From 5314623d9b579f464c8fa0e20bf23359d1adab45 Mon Sep 17 00:00:00 2001
From: Claas Augner <caugner@mozilla.com>
Date: Wed, 21 Oct 2026 14:00:27 +0200
Subject: [PATCH 1/3] ci(auto-merge): skip draft PRs

Skip the `auto-merge` job for draft PRs and re-run on `ready_for_review`, so eligible PRs are approved and merged once marked ready. Re-check the draft state before `gh pr merge --auto`, since the event payload can be stale.

`gh pr merge --auto` fails on draft PRs.
---
 .github/workflows/auto-merge-workflows.yml |  1 +
 .github/workflows/auto-merge.yml           | 11 +++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/auto-merge-workflows.yml b/.github/workflows/auto-merge-workflows.yml
index a5bc262..ae425c1 100644
--- a/.github/workflows/auto-merge-workflows.yml
+++ b/.github/workflows/auto-merge-workflows.yml
@@ -2,6 +2,7 @@ name: auto-merge
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
   contents: read
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 5e17274..57bcb5e 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   auto-merge:
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && !github.event.pull_request.draft
     runs-on: ubuntu-latest
 
     steps:
@@ -84,4 +84,11 @@ jobs:
         if: inputs.auto-merge && steps.check.outputs.eligible == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-        run: gh pr merge ${{ github.event.pull_request.html_url }} --auto --squash
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          # The event payload is a snapshot; the PR may have become a draft since
+          if [[ "$(gh pr view "$PR_URL" --json isDraft --jq .isDraft)" == "true" ]]; then
+            echo "::notice::Skipping auto-merge, the PR is now a draft"
+            exit 0
+          fi
+          gh pr merge "$PR_URL" --auto --squash

From 8495fdda7a86fbe3462a9a92d6d29152141b32ac Mon Sep 17 00:00:00 2001
From: Claas Augner <caugner@mozilla.com>
Date: Wed, 21 Oct 2026 14:00:27 +0200
Subject: [PATCH 2/3] ci(auto-merge): skip approval of approved commit

Skip the approval when the token's user has already approved the PR's head commit. Approvals on older commits are ignored, so repos that require approval of the most recent push are re-approved.

Re-runs (e.g. on `ready_for_review`) would otherwise approve repeatedly.
---
 .github/workflows/auto-merge.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 57bcb5e..a48d244 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -78,7 +78,15 @@ jobs:
         if: inputs.auto-approve && steps.check.outputs.eligible == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-        run: gh pr review ${{ github.event.pull_request.html_url }} --approve
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          me="$(gh api user --jq .login)"
+          approved="$(gh pr view "$PR_URL" --json reviews,headRefOid --jq ".headRefOid as \$head | [.reviews[] | select(.author.login == \"$me\" and .state == \"APPROVED\" and .commit.oid == \$head)] | length")"
+          if [[ "$approved" != "0" ]]; then
+            echo "::notice::Skipping approval, the latest commit is already approved by $me"
+            exit 0
+          fi
+          gh pr review "$PR_URL" --approve
 
       - name: Enable auto-merge
         if: inputs.auto-merge && steps.check.outputs.eligible == 'true'

From 05a1674903744b973c2e48035bd2506ff0915d73 Mon Sep 17 00:00:00 2001
From: Claas Augner <caugner@mozilla.com>
Date: Wed, 21 Oct 2026 14:05:16 +0200
Subject: [PATCH 3/3] refactor(auto-merge): pass login to jq via `--arg`

Avoid splicing the shell variable into the jq program.
---
 .github/workflows/auto-merge.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index a48d244..027d068 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -81,7 +81,8 @@ jobs:
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
           me="$(gh api user --jq .login)"
-          approved="$(gh pr view "$PR_URL" --json reviews,headRefOid --jq ".headRefOid as \$head | [.reviews[] | select(.author.login == \"$me\" and .state == \"APPROVED\" and .commit.oid == \$head)] | length")"
+          approved="$(gh pr view "$PR_URL" --json reviews,headRefOid \
+            | jq --arg me "$me" '.headRefOid as $head | [.reviews[] | select(.author.login == $me and .state == "APPROVED" and .commit.oid == $head)] | length')"
           if [[ "$approved" != "0" ]]; then
             echo "::notice::Skipping approval, the latest commit is already approved by $me"
             exit 0