@rmartz/bot-automerge 0.2.1

package/README.md

@@ -0,0 +1,100 @@
+# @rmartz/bot-automerge
+
+The **eligibility enabler** for trustworthy bot pull requests, packaged so a repo
+can turn on GitHub's native auto-merge for the bot PRs it trusts. bot-automerge
+classifies a bot PR — Dependabot `patch`/`minor` bumps and release-please release
+PRs — and, when the PR is eligible, runs `gh pr merge --auto --squash` to enable
+native auto-merge. It is the counterpart to
+[`@rmartz/merge-safety`](https://github.com/rmartz/merge-safety), which computes
+the pre-auto-merge safety verdict: where merge-safety answers "is it safe to
+merge?", bot-automerge answers "is this a bot PR we trust enough to enable
+auto-merge on?". Unlike merge-safety, it posts **no check-run**.
+
+It is distributed the same way [`@rmartz/repo-hygiene`](https://github.com/rmartz/repo-hygiene)
+and `@rmartz/merge-safety` are:
+
+1. **Updates propagate automatically.** Consuming repos pin one reusable workflow
+   by SHA; Dependabot's `github-actions` ecosystem opens PRs to bump that pin.
+2. **No check-run contract.** bot-automerge is purely an eligibility enabler — it
+   requires no fleet-wide status-check name. See
+   [docs/bot-automerge-contract.md](docs/bot-automerge-contract.md).
+
+> **Status: implemented.** The `enable` classification — Dependabot `patch`/`minor`
+> bumps and release-please release PRs — and the reusable workflow are complete and
+> ship in `v0.1.0`, the first release to GitHub Packages. It was built per
+> [ai-tools#264](https://github.com/rmartz/ai-tools/issues/264); see
+> [docs/bot-automerge-contract.md](docs/bot-automerge-contract.md) for the
+> eligibility contract.
+
+## Using it in a consuming repo
+
+Add one caller workflow (this is what Dependabot keeps current). Unlike a
+read-only hygiene check, this caller carries the triggers, grants write scopes,
+and passes secrets through — because a reusable workflow can't declare its own
+triggers and runs with the intersection of granted and declared permissions:
+
+```yaml
+# .github/workflows/bot-automerge.yml
+name: bot-automerge
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, labeled]
+permissions:
+  contents: write
+  pull-requests: write
+  packages: read # install the CLI from GitHub Packages
+jobs:
+  bot-automerge:
+    uses: rmartz/bot-automerge/.github/workflows/bot-automerge.yml@<sha> # vX.Y.Z
+    with:
+      pr: ${{ github.event.pull_request.number }}
+    secrets: inherit
+```
+
+It uses `pull_request_target` (not `pull_request`) because Dependabot PRs run with
+a read-only token, and enabling auto-merge needs base-context write.
+
+> **Require `merge-safety` + your CI checks on the default branch _before_ adopting
+> this.** `gh pr merge --auto` merges a PR immediately if the repo has no required
+> status checks — bot-automerge only makes a bot PR _eligible_ to auto-merge; the
+> repo's required checks are what it waits on. See the
+> [consumer setup guide](docs/consuming.md) for the full prerequisite.
+
+The public `@rmartz/bot-automerge` package on GitHub Packages is readable with the
+built-in `GITHUB_TOKEN`, so no consumer PAT is required.
+
+> For the full walkthrough — the caller's permissions, why it isn't trigger-free,
+> and how the pin stays current — see the
+> [consumer setup guide](docs/consuming.md).
+
+## Requirements
+
+- Node.js >= 20.11
+- pnpm 9 (pinned via `packageManager`)
+
+Consuming repos need neither — the reusable workflow runs the published CLI on a
+GitHub-hosted runner.
+
+## Local development
+
+```bash
+pnpm install
+pnpm run build        # tsup → dist (ESM + d.ts)
+pnpm run typecheck
+pnpm run lint
+pnpm run format:check
+pnpm run test         # vitest
+```
+
+## Releases
+
+Versioned by [semantic-release](.releaserc.json). A push to `main` analyzes the
+Conventional-Commit history since the last `bot-automerge-v*` tag and, when a
+release is warranted, publishes the package to GitHub Packages (public) and
+creates the git tag + GitHub Release — no release PR and no commit-back, so the
+built-in `GITHUB_TOKEN` suffices. `tagFormat` stays `bot-automerge-v${version}`
+for continuity with the prior release-please tags.
