feat: add guarded auto merge for optimization PRs

Author: Pigbibi

.github/workflows/auto_merge_optimization_pr.yml

@@ -0,0 +1,94 @@
+name: Auto Merge Optimization PR
+
+"on":
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+jobs:
+  auto-merge:
+    if: github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'automation/monthly-optimization-issue-')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Resolve automation PR
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mkdir -p data/output/auto_merge
+          BRANCH_NAME="${{ github.event.workflow_run.head_branch }}"
+          PR_NUMBER=$(gh pr list --state open --head "${BRANCH_NAME}" --json number --jq '.[0].number // empty')
+          if [ -z "${PR_NUMBER}" ]; then
+            echo "No open automation PR found for ${BRANCH_NAME}." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Evaluate merge eligibility
+        id: merge_guard
+        if: steps.pr.outputs.pr_number != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr view "${{ steps.pr.outputs.pr_number }}" --json number,isDraft,body,url,files > data/output/auto_merge/pr.json
+          python3 - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          from scripts.prepare_auto_optimization_pr import evaluate_changed_files
+
+          pr = json.loads(Path("data/output/auto_merge/pr.json").read_text(encoding="utf-8"))
+          body = pr.get("body") or ""
+          changed_files = [item.get("path", "") for item in pr.get("files", [])]
+          guard = evaluate_changed_files(changed_files)
+          has_marker = "<!-- auto-optimization-pr:issue-" in body
+          task_level_allowed = "Task-level auto-merge eligible: `yes`" in body
+          should_merge = has_marker and task_level_allowed and not pr.get("isDraft") and guard["allowed"]
+          if not has_marker:
+              reason = "missing_marker"
+          elif not task_level_allowed:
+              reason = "task_level_guard"
+          elif pr.get("isDraft"):
+              reason = "draft_pr"
+          elif not guard["allowed"]:
+              reason = "sensitive_changed_files"
+          else:
+              reason = "ready"
+
+          summary_lines = [
+              "## Auto-Merge Gate",
+              f"- PR: {pr['url']}",
+              f"- Draft: `{ 'yes' if pr.get('isDraft') else 'no' }`",
+              f"- Task-level auto-merge eligible: `{ 'yes' if task_level_allowed else 'no' }`",
+              f"- Sensitive files touched: `{len(guard['blocked_files'])}`",
+              f"- Final merge decision: `{ 'merge' if should_merge else 'skip' }`",
+              f"- Reason: `{reason}`",
+          ]
+          if guard["blocked_files"]:
+              summary_lines.append("")
+              summary_lines.append("### Sensitive changed files")
+              summary_lines.extend(f"- `{path}`" for path in guard["blocked_files"])
+          Path("data/output/auto_merge/summary.md").write_text("\n".join(summary_lines).strip() + "\n", encoding="utf-8")
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              print(f"should_merge={'true' if should_merge else 'false'}", file=output)
+              print(f"reason={reason}", file=output)
+              print(f"pr_url={pr['url']}", file=output)
+          PY
+
+      - name: Append merge summary
+        if: steps.pr.outputs.pr_number != ''
+        run: cat data/output/auto_merge/summary.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Merge automation PR
+        if: steps.merge_guard.outputs.should_merge == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr merge "${{ steps.pr.outputs.pr_number }}" --rebase --delete-branch

.github/workflows/auto_optimization_pr.yml

@@ -93,9 +93,7 @@ jobs:
       - name: Prepare auto optimization payload
         id: auto_payload
         run: |
-          python3 scripts/prepare_auto_optimization_pr.py \
-            --issue-context-file data/output/auto_optimization/issue_context.json \
-            --output-dir data/output/auto_optimization >> "$GITHUB_OUTPUT"
+          python3 scripts/prepare_auto_optimization_pr.py             --issue-context-file data/output/auto_optimization/issue_context.json             --output-dir data/output/auto_optimization >> "$GITHUB_OUTPUT"
 
       - name: Append task summary
         run: cat data/output/auto_optimization/task_summary.md >> "$GITHUB_STEP_SUMMARY"
@@ -115,7 +113,7 @@ jobs:
           if [ -f data/output/auto_optimization/skip_reason.txt ]; then
             cat data/output/auto_optimization/skip_reason.txt >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "No eligible low-risk auto-pr-safe tasks were found; skipping draft PR generation." >> "$GITHUB_STEP_SUMMARY"
+            echo "No eligible low-risk auto-pr-safe tasks were found; skipping automation." >> "$GITHUB_STEP_SUMMARY"
           fi
 
