ci: enforce successful CI before auto-merge #114

Goal

Auto-merge must wait for successful CI on the latest proposed commit before merging into main. A failed, pending, cancelled, missing, or unexpectedly skipped required result must block the merge.

Current setup

Read-only inspection found repository auto-merge disabled.

main already requires Build without registering a runner from GitHub Actions, with administrator enforcement enabled. The protection has strict: false, and repository auto-merge is disabled. Preserve that check identity and the existing build, convention, secret-scan, and validation coverage. Scope this issue to ci-fleet's own pull requests.

Prerequisite

Branch protection is available. Enable native auto-merge only after verifying the existing required check and administrator enforcement, and require the PR branch to be up to date with its base.

Acceptance criteria

• Record the exact required check names and expected publishing app. Use existing checks where they fully cover required CI; add a final aggregation job only where needed.
• Ensure every eligible pull request runs the required validation. A final gate must verify all expected jobs/shards and reject incomplete or unexpectedly skipped coverage.
• Configure active rulesets or branch protection for main, require a pull request, and require the branch to be up to date before merging. Preserve existing approval requirements and unrelated protections.
• Apply CI requirements to maintainers, administrators, and merge bots without bypass exceptions. Bind required results to the expected publishing app.
• Enable repository auto-merge after enforcement is active. Verify a pending or intentionally failing required check prevents merging, a new commit invalidates previous success, and successful current-head CI satisfies the check requirement.
• Record before/after settings and verification evidence. Keep the issue open while any capability prerequisite or enforcement proof is outstanding.

Scope

This issue concerns this repository's CI and merge settings. It does not authorize plan purchases, visibility changes, credential changes, live host work, deployment, release publication, or unrelated review-policy changes. Issue creation does not activate auto-merge or authorize merging an existing PR.

Reconciliation with local validation, issue #135

Engine implementation merged through #137 as 67beabbddaad73c19f15bc3baa227779bc88dc96, with reviewed tree equal to a8552da5c902c54c0d78b19e6f093e2e96482f62. Required exact-head CI passed and the complete standalone run passed all eight stages with no skips and all 68 verification checks. Independent archive/log/isolation/cleanup readback is recorded at #135 (comment) . This establishes code integration and functional parity; signed host adoption, recovery and settings cutover remain separate and unclaimed.

Do not enable auto-merge or remove the current required check as a side effect of this implementation. The existing engine check identity and trusted-main guards remain. Configuration-template hosted execution is default-off convenience and must not become a missing/skipped required-check deadlock. A policy requiring hosted evidence is an explicit additional operator choice.

Before cutover, choose and review the authoritative local-evidence enforcement and any independently trusted status publication needed for native auto-merge. Native branch protection cannot verify an arbitrary local success file or PR comment. Retain exact-head review, incomplete-result rejection, full local parity, compatible recovery and tested rollback/reinstall. Review the selected required-check publishing identity and manual/native auto-merge behavior deliberately; no settings change is included in PR #137.