Enforce reviewer gates before bot auto-merge

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Problem

The organization-required EnableAutoMerge workflow is arming ordinary Dependabot/Renovate PRs before the required current-head reviewer and CodeRabbit pre-merge gates are green.

Live evidence

• platform#2630 auto-merged on 2026-07-14 with green CI and zero threads, but no supported CodeRabbit pre-merge summary and no current-head CodeRabbit/Codex green review.
• platform#2629 entered the merge queue and began its production deploy with the same two gates missing. It was dequeued and normally cancelled; the always-on heal completed successfully and restored a healthy production state.
• platform#2611 repeatedly re-armed after Renovate rebases until auto-merge was disabled manually.

Root cause

Platform's active organization ruleset Require workflows to pass before merging - EnableAutoMerge still references .github/workflows/enable-auto-merge.yaml from archived devantler-tech/reusable-workflows (repository id 1022337231). The maintained workflow now lives in devantler-tech/actions and contains the fail-closed review/pre-merge gate, but that gate is feature-flagged off by default unless enforce-review-gates or ENFORCE_MERGE_GATES is true.

The ruleset is UI-managed because its repository-property condition is not representable by the current provider schema, so this cannot be corrected safely through the existing Crossplane manifests.

Proposed direction

Update the UI-managed required-workflow ruleset to the maintained devantler-tech/actions/.github/workflows/enable-auto-merge.yaml@main, then enable its review-gate path for ordinary single-author dependency bots in the intended repository-property scope. Preserve the explicit trusted release-bot carve-out from the portfolio merge policy.

Acceptance criteria

• The required-workflow source no longer points at archived reusable-workflows.
• Ordinary Dependabot/Renovate PRs never arm classic auto-merge or enter a merge queue while the current-head green-review or supported CodeRabbit pre-merge gate is missing, stale, failed, mixed, or unreadable.
• A red/unreadable gate actively revokes both classic autoMergeRequest and merge-queue entries.
• Trusted programmed release-bot PRs retain their documented review/pre-merge carve-out.
• A live bot PR proves the fail-closed state before gates are green and the permitted handoff after they become green.
• The UI-managed mutation and its custom-property scope are documented, with migration back to GitOps linked to Adopt remaining rulesets declaratively as provider-upjet-github gains support (10 org rulesets + push + Actions policies) #69.

Related implementation: devantler-tech/actions#548.

[coderabbitai]

🔗 Related PRs

#74 - feat(rulesets): require the CodeRabbit review status check org-wide [merged]
#75 - revert(rulesets): drop the provider-uncreatable CodeRabbit required-check ruleset [merged]
#80 - ci: repoint reusable workflows to devantler-tech/actions v8.0.0 [merged]
#88 - feat: archived-repo pattern + reusable-workflows archival groundwork [merged]
#90 - feat: archive the reusable-workflows repository (phase 2) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

Bots are supposed to be allowed to auto-merge without satisfying the reviewer gate.