ci: improve merge-approved-pr.yml

[HowardBraham]

• Adds reusable-workflow inputs:

  • merge-method (merge default, the workflow now supports squash)
  • verify-version-bump (boolean input, default false)

• Hardens all inputs used in bash or script to be env vars

• If verify-version-bump is true, then verify that

  • the only change is in package.json
  • the only line changed is "version"
  • the version change is a valid semver bump

---

Note

Medium Risk
Changes CI automation that can merge PRs, including new gating logic and squash support; misconfiguration or token permission issues could cause unintended merges or blocked releases.

Overview
Refactors the merge-approved-pr reusable workflow into a new composite action (.github/actions/merge-approved-pr) and simplifies the workflow to delegate to it (marked deprecated).

The action adds configurable merge-method (merge/squash), hardens input handling by passing values through env vars, and optionally enforces a version-bump-only policy by validating that the PR changes only package.json and only the version line with a valid semver +1 bump before allowing the merge.

^{Written by Cursor Bugbot for commit ad58d2d. This will update automatically on new commits. Configure here.}

[HowardBraham]

Going with a different solution to this issue

[Copilot]

Pull request overview

This PR enhances the reusable merge-approved-pr.yml workflow with additional configuration options and stricter validation capabilities. It introduces a merge-method input allowing callers to choose between merge commits and squash merges, and adds an optional verify-version-bump feature that validates PRs contain only a valid semantic version bump in package.json. The changes also refactor the workflow to use environment variables consistently across all steps, improving maintainability and reducing direct input references.

Changes:

• Added configurable merge method support (merge or squash) with input validation
• Implemented version bump verification to ensure PRs only change package.json version field with valid semver bumps
• Converted step outputs to workflow-level environment variables for consistent access patterns

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Mrtenz]

Can this be an action, rather than a reusable workflow?

[HowardBraham]

Hah, I literally got halfway into writing it that way and then decided against it. Should it be?

[Mrtenz]

I've updated most workflows to actions a little while ago. Mainly to be able to access github.action_ref and reduce the number of anti patterns in this repo, though I don't think that's relevant for this specific workflow.

Doesn't look like we need any of the workflow features (like matrices, parallelisation) here, so I would prefer using an action.

[HowardBraham]

It's an action now. Should we remove the wrapper stub at .github/workflows/merge-approved-pr.yml?

If we remove it, I think we would have to bump the whole github-tools to v2 because it causes an incompatibility.

[Mrtenz]

Maybe just deprecate it for now, so we don't have to release a new major?

[HowardBraham]

Ah how do we signify a deprecated wrapper stub?

[Mrtenz]

Apparently the deprecation notice is only for actions, not for reusable workflows. 😅 Just a comment on the top of the workflow is fine I think.

[HowardBraham]

Done. Anything else left to do here?

[Mrtenz]

Nope, looks good to me.

[Mrtenz]

Just one more nit.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[cursor]

Version bump rejects package.json in subdirectories

Low Severity

The version-bump check uses an exact match files[0].filename !== 'package.json', so only changes to the repository-root package.json pass. When verify-version-bump is true and the only change is a version bump in a subpackage (e.g., packages/core/package.json), validation incorrectly fails with "PR must only change package.json". GitHub's listFiles API returns the full path in filename, so subdirectory package.json files are rejected.