From 993bd78d3be694282c03ba189dab3a500d2b10fe Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 24 Aug 2026 11:11:22 -0400
Subject: [PATCH 1/4] fix(ci): enqueue merge queue as seahaven-bot

---
 .github/workflows/auto-merge.yaml | 41 ++++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index f0ef235..633887a 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -4,14 +4,15 @@ on:
   pull_request:
     types: [opened, ready_for_review, reopened, synchronize]
     branches: [main]
+  pull_request_review:
+    types: [submitted]
 
 concurrency:
   group: enable-auto-merge-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   enable:
@@ -20,25 +21,47 @@ jobs:
       && github.event.pull_request.head.repo.full_name == github.repository
       && github.event.pull_request.user.login != 'dependabot[bot]'
       && github.event.pull_request.user.login != 'renovate[bot]'
+      && (github.event_name != 'pull_request_review' || github.event.review.state == 'approved')
     runs-on: ubuntu-latest
     steps:
-      - name: Enable squash auto-merge
+      - name: Mint seahaven-bot token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.SEAHAVEN_BOT_APP_ID }}
+          private-key: ${{ secrets.SEAHAVEN_BOT_PRIVATE_KEY }}
+          owner: Sea-Haven-Industries
+          repositories: ${{ github.event.repository.name }}
+
+      - name: Enqueue or arm auto-merge
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PR: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
+          PR_NODE_ID: ${{ github.event.pull_request.node_id }}
         run: |
           set -euo pipefail
-          if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
-            echo "auto-merge already enabled"
+          in_queue="$(gh api graphql -f query='query($id:ID!) { node(id:$id) { ... on PullRequest { isInMergeQueue } } }' -f id="$PR_NODE_ID" --jq '.data.node.isInMergeQueue')"
+          if [ "$in_queue" = "true" ]; then
+            echo "already in merge queue"
             exit 0
           fi
-          if ! out=$(gh pr merge "$PR" --repo "$REPO" --auto 2>&1); then
-            echo "$out"
+          set +e
+          out="$(gh api graphql -f query='mutation($id:ID!) { enqueuePullRequest(input:{pullRequestId:$id}) { mergeQueueEntry { state } } }' -f id="$PR_NODE_ID" 2>&1)"
+          status=$?
+          set -e
+          if [ "$status" -eq 0 ]; then
+            printf '%s\n' "$out"
+            exit 0
+          fi
+          echo "$out"
+          # Re-arm as seahaven-bot. A leftover GITHUB_TOKEN auto-merge would
+          # enqueue without starting merge_group.
+          gh pr merge "$PR" --repo "$REPO" --disable-auto || true
+          if ! gh pr merge "$PR" --repo "$REPO" --auto; then
             if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
               echo "auto-merge already enabled"
               exit 0
             fi
             exit 1
           fi
-          printf '%s\n' "$out"

From 831261a760ba0ff816b340f7a4996737da57ebac Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 24 Aug 2026 11:25:05 -0400
Subject: [PATCH 2/4] fix(ci): limit seahaven-bot enqueue to PRs targeting main

---
 .github/workflows/auto-merge.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index 633887a..7a6e8a1 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -18,6 +18,7 @@ jobs:
   enable:
     if: >-
       github.event.pull_request.draft == false
+      && github.event.pull_request.base.ref == 'main'
       && github.event.pull_request.head.repo.full_name == github.repository
       && github.event.pull_request.user.login != 'dependabot[bot]'
       && github.event.pull_request.user.login != 'renovate[bot]'

From 482d6a532cd1c115b63ff5c6900f06bdc4afce2b Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 24 Aug 2026 11:51:14 -0400
Subject: [PATCH 3/4] fix(ci): keep enqueue across review chatter

---
 .github/workflows/auto-merge.yaml | 71 +++++++++++++++++++++++++------
 1 file changed, 57 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index 7a6e8a1..22f762b 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -7,10 +7,6 @@ on:
   pull_request_review:
     types: [submitted]
 