       - name: Prepare automation branch
@@ -137,15 +135,17 @@ jobs:
           claude_args: --max-turns 8
           prompt: |
             Do not ask for additional approval.
-            Do not create a pull request yourself. The workflow will handle git, draft PR creation, and CI dispatch.
+            Do not create a pull request yourself. The workflow will handle git, PR creation, CI dispatch, and post-CI merge.
             Only implement the low-risk tasks explicitly marked `[auto-pr-safe]`.
             Ignore any medium-risk or high-risk tasks.
             You are working inside CryptoStrategies, the shared strategy-logic repository.
-            Prefer minimal changes in shared helpers, documentation, and tests.
-            Avoid changing shared production strategy behavior unless the task remains clearly low-risk and local.
-            If the selected low-risk tasks do not map cleanly to this repository, leave the working tree unchanged.
+            Prefer minimal changes in documentation, report wording, validation, shadow/challenger plumbing, instrumentation, and tests.
+            Do not change production selector logic or ranking behavior from this issue alone.
+            If an eligible task is marked `experiment-only`, keep the change non-production.
+            Never edit files under src/ in this automation step.
+            If the selected low-risk tasks already appear implemented on the current main branch, leave the working tree unchanged.
             Do not use Bash in this workflow. Limit yourself to file edits and repository-local reasoning.
-            The workflow will run CI after the draft PR is created.
+            The workflow will run CI after the PR is created.
 
             ## Issue Title
             ${{ steps.issue_context.outputs.issue_title }}
@@ -163,32 +163,107 @@ jobs:
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Evaluate merge guardrails
+        id: merge_guard
+        if: steps.changes.outputs.has_changes == 'true'
+        run: |
+          git diff --name-only --relative > data/output/auto_optimization/changed_files.txt
+          python3 - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          from scripts.prepare_auto_optimization_pr import evaluate_changed_files
+
+          output_dir = Path("data/output/auto_optimization")
+          payload = json.loads((output_dir / "payload.json").read_text(encoding="utf-8"))
+          changed_files = [
+              line.strip()
+              for line in (output_dir / "changed_files.txt").read_text(encoding="utf-8").splitlines()
+              if line.strip()
+          ]
+          guard = evaluate_changed_files(changed_files)
+          merge_ready = bool(payload.get("task_level_auto_merge_allowed")) and bool(guard["allowed"])
+          if not payload.get("task_level_auto_merge_allowed"):
+              reason = "task_level_guard"
+          elif not guard["allowed"]:
+              reason = "sensitive_changed_files"
+          else:
+              reason = "ready"
+
+          summary_lines = [
+              "## Merge Guardrails",
+              f"- Task-level auto-merge eligible: `{ 'yes' if payload.get('task_level_auto_merge_allowed') else 'no' }`",
+              f"- Changed files reviewed: `{len(changed_files)}`",
+              f"- Sensitive files touched: `{len(guard['blocked_files'])}`",
+          ]
+          if guard["blocked_files"]:
+              summary_lines.append("")
+              summary_lines.append("### Sensitive changed files")
+              summary_lines.extend(f"- `{path}`" for path in guard["blocked_files"])
+          if merge_ready:
+              summary_lines.extend(["", "Ready PR is allowed; the follow-up auto-merge workflow may merge after CI succeeds."])
+          else:
+              summary_lines.extend(["", f"PR will stay draft. Guard reason: `{reason}`"])
+
+          (output_dir / "guard_summary.md").write_text("\n".join(summary_lines).strip() + "\n", encoding="utf-8")
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              print(f"merge_ready={'true' if merge_ready else 'false'}", file=output)
+              print(f"guard_reason={reason}", file=output)
+              print(f"blocked_file_count={len(guard['blocked_files'])}", file=output)
+          PY
+
+      - name: Append merge guard summary
+        if: steps.changes.outputs.has_changes == 'true'
+        run: cat data/output/auto_optimization/guard_summary.md >> "$GITHUB_STEP_SUMMARY"
+
       - name: Commit and push automation branch
         if: steps.changes.outputs.has_changes == 'true'
         run: |
           git add -A
           git commit -m "${{ steps.auto_payload.outputs.commit_message }}"
           git push --force-with-lease origin "${{ steps.auto_payload.outputs.branch_name }}"
 
