ci: auto-merge release-please PRs

.github/workflows/auto-merge-release.yml

@@ -0,0 +1,45 @@
+name: auto-merge-release-pr
+
+on:
+  workflow_run:
+    workflows: ["Release Please"]
+    types: [completed]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  find-release-pr:
+    name: Find release PR
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-24.04
+    outputs:
+      pr_number: ${{ steps.find.outputs.pr_number }}
+    steps:
+      # The "Release Please" workflow's generate-readmes job pushes an extra
+      # commit (regenerated READMEs) to the release PR branch after the PR is
+      # opened. Waiting for the whole workflow run to finish (workflow_run)
+      # instead of reacting directly to pull_request events avoids merging
+      # before that commit lands.
+      - name: Find open release-please PR
+        id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          pr_number="$(gh pr list --repo "$GITHUB_REPOSITORY" \
+            --head release-please--branches--main \
+            --state open \
+            --json number,author,labels \
+            --jq '[.[] | select(.author.login == "github-actions[bot]" and ([.labels[].name] | contains(["autorelease: pending"])))][0].number // 0')"
+          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
+
+  automerge:
+    name: Auto-merge release PR
+    needs: find-release-pr
+    if: needs.find-release-pr.outputs.pr_number != '0'
+    uses: nullplatform/actions-nullplatform/.github/workflows/auto-merge-release.yml@main
+    with:
+      pr_number: ${{ fromJson(needs.find-release-pr.outputs.pr_number) }}
+    secrets:
+      app-id: ${{ secrets.APP_RELEASE_ID }}
+      app-private-key: ${{ secrets.APP_RELEASE_PRIVATE_KEY }}