-concurrency:
-  group: enable-auto-merge-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
@@ -24,6 +20,9 @@ jobs:
       && github.event.pull_request.user.login != 'renovate[bot]'
       && (github.event_name != 'pull_request_review' || github.event.review.state == 'approved')
     runs-on: ubuntu-latest
+    concurrency:
+      group: enable-auto-merge-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
     steps:
       - name: Mint seahaven-bot token
         id: app-token
@@ -42,13 +41,33 @@ jobs:
           PR_NODE_ID: ${{ github.event.pull_request.node_id }}
         run: |
           set -euo pipefail
-          in_queue="$(gh api graphql -f query='query($id:ID!) { node(id:$id) { ... on PullRequest { isInMergeQueue } } }' -f id="$PR_NODE_ID" --jq '.data.node.isInMergeQueue')"
-          if [ "$in_queue" = "true" ]; then
+          BOT_LOGIN='seahaven-bot[bot]'
+          GQL_STATE="query(\$id:ID!) { node(id:\$id) { ... on PullRequest { isInMergeQueue autoMergeRequest { mergeMethod enabledBy { login } } } } }"
+
+          pr_json() {
+            gh api graphql -f query="$GQL_STATE" -f id="$PR_NODE_ID" "$@"
+          }
+
+          in_queue() {
+            pr_json --jq '.data.node.isInMergeQueue'
+          }
+
+          enabled_by() {
+            pr_json --jq -r '.data.node.autoMergeRequest.enabledBy.login // ""'
+          }
+
+          armed_as_bot() {
+            by="$(enabled_by)"
+            [ "$by" = "$BOT_LOGIN" ] || [ "$by" = "seahaven-bot" ]
+          }
+
+          if [ "$(in_queue)" = "true" ]; then
             echo "already in merge queue"
             exit 0
           fi
+
           set +e
-          out="$(gh api graphql -f query='mutation($id:ID!) { enqueuePullRequest(input:{pullRequestId:$id}) { mergeQueueEntry { state } } }' -f id="$PR_NODE_ID" 2>&1)"
+          out="$(gh api graphql -f query="mutation(\$id:ID!) { enqueuePullRequest(input:{pullRequestId:\$id}) { mergeQueueEntry { state } } }" -f id="$PR_NODE_ID" 2>&1)"
           status=$?
           set -e
           if [ "$status" -eq 0 ]; then
@@ -56,13 +75,37 @@ jobs:
             exit 0
           fi
           echo "$out"
+
           # Re-arm as seahaven-bot. A leftover GITHUB_TOKEN auto-merge would
-          # enqueue without starting merge_group.
-          gh pr merge "$PR" --repo "$REPO" --disable-auto || true
-          if ! gh pr merge "$PR" --repo "$REPO" --auto; then
-            if [ "$(gh pr view "$PR" --repo "$REPO" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then
-              echo "auto-merge already enabled"
-              exit 0
+          # enqueue without starting merge_group. Do not treat an unknown
+          # autoMergeRequest as success.
+          by="$(enabled_by)"
+          if [ -n "$by" ]; then
+            set +e
+            disable_out="$(gh pr merge "$PR" --repo "$REPO" --disable-auto 2>&1)"
+            set -e
+            echo "$disable_out"
+            by="$(enabled_by)"
+            if [ -n "$by" ]; then
+              echo "failed to disable auto-merge (enabledBy=$by)"
+              exit 1
             fi
-            exit 1
           fi
+
+          set +e
+          arm_out="$(gh pr merge "$PR" --repo "$REPO" --auto 2>&1)"
+          arm_status=$?
+          set -e
+          printf '%s\n' "$arm_out"
+
+          if [ "$(in_queue)" = "true" ]; then
+            echo "in merge queue"
+            exit 0
+          fi
+          if armed_as_bot; then
+            echo "auto-merge armed as seahaven-bot"
+            exit 0
+          fi
+          by="$(enabled_by)"
+          echo "auto-merge not armed as seahaven-bot (enabledBy=${by:-none} arm_status=$arm_status)"
+          exit 1

From 07d7292e83cf0ee0883ad6158f54058526c8e6fd Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 24 Aug 2026 12:06:50 -0400
Subject: [PATCH 4/4] fix(ci): fix seahaven-bot actor lookup after enqueue

---
 .github/workflows/auto-merge.yaml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index 22f762b..d725fce 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -53,7 +53,7 @@ jobs:
           }
 
           enabled_by() {
-            pr_json --jq -r '.data.node.autoMergeRequest.enabledBy.login // ""'
+            pr_json --jq '.data.node.autoMergeRequest.enabledBy.login // ""'
           }
 
           armed_as_bot() {
@@ -76,6 +76,15 @@ jobs:
           fi
           echo "$out"
 
+          if [ "$(in_queue)" = "true" ]; then
+            echo "in merge queue"
+            exit 0
+          fi
+          if armed_as_bot; then
+            echo "auto-merge already armed as seahaven-bot"
+            exit 0
+          fi
+
           # Re-arm as seahaven-bot. A leftover GITHUB_TOKEN auto-merge would
           # enqueue without starting merge_group. Do not treat an unknown
           # autoMergeRequest as success.