+
+---
+
+🤖 Created by Claude Opus 4.8

package/dist/bin/bot-automerge.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin/bot-automerge.js

@@ -0,0 +1,304 @@
+#!/usr/bin/env node
+import {
+  AUTOMERGE_HANDLED_LABEL,
+  RELEASE_PLEASE_BRANCH_PREFIX,
+  RELEASE_PLEASE_PENDING_LABEL,
+  isBotAutomergeCommand,
+  isDependabotAuthor,
+  isDependabotUpdateType,
+  isEligibleDependabotUpdateType
+} from "../chunk-MM4DLJ6N.js";
+
+// src/lib/bounded-subprocess.ts
+import { spawn } from "child_process";
+function boundedRun(command, args, options) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      detached: true
+      // new process group, so we can kill the whole tree
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+      }
+    }, options.timeoutMs);
+    if (options.input !== void 0 && child.stdin) {
+      child.stdin.on("error", () => {
+      });
+      child.stdin.write(options.input);
+      child.stdin.end();
+    }
+    child.stdout.on("data", (chunk) => stdout += chunk.toString());
+    child.stderr.on("data", (chunk) => stderr += chunk.toString());
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({ stdout, stderr, code, timedOut });
+    });
+  });
+}
+
+// src/lib/github.ts
+var GH_API_TIMEOUT_MS = 3e4;
+var MAX_RETRIES = 2;
+var BACKOFF_BASE_MS = 1e3;
+var BACKOFF_CAP_MS = 8e3;
+var realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function isRateLimited(text) {
+  const t = (text ?? "").toLowerCase();
+  return t.includes("rate limit") || t.includes("rate-limit");
+}
+async function runTransport({ argv, stdin }, cwd) {
+  const [command, ...args] = argv;
+  if (command === void 0) return { stdout: null, stderr: "empty argv" };
+  try {
+    const r = await boundedRun(command, args, { timeoutMs: GH_API_TIMEOUT_MS, cwd, input: stdin });
+    if (r.code === 0) return { stdout: r.stdout, stderr: "" };
+    return { stdout: null, stderr: r.stderr || "" };
+  } catch (err) {
+    return { stdout: null, stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function ghCall(primary, fallback, opts = {}) {
+  const sleep = opts.sleep ?? realSleep;
+  for (const transport of [primary, fallback]) {
+    if (!transport) continue;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      const { stdout, stderr } = await runTransport(transport, opts.cwd);
+      if (stdout !== null) return stdout;
+      if (isRateLimited(stderr)) break;
+      if (attempt < MAX_RETRIES) {
+        await sleep(Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS));
+      }
+    }
+  }
+  return null;
+}
+function parseSlugFromRemoteUrl(url) {
+  const trimmed = url.trim();
+  const match = trimmed.match(/[/:]([^/:]+)\/([^/]+?)(?:\.git)?\/?$/);
+  if (match) return `${match[1]}/${match[2]}`;
+  const bare = trimmed.match(/^([^/:\s]+)\/([^/:\s]+?)(?:\.git)?$/);
+  return bare ? `${bare[1]}/${bare[2]}` : null;
+}
+async function currentRepo(opts = {}) {
+  const out = await ghCall(
+    { argv: ["gh", "repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"] },
+    null,
+    opts
+  );
+  if (out && out.trim()) return out.trim();
+  const remote = await boundedRun("git", ["remote", "get-url", "origin"], {
+    timeoutMs: GH_API_TIMEOUT_MS,
+    cwd: opts.cwd
+  });
+  return remote.code === 0 ? parseSlugFromRemoteUrl(remote.stdout) : null;
+}
+async function resolveRepoTarget(opts = {}) {
+  const explicit = opts.repo?.trim();
+  if (explicit) return explicit;
+  const ghRepo = (opts.env ?? process.env).GH_REPO?.trim();
