@leaflink/dom-testing-utils 0.0.0-PR-215--a64f64f → 0.0.0-PR-214--5cf87d7

package/README.md

@@ -58,9 +58,9 @@ Dependency updates are handled by self-hosted [Renovate](https://docs.renovatebo
 ### Schedule
 
 - Workflow cron wakes Renovate hourly.
-- Renovate only opens PRs and merges between **1am–5am America/New_York**, every day.
+- Renovate only opens PRs between **1am–5am America/New_York**, every day.
 - A new release must be **≥ 10 days old** (`minimumReleaseAge`) before Renovate will propose it — buffer against compromised/withdrawn publishes.
-- Merging is done by Renovate itself (`platformAutomerge: false`), not GitHub's native auto-merge — so a PR that goes green merges on the next hourly wake inside the schedule window.
+- Merging is handled by a separate workflow (see [Auto-merge](#auto-merge)) that runs whenever required CI completes — independent of Renovate's schedule.
 
 ### Update groups and auto-merge policy
 
@@ -75,14 +75,29 @@ Dependency updates are handled by self-hosted [Renovate](https://docs.renovatebo
 
 Renovate PR bodies all link back to MKPL-1055 via `prBodyNotes`.
 
-### How auto-merge interacts with branch protection
+### Auto-merge
 
-`main` requires `quality-checks` + `release` status checks and a CODEOWNERS review. The Renovate PAT is issued from `leaflink-automation`, which is in `main`'s `bypass_pull_request_allowances` — bypass covers the review requirement only; required status checks still gate every merge.
+`main` requires `quality-checks` + `release` status checks and a CODEOWNERS review. The `leaflink-automation` account (whose PAT Renovate uses) is in `main`'s `bypass_pull_request_allowances`, but Renovate itself won't call the merge API while the PR shows as `BLOCKED` in GitHub's API — even though the bypass would let it through.
+
+To work around this, `.github/workflows/renovate-merge.yml` performs the merge on Renovate's behalf:
+
+1. Renovate creates the PR. Any rule with `automerge: true` adds `addLabels: ['automerge']`, so the label is the single source of truth for "Renovate intended to auto-merge this."
+2. `PR Quality Checks` and `Release` run on the PR.
+3. When either completes, the `Renovate Merge` workflow is triggered via `workflow_run`. It:
+   - filters to PRs authored by `leaflink-automation` with the `automerge` label,
+   - asserts both required checks are present and successful,
+   - calls the merge API authenticated as `leaflink-automation`.
+4. Because the user is on the bypass list, the merge call succeeds despite `BLOCKED` status.
+
+Human PRs are unaffected — they still require CODEOWNERS review.
+
+The required-checks list in `renovate-merge.yml` (`REQUIRED_CHECKS`) is hard-coded and must stay in sync with branch protection on `main`.
 
 ### Where to look
 
 - **Dependency Dashboard issue** (auto-created by Renovate, label `dependencies`) — single source of truth for what Renovate sees, what it skipped, and why.
-- **Workflow runs** for `Renovate` in the Actions tab — `workflow_dispatch` with `logLevel: debug` to debug.
+- **Workflow runs** for `Renovate` in the Actions tab — `workflow_dispatch` with `logLevel: debug` to debug Renovate itself.
+- **Workflow runs** for `Renovate Merge` in the Actions tab — shows which PRs were merged or skipped (with reason) when CI completed. `workflow_dispatch` for manual recovery.
 - **`config:recommended`** is the base preset; any unspecified behavior comes from there.
 
 ## Usage

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leaflink/dom-testing-utils",
-  "version": "0.0.0-PR-215--a64f64f",
+  "version": "0.0.0-PR-214--5cf87d7",
   "description": "Frontend DOM testing utilities",
   "packageManager": "pnpm@11.0.9",
   "engines": {
@@ -49,7 +49,7 @@
     "@vitest/coverage-v8": "^4.1.6",
     "commitlint": "^21.0.0",
     "conventional-changelog-conventionalcommits": "^9.3.0",
-    "eslint": "^9.39.2",
+    "eslint": "^10.0.0",
     "jsdom": "^29.1.1",
     "semantic-release": "^25.0.3",
     "stylelint": "^17.11.0",