From 527fd757a4102bd84c1c02a9367fe63f05ba8387 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 21 Aug 2026 18:50:19 -0400
Subject: [PATCH 1/4] ci: enable squash auto-merge on ready PRs

---
 .github/workflows/auto-merge.yaml | 32 +++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/auto-merge.yaml

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
new file mode 100644
index 0000000..a42db32
--- /dev/null
+++ b/.github/workflows/auto-merge.yaml
@@ -0,0 +1,32 @@
+name: Enable auto-merge
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened, synchronize]
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  enable:
+    if: >-
+      github.event.pull_request.draft == false
+      && github.event.pull_request.head.repo.full_name == github.repository
+      && github.event.pull_request.user.login != 'dependabot[bot]'
+      && github.event.pull_request.user.login != 'renovate[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enable squash auto-merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
+            echo "auto-merge already enabled"
+            exit 0
+          fi
+          gh pr merge "$PR" --repo "$REPO" --auto

From 7a943294683a93c8fdfc1778219ed5fe3efc7267 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 21 Aug 2026 19:15:14 -0400
Subject: [PATCH 2/4] fix(ci): serialize auto-merge enable and ignore
 already-enabled

---
 .github/workflows/auto-merge.yaml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index a42db32..f0ef235 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -5,6 +5,10 @@ on:
     types: [opened, ready_for_review, reopened, synchronize]
     branches: [main]
 
+concurrency:
+  group: enable-auto-merge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: write
   pull-requests: write
@@ -29,4 +33,12 @@ jobs:
             echo "auto-merge already enabled"
             exit 0
           fi
-          gh pr merge "$PR" --repo "$REPO" --auto
+          if ! out=$(gh pr merge "$PR" --repo "$REPO" --auto 2>&1); then
+            echo "$out"
+            if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
+              echo "auto-merge already enabled"
+              exit 0
+            fi
+            exit 1
+          fi
+          printf '%s\n' "$out"

From 600be065241bb93d3f4353421af5ce9fa19ddd2c Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 21 Aug 2026 20:24:43 -0400
Subject: [PATCH 3/4] fix(ci): enqueue merge queue as seahaven-bot

---
 .github/workflows/auto-merge.yaml | 38 +++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index f0ef235..a8a074a 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -4,14 +4,15 @@ on:
   pull_request:
     types: [opened, ready_for_review, reopened, synchronize]
     branches: [main]
+  pull_request_review:
+    types: [submitted]
 
 concurrency:
   group: enable-auto-merge-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   enable:
@@ -20,25 +21,44 @@ jobs:
       && github.event.pull_request.head.repo.full_name == github.repository
       && github.event.pull_request.user.login != 'dependabot[bot]'
       && github.event.pull_request.user.login != 'renovate[bot]'
+      && (github.event_name != 'pull_request_review' || github.event.review.state == 'approved')
     runs-on: ubuntu-latest
     steps:
-      - name: Enable squash auto-merge
+      - name: Mint seahaven-bot token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.SEAHAVEN_BOT_APP_ID }}
+          private-key: ${{ secrets.SEAHAVEN_BOT_PRIVATE_KEY }}
+          owner: Sea-Haven-Industries
+          repositories: ${{ github.event.repository.name }}
+
+      - name: Enqueue or arm auto-merge
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PR: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
+          PR_NODE_ID: ${{ github.event.pull_request.node_id }}
         run: |
           set -euo pipefail
-          if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
-            echo "auto-merge already enabled"
+          in_queue="$(gh api graphql -f query='query($id:ID!) { node(id:$id) { ... on PullRequest { isInMergeQueue } } }' -f id="$PR_NODE_ID" --jq '.data.node.isInMergeQueue')"
+          if [ "$in_queue" = "true" ]; then
+            echo "already in merge queue"
             exit 0
           fi
-          if ! out=$(gh pr merge "$PR" --repo "$REPO" --auto 2>&1); then
-            echo "$out"
+          set +e
+          out="$(gh api graphql -f query='mutation($id:ID!) { enqueuePullRequest(input:{pullRequestId:$id}) { mergeQueueEntry { state } } }' -f id="$PR_NODE_ID" 2>&1)"
+          status=$?
+          set -e
+          if [ "$status" -eq 0 ]; then
+            printf '%s\n' "$out"
+            exit 0
+          fi
+          echo "$out"
+          if ! gh pr merge "$PR" --repo "$REPO" --auto; then
             if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
               echo "auto-merge already enabled"
               exit 0
             fi
             exit 1
           fi
-          printf '%s\n' "$out"

From bf6f9a3b289e69723532f6afc428aab2162c6189 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 21 Aug 2026 20:25:33 -0400
Subject: [PATCH 4/4] fix(ci): re-arm auto-merge as seahaven-bot after failed
 enqueue

---
 .github/workflows/auto-merge.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index a8a074a..633887a 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -55,6 +55,9 @@ jobs:
             exit 0
           fi
           echo "$out"
+          # Re-arm as seahaven-bot. A leftover GITHUB_TOKEN auto-merge would
+          # enqueue without starting merge_group.
+          gh pr merge "$PR" --repo "$REPO" --disable-auto || true
           if ! gh pr merge "$PR" --repo "$REPO" --auto; then
             if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
               echo "auto-merge already enabled"