+  if (ghRepo) return ghRepo;
+  return currentRepo(opts);
+}
+function issueNumber(ref) {
+  const s = String(ref);
+  if (/^\d+$/.test(s)) return s;
+  const m = s.match(/\/(?:issues|pull)\/(\d+)/);
+  return m?.[1] ?? null;
+}
+async function addLabels(repo, issue, labels, call = {}) {
+  const number = issueNumber(issue);
+  if (number === null || !labels.length) return null;
+  const rest = {
+    argv: ["gh", "api", "-X", "POST", `repos/${repo}/issues/${number}/labels`, "--input", "-"],
+    stdin: JSON.stringify({ labels })
+  };
+  const fb = {
+    argv: ["gh", "issue", "edit", number, "--repo", repo, "--add-label", labels.join(",")]
+  };
+  const out = await ghCall(rest, fb, call);
+  return out !== null ? out.trim() : null;
+}
+
+// src/lib/automerge-label.ts
+async function markPrHandled(repo, pr, opts = {}) {
+  const out = await addLabels(repo, pr, [AUTOMERGE_HANDLED_LABEL], opts);
+  return out !== null;
+}
+
+// src/bot-automerge.ts
+function isEvaluablePrState(state) {
+  return state === "OPEN";
+}
+function detectBotPrType(view) {
+  if (isDependabotAuthor(view.author)) return "dependabot";
+  if (view.headRefName.startsWith(RELEASE_PLEASE_BRANCH_PREFIX) || view.labels.includes(RELEASE_PLEASE_PENDING_LABEL)) {
+    return "release-please";
+  }
+  return null;
+}
+function semverWord(updateType) {
+  return updateType.slice("version-update:semver-".length);
+}
+function verdict(eligible, reason, prType, updateType) {
+  return { eligible, reason, prType, updateType };
+}
+function classifyBotPr(view, updateType) {
+  const prType = detectBotPrType(view);
+  if (!isEvaluablePrState(view.state)) {
+    return verdict(false, `PR is ${view.state.toLowerCase()} \u2014 no auto-merge action`, prType, null);
+  }
+  if (view.isCrossRepository) {
+    return verdict(false, "PR is from a fork (cross-repository) \u2014 never eligible", null, null);
+  }
+  if (prType === null) {
+    return verdict(false, "not a recognized bot PR (unknown or human author)", null, null);
+  }
+  if (prType === "release-please") {
+    return verdict(
+      true,
+      "release-please release PR \u2014 eligible once its required checks pass",
+      "release-please",
+      null
+    );
+  }
+  if (!isDependabotUpdateType(updateType)) {
+    const reason = updateType === void 0 || updateType === "" ? "Dependabot PR but update-type unavailable \u2014 not enabling auto-merge" : `Dependabot PR with unrecognized update-type "${updateType}" \u2014 not enabling auto-merge`;
+    return verdict(false, reason, "dependabot", null);
+  }
+  if (isEligibleDependabotUpdateType(updateType)) {
+    return verdict(
+      true,
+      `Dependabot ${semverWord(updateType)} update \u2014 eligible`,
+      "dependabot",
+      updateType
+    );
+  }
+  return verdict(
+    false,
+    `Dependabot ${semverWord(updateType)} update \u2014 held for manual review`,
+    "dependabot",
+    updateType
+  );
+}
+function errorBotAutomergeVerdict(message) {
+  return verdict(false, `could not evaluate: ${message}`, null, null);
+}
+
+// src/bin/bot-automerge.ts
+function usage() {
+  console.error(
+    "usage: ai-bot-automerge enable --pr <n> [--repo <o/r>] [--update-type <t>] [--json] [--cwd <path>]"
+  );
+  process.exit(2);
+}
+function parse(argv) {
+  const mode = argv[0];
+  if (!isBotAutomergeCommand(mode)) usage();
+  const args = { mode, json: false };
+  for (let i = 1; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--pr") args.pr = Number(argv[++i]);
