From e492843cc2372dcc9e2293e8a937ef2432f41bb8 Mon Sep 17 00:00:00 2001
From: Kevin Longe <kevinl@mustardsystems.com>
Date: Mon, 24 Aug 2026 14:14:43 +0100
Subject: [PATCH] fix: use delivery app for auto-merge

---
 .github/workflows/auto-merge.yml | 16 +++++++++++++---
 README.md                        |  9 +++++----
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 4288769..3b7cf7c 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -2,10 +2,11 @@ name: Request Auto-Merge
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
+  pull-requests: read
 
 jobs:
   request-auto-merge:
@@ -15,9 +16,18 @@ jobs:
       !startsWith(github.event.pull_request.head.ref, 'release-please--')
     runs-on: ubuntu-latest
     steps:
+      - name: Create delivery token
+        id: delivery-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.CHIO_DELIVERY_APP_ID }}
+          private-key: ${{ secrets.CHIO_DELIVERY_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+
       - name: Request squash auto-merge
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.delivery-token.outputs.token }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: >-
diff --git a/README.md b/README.md
index 96f604d..74ea887 100644
--- a/README.md
+++ b/README.md
@@ -4,10 +4,11 @@ This repository owns organization-wide GitHub workflow policy.
 
 `auto-merge.yml` requests squash auto-merge for ready, same-repository pull requests. Repository
 rulesets and required checks remain authoritative: GitHub merges only after every required check
-passes. Release Please branches are excluded because each product's release workflow validates and
-merges those pull requests itself.
+passes. It uses an organization-owned GitHub App so the resulting merge can trigger downstream
+delivery workflows. Release Please branches are excluded because each product's release workflow
+validates those pull requests and requests auto-merge itself with the same App identity.
 
 The organization ruleset applies this workflow to Chio Labs public repositories.
 
-Draft and fork-based pull requests are intentionally excluded. Release Please pull requests remain
-owned by each product's release workflow.
+Draft and fork-based pull requests are intentionally excluded. A draft is handled when it becomes
+ready for review. Release Please pull requests remain owned by each product's release workflow.