Enable Auto-Merge fails on PRs that modify workflow files (App token lacks `workflows` permission)

[devantler]

🤖 Generated by the Daily AI Engineer

Problem

The 🔀 Enable Auto-Merge workflow's arming step fails hard on any PR that modifies a file under .github/workflows/:

GraphQL: Pull request refusing to allow a GitHub App to create or update workflow `.github/workflows/ci.yaml` without `workflows` permission (enablePullRequestAutoMerge)

Live case: platform#2584 (touches ci.yaml) — the App approval succeeds, then enablePullRequestAutoMerge is refused and the step exits 1, leaving a permanently red auto-merge check on an otherwise-green promoted PR (run 29179566420, 2026-07-12). Any workflow-touching PR in any consumer repo hits this.

Proposed direction

Two complementary fixes at the root cause:

1. Request permission-workflows: write in the create-github-app-token mint used by this workflow (the installation already carries workflows:write org-wide), so arming succeeds on workflow-touching PRs.
2. Degrade gracefully as the existing self-approval carve-out does: if arming is still refused with the without \workflows` permission` error, emit a warning and exit 0 (the PR simply isn't auto-armed; a trusted human merges manually) instead of failing the check.

Rough size

Small — one token-mint input + one error-branch in the arming step of .github/workflows/enable-auto-merge.yaml. Should be tested both states (workflow-touching PR and normal PR) per the feature-flag/both-states discipline.

[coderabbitai]

🔗 Related PRs

#402 - fix(enable-auto-merge-on-pr): retry-harden the gh API/merge network calls [merged]
#405 - fix(approve-pr,upsert-issue): retry-harden unguarded gh network calls [merged]
#412 - ci: skip the suite on the release-commit push to dodge the self-pin tag race [merged]
#427 - fix: resolve first-party self-references at the same commit [merged]
#484 - fix(create-issues-from-todos): retry-harden raw.githubusercontent.com fetches [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!