+    else if (a === "--repo") args.repo = argv[++i];
+    else if (a === "--update-type") args.updateType = argv[++i];
+    else if (a === "--cwd") args.cwd = argv[++i];
+    else if (a === "--json" || a === "--dry-run") args.json = true;
+    else usage();
+  }
+  if (mode === "enable" && !args.pr) usage();
+  return args;
+}
+async function ghJson(argv, cwd) {
+  const out = await ghCall({ argv }, null, { cwd });
+  if (out === null) return null;
+  try {
+    return JSON.parse(out);
+  } catch {
+    return null;
+  }
+}
+async function fetchPrView(repo, pr, cwd) {
+  return ghJson(
+    [
+      "gh",
+      "pr",
+      "view",
+      String(pr),
+      "--repo",
+      repo,
+      "--json",
+      "number,author,headRefName,headRepository,isCrossRepository,labels,state"
+    ],
+    cwd
+  );
+}
+function emitVerdictJson(verdict2, isError) {
+  console.log(JSON.stringify(verdict2, null, 2));
+  if (isError) process.exitCode = 1;
+}
+async function enableAutoMerge(repo, pr, cwd) {
+  const out = await ghCall(
+    { argv: ["gh", "pr", "merge", "--auto", "--squash", String(pr), "--repo", repo] },
+    null,
+    { cwd }
+  );
+  return out !== null;
+}
+async function runEnable(repo, pr, args) {
+  const view = await fetchPrView(repo, pr, args.cwd);
+  if (!view) {
+    const msg = `could not read PR #${pr}`;
+    if (args.json) return emitVerdictJson(errorBotAutomergeVerdict(msg), true);
+    console.error(`#${pr}: ${msg} \u2014 not enabling auto-merge`);
+    process.exitCode = 1;
+    return;
+  }
+  const prView = {
+    author: view.author?.login ?? "",
+    headRefName: view.headRefName,
+    // Fail safe: a missing field or a deleted head repository counts as a fork.
+    isCrossRepository: view.isCrossRepository !== false || !view.headRepository,
+    labels: view.labels.map((l) => l.name),
+    state: view.state
+  };
+  const verdict2 = classifyBotPr(prView, args.updateType);
+  if (args.json) return emitVerdictJson(verdict2, false);
+  if (!isEvaluablePrState(view.state)) {
+    console.log(`#${pr}: ${view.state.toLowerCase()} \u2014 skipping (no auto-merge action)`);
+    return;
+  }
+  if (!verdict2.eligible) {
+    console.log(`#${pr}: not eligible \u2014 ${verdict2.reason}`);
+    return;
+  }
+  const enabled = await enableAutoMerge(repo, pr, args.cwd);
+  if (!enabled) {
+    console.error(`#${pr}: eligible (${verdict2.reason}) but failed to enable auto-merge`);
+    process.exitCode = 1;
+    return;
+  }
+  const labeled = await markPrHandled(repo, pr, { cwd: args.cwd });
+  const labelNote = labeled ? `; labeled "${AUTOMERGE_HANDLED_LABEL}"` : `; could not apply "${AUTOMERGE_HANDLED_LABEL}" label (non-fatal)`;
+  console.log(`#${pr}: eligible \u2014 auto-merge enabled (${verdict2.reason})${labelNote}`);
+}
+async function main() {
+  const args = parse(process.argv.slice(2));
+  const repo = await resolveRepoTarget({ repo: args.repo, cwd: args.cwd });
+  if (!repo) {
+    console.error("error: could not resolve target repo (pass --repo <owner/repo>)");
+    process.exit(2);
+  }
+  await runEnable(repo, args.pr, args);
+}
+void main();

package/dist/chunk-MM4DLJ6N.js

@@ -0,0 +1,47 @@
+// src/index.ts
+var BOT_AUTOMERGE_COMMANDS = ["enable"];
+function isBotAutomergeCommand(value) {
+  return value !== void 0 && BOT_AUTOMERGE_COMMANDS.includes(value);
+}
+var DEPENDABOT_AUTHOR = "dependabot[bot]";
+var DEPENDABOT_AUTHOR_GH_CLI = "app/dependabot";
+var DEPENDABOT_AUTHORS = [DEPENDABOT_AUTHOR, DEPENDABOT_AUTHOR_GH_CLI];
+function isDependabotAuthor(login) {