-      - name: Create or update draft PR
-        id: draft_pr
+      - name: Create or update automation PR
+        id: automation_pr
         if: steps.changes.outputs.has_changes == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           BRANCH_NAME="${{ steps.auto_payload.outputs.branch_name }}"
           PR_TITLE="${{ steps.auto_payload.outputs.pr_title }}"
           PR_BODY_FILE="${{ steps.auto_payload.outputs.pr_body_file }}"
+          MERGE_READY="${{ steps.merge_guard.outputs.merge_ready }}"
           EXISTING_PR_NUMBER=$(gh pr list --state open --head "${BRANCH_NAME}" --json number --jq '.[0].number // empty')
           if [ -n "${EXISTING_PR_NUMBER}" ]; then
             gh pr edit "${EXISTING_PR_NUMBER}" --title "${PR_TITLE}" --body-file "${PR_BODY_FILE}"
+            if [ "${MERGE_READY}" = "true" ]; then
+              gh pr ready "${EXISTING_PR_NUMBER}" || true
+              PR_STATE="ready_for_review"
+            else
+              gh pr ready "${EXISTING_PR_NUMBER}" --undo || true
+              PR_STATE="draft"
+            fi
             PR_URL=$(gh pr view "${EXISTING_PR_NUMBER}" --json url --jq '.url')
+            PR_NUMBER="${EXISTING_PR_NUMBER}"
             echo "pr_action=updated" >> "$GITHUB_OUTPUT"
           else
-            PR_URL=$(gh pr create --draft --base main --head "${BRANCH_NAME}" --title "${PR_TITLE}" --body-file "${PR_BODY_FILE}")
+            CREATE_ARGS=(--base main --head "${BRANCH_NAME}" --title "${PR_TITLE}" --body-file "${PR_BODY_FILE}")
+            if [ "${MERGE_READY}" != "true" ]; then
+              CREATE_ARGS=(--draft "${CREATE_ARGS[@]}")
+            fi
+            PR_URL=$(gh pr create "${CREATE_ARGS[@]}")
+            PR_NUMBER=$(gh pr view "${PR_URL}" --json number --jq '.number')
+            if [ "${MERGE_READY}" = "true" ]; then
+              PR_STATE="ready_for_review"
+            else
+              PR_STATE="draft"
+            fi
             echo "pr_action=created" >> "$GITHUB_OUTPUT"
           fi
           echo "pr_url=${PR_URL}" >> "$GITHUB_OUTPUT"
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+          echo "pr_state=${PR_STATE}" >> "$GITHUB_OUTPUT"
 
       - name: Dispatch CI workflow on automation branch
         if: steps.changes.outputs.has_changes == 'true'
@@ -202,10 +277,15 @@ jobs:
           if [ "${{ steps.changes.outputs.has_changes }}" = "true" ]; then
             {
               echo ""
-              echo "## Draft PR Result"
-              echo "- Draft PR ${{ steps.draft_pr.outputs.pr_action }}: ${{ steps.draft_pr.outputs.pr_url }}"
+              echo "## Automation PR Result"
+              echo "- PR ${{ steps.automation_pr.outputs.pr_action }}: ${{ steps.automation_pr.outputs.pr_url }}"
+              echo "- PR state: `${{ steps.automation_pr.outputs.pr_state }}`"
+              echo "- Guard reason: `${{ steps.merge_guard.outputs.guard_reason }}`"
               echo "- CI workflow dispatched on branch: `${{ steps.auto_payload.outputs.branch_name }}`"
             } >> "$GITHUB_STEP_SUMMARY"
+            if [ "${{ steps.merge_guard.outputs.merge_ready }}" = "true" ]; then
+              echo "Auto-merge will be handled only after a successful CI workflow run." >> "$GITHUB_STEP_SUMMARY"
+            fi
           else
             echo "No code changes were produced for the selected low-risk tasks." >> "$GITHUB_STEP_SUMMARY"
           fi