nothing to merge.
 permissions:
   contents: write # merge the PR
   pull-requests: write # read PR state, delete the branch
   actions: write # dispatch the re-arm workflows
-
-# Never let two sweeps merge concurrently — they would race on the same PRs.
-concurrency:
-  group: auto-merge
-  cancel-in-progress: false
+  checks: read # statusCheckRollup — only load-bearing on private repos
+  statuses: read
 
 jobs:
   sweep:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Merge every green, ready PR
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          BASE_BRANCH: ${{ github.event.repository.default_branch }}
-          CI_WORKFLOW: ci.yml
-          # Everything that runs on push and therefore would NOT fire after a
-          # merge made with the default GITHUB_TOKEN. Keep this in sync when a
-          # push-triggered workflow is added.
-          REARM_WORKFLOWS: ci.yml deploy.yml
-        run: bash scripts/ci/auto-merge-sweep.sh
+    uses: maonakamoto/dotfiles/.github/workflows/auto-merge-sweep.yml@master
+    with:
+      base_branch: main
+      ci_workflow: ci.yml
+      # SPACE-separated: the sweep word-splits this. A comma would become one
+      # bogus token, every dispatch would fail, and the only symptom would be
+      # that nothing deploys — while the sweep still reported success.
+      rearm_workflows: 'ci.yml deploy.yml'