+  return DEPENDABOT_AUTHORS.includes(login);
+}
+var RELEASE_PLEASE_BRANCH_PREFIX = "release-please--";
+var RELEASE_PLEASE_PENDING_LABEL = "autorelease: pending";
+var DEPENDABOT_UPDATE_TYPES = [
+  "version-update:semver-patch",
+  "version-update:semver-minor",
+  "version-update:semver-major"
+];
+var AUTO_MERGE_ELIGIBLE_UPDATE_TYPES = [
+  "version-update:semver-patch",
+  "version-update:semver-minor"
+];
+function isDependabotUpdateType(value) {
+  return value !== void 0 && DEPENDABOT_UPDATE_TYPES.includes(value);
+}
+function isEligibleDependabotUpdateType(value) {
+  return value !== void 0 && AUTO_MERGE_ELIGIBLE_UPDATE_TYPES.includes(value);
+}
+var BOT_PR_TYPES = ["dependabot", "release-please"];
+var AUTOMERGE_HANDLED_LABEL = "auto-merge enabled";
+
+export {
+  BOT_AUTOMERGE_COMMANDS,
+  isBotAutomergeCommand,
+  DEPENDABOT_AUTHOR,
+  DEPENDABOT_AUTHOR_GH_CLI,
+  DEPENDABOT_AUTHORS,
+  isDependabotAuthor,
+  RELEASE_PLEASE_BRANCH_PREFIX,
+  RELEASE_PLEASE_PENDING_LABEL,
+  DEPENDABOT_UPDATE_TYPES,
+  AUTO_MERGE_ELIGIBLE_UPDATE_TYPES,
+  isDependabotUpdateType,
+  isEligibleDependabotUpdateType,
+  BOT_PR_TYPES,
+  AUTOMERGE_HANDLED_LABEL
+};

package/dist/index.d.ts

@@ -0,0 +1,115 @@
+/**
+ * @rmartz/bot-automerge — public entry point.
+ *
+ * Encodes the package's stable public contract: the CLI command surface that
+ * enables GitHub-native auto-merge for trustworthy bot pull requests. This is the
+ * "eligibility enabler" counterpart to `@rmartz/merge-safety`'s "safety verdict" —
+ * it classifies a bot PR and, when eligible, turns on native auto-merge. Unlike
+ * merge-safety it posts NO check-run and carries no fleet check-run contract.
+ *
+ * The classification + enablement implementation (and the `ai-bot-automerge` bin)
+ * lives alongside it; this module is intentionally the narrow, frozen surface the
+ * reusable workflow and consumers depend on. Extracted per rmartz/ai-tools#264.
+ */
+/**
+ * The operations the `ai-bot-automerge` CLI dispatches:
+ * - `enable` — classify one bot PR and, when it is an eligible bot bump, turn on
+ *   GitHub-native auto-merge (`gh pr merge --auto --squash`).
+ */
+declare const BOT_AUTOMERGE_COMMANDS: readonly ["enable"];
+type BotAutomergeCommand = (typeof BOT_AUTOMERGE_COMMANDS)[number];
+/** Type guard for the CLI command surface. */
+declare function isBotAutomergeCommand(value: string | undefined): value is BotAutomergeCommand;
+/**
+ * The GitHub login of the Dependabot app account in REST/GraphQL form. A PR
+ * authored by this login takes the Dependabot classification path (its
+ * eligibility then turns on the caller-supplied semver update-type).
+ */
+declare const DEPENDABOT_AUTHOR = "dependabot[bot]";
+/**
+ * The same Dependabot author login as the `gh` CLI reports it. `gh pr view
+ * --json author` surfaces bot logins in `app/<slug>` form, not the REST/GraphQL
+ * `<slug>[bot]` form — so the CLI path (`ai-bot-automerge enable`, which reads
+ * the author via `gh`) sees this, and detection must accept it alongside
+ * {@link DEPENDABOT_AUTHOR}. (Missing this form is why every Dependabot PR was
+ * misclassified as "not a recognized bot PR" — issue #22.)
+ */
+declare const DEPENDABOT_AUTHOR_GH_CLI = "app/dependabot";
+/**
+ * Every author login that marks a PR as Dependabot-authored, across the two
+ * shapes GitHub surfaces the account under: REST/GraphQL {@link DEPENDABOT_AUTHOR}
+ * and `gh` CLI {@link DEPENDABOT_AUTHOR_GH_CLI}. Detection accepts either.
