From 08b16af06e3dd11ed7c5fd15c25e21f0c7a9116a Mon Sep 17 00:00:00 2001
From: Shaun Smith <51304449+smith-xyz@users.noreply.github.com>
Date: Fri, 30 Oct 2026 14:36:35 -0400
Subject: [PATCH] ci: retire auto-merge workflow

Active development is cooling off and Qodo covers review, so the
unattended-merge path is no longer worth a standing pull_request_target
workflow with a write token. Required checks still gate every merge -
they now just need a click.
---
 .github/workflows/auto-merge.yml | 85 --------------------------------
 AGENTS.md                        |  7 +--
 2 files changed, 2 insertions(+), 90 deletions(-)
 delete mode 100644 .github/workflows/auto-merge.yml

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
deleted file mode 100644
index f2e2ea5..0000000
--- a/.github/workflows/auto-merge.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-# Arms GitHub's native auto-merge so a green PR lands unattended: the required
-# checks gate it, no human click. Arming belongs to people with write access:
-#   - apply the `automerge` label (labelling needs triage or better), or
-#   - tick the test checkbox in the PR body -
-#       "- [x] A person reviewed each changed test and the behaviour change is intended"
-#       "- [x] No existing test changed" / "- [x] Tests change only on purpose"
-#     honoured only for authors with write access to the repo (checked through the
-#     API, see below), so an outside contributor cannot arm their own merge by typing.
-# Merge commit only, matching the repo convention (pins point at PR commits).
-# Never disarms: undoing is the UI's "Disable auto-merge", so a PR armed by hand
-# is never clobbered by a body edit.
-#
-# pull_request_target: a write token for fork PRs too. Safe because nothing is
-# checked out - the body is only pattern-matched, never evaluated.
-#
-# Takes effect once this file is on the DEFAULT branch: pull_request_target is a
-# privileged trigger, and those only fire when the workflow exists on the default
-# branch. Here that is `main`, while code lives on `development` - so the file has
-# to be on `main` to run at all. (Same rule silently disables review-after-merge.yml.)
-name: auto-merge
-
-on:
-  pull_request_target:
-    types: [opened, edited, reopened, ready_for_review, synchronize, labeled]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: auto-merge-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  arm:
-    if: >-
-      github.event.pull_request.state == 'open' &&
-      github.event.pull_request.draft == false &&
-      github.event.pull_request.base.ref == 'development'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Arm auto-merge
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-          AUTHOR: ${{ github.event.pull_request.user.login }}
-          LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
-          BODY: ${{ github.event.pull_request.body }}
-        run: |
-          set -euo pipefail
-
-          case ",$LABELS," in *,automerge,*) labelled=yes ;; *) labelled=no ;; esac
-          ticked=no
-          if grep -qiE '^- \[[xX]\].*(a person reviewed each changed test|no existing tests? (changed|were edited)|tests? change only on purpose)' <<<"${BODY:-}"; then
-            ticked=yes
-          fi
-
-          if [ "$labelled" = no ] && [ "$ticked" = no ]; then
-            echo "not armed: no automerge label and no test checkbox ticked"
-            exit 0
-          fi
-          # The body is written by the PR author, so the checkbox only counts for
-          # someone who can push here. author_association cannot answer that: it
-          # reports CONTRIBUTOR for every fork PR, an org admin's included. Ask the
-          # API for the author's actual permission instead (200 + "admin" for a
-          # fork PR from a repo admin).
-          if [ "$labelled" = no ]; then
-            permission=$(gh api "repos/$GH_REPO/collaborators/$AUTHOR/permission" \
-              --jq '.permission' 2>/dev/null || true)
-            case "$permission" in
-              admin | maintain | write) ;;
-              *)
-                echo "not armed: $AUTHOR has '${permission:-no}' access, so the checkbox does not count; apply the automerge label instead"
-                exit 0
-                ;;
-            esac
-          fi
-
-          if [ "$(gh pr view "$PR" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
-            echo "auto-merge already enabled on #$PR"
-            exit 0
-          fi
-          gh pr merge "$PR" --auto --merge
-          echo "auto-merge armed on #$PR: merge commit, lands when the required checks pass"
diff --git a/AGENTS.md b/AGENTS.md
index 7db2020..0c96c40 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -8,9 +8,6 @@ Python 3.11+ library (`traust_engine`).
 - **Releases:** `feat`/`fix`/`perf`/breaking MRs need `make check-release`, `VERSION` + `CHANGELOG.md` bump
 - **Scope:** smallest diff; match existing style
 - **Downstream:** no repo pins this one; traust depends on traust-core only.
-- **Merging:** `development` requires no approvals - the checks gate it. Arm
-  auto-merge instead of waiting on a click: apply the `automerge` label, or tick
-  the test checkbox in the PR body; `.github/workflows/auto-merge.yml` then runs
-  `gh pr merge --auto --merge` and the PR lands when the checks pass. Merge
-  commits only - downstream pins point at them.
+- **Merging:** `development` requires no approvals - the checks gate it; merge
+  once the checks are green. Merge commits only - downstream pins point at them.
 - **Setup:** `make setup` once per clone (hooks). More: [CONTRIBUTING.md](CONTRIBUTING.md), [README.md](README.md)