From 87190028f656e21ee46518b4f1d1fe8f7d5b9b7f Mon Sep 17 00:00:00 2001
From: callumalpass <callumalpass@gmail.com>
Date: Thu, 5 Nov 2026 16:21:53 +1100
Subject: [PATCH] Merge the automated Connect release update when Site checks
 pass

Callum decided Downloads updates should merge automatically. A workflow_run job merges only the release App's update pull request, at the exact checked head, and only when it changes the two release files. No repository merge settings change.
---
 .github/workflows/merge-connect-release.yml | 70 +++++++++++++++++++++
 README.md                                   |  7 +++
 2 files changed, 77 insertions(+)
 create mode 100644 .github/workflows/merge-connect-release.yml

diff --git a/.github/workflows/merge-connect-release.yml b/.github/workflows/merge-connect-release.yml
new file mode 100644
index 0000000..95d0d99
--- /dev/null
+++ b/.github/workflows/merge-connect-release.yml
@@ -0,0 +1,70 @@
+name: Merge Connect release update
+
+# Merges only the automated Downloads pull request, after Site checks pass on
+# its exact head. Every other pull request keeps its normal merge path.
+on:
+  workflow_run:
+    workflows: [Site checks]
+    types: [completed]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: connect-release-merge
+  cancel-in-progress: false
+
+jobs:
+  merge:
+    name: Merge verified release update
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      startsWith(github.event.workflow_run.head_branch, 'automation/connect-release-v')
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Create website automation token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.RELEASE_AUTOMATION_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_AUTOMATION_APP_PRIVATE_KEY }}
+          owner: mdbase-dev
+          repositories: mdbase.dev
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Merge the exact checked head
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          BRANCH: ${{ github.event.workflow_run.head_branch }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          fields=number,author,baseRefName,files,headRefOid,isCrossRepository,mergeStateStatus,state,title
+          pr="$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --head "$BRANCH" --json "$fields" --jq '.[0] // empty')"
+          if [ -z "$pr" ]; then
+            echo "No open release update for $BRANCH."
+            exit 0
+          fi
+          if [ "$(jq -r .headRefOid <<<"$pr")" != "$HEAD_SHA" ]; then
+            echo "$BRANCH moved after these checks; its own Site checks run decides."
+            exit 0
+          fi
+          jq -e --arg title "Update Connect downloads to ${BRANCH#automation/connect-release-}" '
+            .author.login == "app/mdbase-dev-release-automation" and
+            .baseRefName == "main" and
+            .isCrossRepository == false and
+            .title == $title and
+            ([.files[].path] | sort) == ["site-sources.json", "src/data/connect-release.json"]
+          ' <<<"$pr" >/dev/null || {
+            echo "This pull request is not an automated release-only update." >&2
+            exit 1
+          }
+          number="$(jq -r .number <<<"$pr")"
+          # main is strict, so a behind branch needs fresh checks on its new head.
+          if [ "$(jq -r .mergeStateStatus <<<"$pr")" = "BEHIND" ]; then
+            gh pr update-branch "$number" --repo "$GITHUB_REPOSITORY"
+            exit 0
+          fi
+          gh pr merge "$number" --repo "$GITHUB_REPOSITORY" --squash --match-head-commit "$HEAD_SHA" --delete-branch
diff --git a/README.md b/README.md
index ee8e445..732f70f 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,13 @@ normal pull request. It never deploys or pushes `main` directly. The same
 workflow can be run manually with a tag to recover from a delayed npm
 publication or failed dispatch.
 
+When `Site checks` passes on that pull request's exact head,
+`.github/workflows/merge-connect-release.yml` merges it, and the merge deploys
+through the normal `main` path. It acts only on a pull request opened by the
+release App on an `automation/connect-release-v*` branch, titled for that tag
+and changing only `site-sources.json` and `src/data/connect-release.json`. Any
+other pull request keeps its normal review and merge path.
+
 The workflow uses a GitHub App configured as `RELEASE_AUTOMATION_CLIENT_ID` and
 `RELEASE_AUTOMATION_APP_PRIVATE_KEY`. Its installation on this repository needs
 only `contents: write` and `pull requests: write`. The App token ensures the