+ */
+declare const DEPENDABOT_AUTHORS: readonly ["dependabot[bot]", "app/dependabot"];
+/** True when `login` is a recognized Dependabot author login (either surface form). */
+declare function isDependabotAuthor(login: string): boolean;
+/**
+ * The head-branch prefix release-please gives its release PR (e.g.
+ * `release-please--branches--main`). Either this prefix OR the pending label
+ * below marks a PR as a release-please release PR.
+ */
+declare const RELEASE_PLEASE_BRANCH_PREFIX = "release-please--";
+/** The label release-please applies to its open release PR. */
+declare const RELEASE_PLEASE_PENDING_LABEL = "autorelease: pending";
+/**
+ * The Dependabot semver update-type, as emitted verbatim by
+ * `dependabot/fetch-metadata` (`steps.metadata.outputs.update-type`). This is
+ * the ONLY source of the update-type — the CLI takes it via `--update-type` and
+ * never re-derives it from the PR title (which would be brittle and could
+ * disagree with fetch-metadata).
+ */
+declare const DEPENDABOT_UPDATE_TYPES: readonly ["version-update:semver-patch", "version-update:semver-minor", "version-update:semver-major"];
+type DependabotUpdateType = (typeof DEPENDABOT_UPDATE_TYPES)[number];
+/**
+ * The Dependabot update-types eligible for auto-merge: patch and minor only.
+ * Majors are potentially breaking and stay manual — a deliberate subset of
+ * {@link DEPENDABOT_UPDATE_TYPES}.
+ */
+declare const AUTO_MERGE_ELIGIBLE_UPDATE_TYPES: readonly ["version-update:semver-patch", "version-update:semver-minor"];
+type EligibleDependabotUpdateType = (typeof AUTO_MERGE_ELIGIBLE_UPDATE_TYPES)[number];
+/** Type guard: is `value` one of the three recognized Dependabot update-types? */
+declare function isDependabotUpdateType(value: string | undefined): value is DependabotUpdateType;
+/** Type guard: is `value` an auto-merge-eligible (patch/minor) update-type? */
+declare function isEligibleDependabotUpdateType(value: string | undefined): value is EligibleDependabotUpdateType;
+/**
+ * The kind of trustworthy bot PR bot-automerge recognizes. `dependabot` PRs are
+ * gated on their update-type; `release-please` release PRs are eligible as a
+ * whole. A PR matching neither is not a bot PR and is never eligible.
+ */
+declare const BOT_PR_TYPES: readonly ["dependabot", "release-please"];
+type BotPrType = (typeof BOT_PR_TYPES)[number];
+/**
+ * The verdict `classifyBotPr` yields and the `--json` / `--dry-run` mode prints.
+ * This shape is the frozen decision contract:
+ * - `eligible` — true iff bot-automerge should enable native auto-merge.
+ * - `reason` — a one-line human-readable justification (positive or negative).
+ * - `prType` — the detected bot path, or `null` when the PR is not a bot PR.
+ * - `updateType` — the recognized Dependabot update-type, or `null` (always
+ *   `null` for release-please, unknown bots, or an unavailable/unrecognized
+ *   update-type).
+ */
+interface BotAutomergeVerdict {
+    eligible: boolean;
+    reason: string;
+    prType: BotPrType | null;
+    updateType: DependabotUpdateType | null;
+}
+/**
+ * The label bot-automerge applies to a PR at the moment it turns on native
+ * auto-merge, so external processes (triage bots, dashboards, PR coordinators)
+ * can see the PR is already owned by bot-automerge and need not route it for
+ * manual merge handling.
+ *
+ * This is additive and human-visible; unlike `@rmartz/merge-safety`'s check-run
+ * it carries NO required-status contract — bot-automerge still posts no check-run.
+ * The application is best-effort: it uses the caller's existing
+ * `pull-requests: write` scope, and consuming repos seed the label through their
+ * label roster (`ai-ensure-labels` / `labels.yml`).
+ *
+ * PUBLIC CONTRACT: external processes key on this string verbatim, so a package
+ * test pins it the way merge-safety pins its check-run name — a silent edit here
+ * would break every consumer keying off the label.
+ */
+declare const AUTOMERGE_HANDLED_LABEL = "auto-merge enabled";
+
+export { AUTOMERGE_HANDLED_LABEL, AUTO_MERGE_ELIGIBLE_UPDATE_TYPES, BOT_AUTOMERGE_COMMANDS, BOT_PR_TYPES, type BotAutomergeCommand, type BotAutomergeVerdict, type BotPrType, DEPENDABOT_AUTHOR, DEPENDABOT_AUTHORS, DEPENDABOT_AUTHOR_GH_CLI, DEPENDABOT_UPDATE_TYPES, type DependabotUpdateType, type EligibleDependabotUpdateType, RELEASE_PLEASE_BRANCH_PREFIX, RELEASE_PLEASE_PENDING_LABEL, isBotAutomergeCommand, isDependabotAuthor, isDependabotUpdateType, isEligibleDependabotUpdateType };

package/dist/index.js

@@ -0,0 +1,32 @@
+import {
+  AUTOMERGE_HANDLED_LABEL,
+  AUTO_MERGE_ELIGIBLE_UPDATE_TYPES,
+  BOT_AUTOMERGE_COMMANDS,
+  BOT_PR_TYPES,
+  DEPENDABOT_AUTHOR,
+  DEPENDABOT_AUTHORS,
+  DEPENDABOT_AUTHOR_GH_CLI,
+  DEPENDABOT_UPDATE_TYPES,
+  RELEASE_PLEASE_BRANCH_PREFIX,
+  RELEASE_PLEASE_PENDING_LABEL,
+  isBotAutomergeCommand,
+  isDependabotAuthor,
+  isDependabotUpdateType,
+  isEligibleDependabotUpdateType
+} from "./chunk-MM4DLJ6N.js";
+export {
+  AUTOMERGE_HANDLED_LABEL,
+  AUTO_MERGE_ELIGIBLE_UPDATE_TYPES,
+  BOT_AUTOMERGE_COMMANDS,
+  BOT_PR_TYPES,
+  DEPENDABOT_AUTHOR,
+  DEPENDABOT_AUTHORS,
+  DEPENDABOT_AUTHOR_GH_CLI,
+  DEPENDABOT_UPDATE_TYPES,
+  RELEASE_PLEASE_BRANCH_PREFIX,
+  RELEASE_PLEASE_PENDING_LABEL,
+  isBotAutomergeCommand,
+  isDependabotAuthor,
+  isDependabotUpdateType,
+  isEligibleDependabotUpdateType
+};

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@rmartz/bot-automerge",
+  "version": "0.2.1",
+  "description": "Enables GitHub-native auto-merge for trustworthy bot pull requests (Dependabot patch/minor bumps and release-please release PRs), distributed via a reusable workflow kept current by Dependabot.",
+  "keywords": [
+    "ci",
+    "bot-automerge",
+    "auto-merge",
+    "github-actions",
+    "reusable-workflow",
+    "dependabot"
+  ],
+  "homepage": "https://github.com/rmartz/bot-automerge#readme",
+  "bugs": {
+    "url": "https://github.com/rmartz/bot-automerge/issues"
+  },
+  "type": "module",
+  "packageManager": "pnpm@9.12.0",
+  "engines": {
+    "node": ">=20.11.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "ai-bot-automerge": "./dist/bin/bot-automerge.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "@rmartz:registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rmartz/bot-automerge.git"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.1",
+    "@typescript-eslint/eslint-plugin": "^8.70.0",
+    "@typescript-eslint/parser": "^8.70.0",
+    "@vitest/coverage-v8": "^5.0.1",
+    "conventional-changelog-conventionalcommits": "^9.1.0",
+    "eslint": "^10.10.0",
+    "eslint-import-resolver-typescript": "^4.4.5",
+    "eslint-plugin-import": "^2.32.0",
+    "prettier": "^3.9.6",
+    "semantic-release": "^25.0.9",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3",
+    "vite": "^8.3.0",
+    "vitest": "^5.0.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "esbuild": ">=0.28.1"
+    }
+  }
+}