From b91b364337f0d162db9cf143e20e5d8c073e99d8 Mon Sep 17 00:00:00 2001
From: "jaouad.siouahe" <jaouad.siouahe.auditeur@cnam.fr>
Date: Wed, 9 Sep 2026 21:58:49 +0200
Subject: [PATCH] fix(dependabot): add auto-merge preflight check

---
 .../reusable-pr-dependabot-automerge.yml          | 15 +++++++++++++++
 docs/reusable-pr-dependabot-automerge.md          | 10 ++++++++++
 2 files changed, 25 insertions(+)

diff --git a/.github/workflows/reusable-pr-dependabot-automerge.yml b/.github/workflows/reusable-pr-dependabot-automerge.yml
index 6fffd90..3cce2e9 100644
--- a/.github/workflows/reusable-pr-dependabot-automerge.yml
+++ b/.github/workflows/reusable-pr-dependabot-automerge.yml
@@ -36,6 +36,21 @@ jobs:
           app-id: ${{ inputs.skeleton_update_app_id }}
           private-key: ${{ secrets.LAUNCH_SKELETON_UPDATE_KEY }}
 
+      - name: Check auto-merge is enabled
+        env:
+          GH_TOKEN: ${{ steps.get-app-token.outputs.token }}
+        run: |
+          allow_auto_merge="$(gh api graphql \
+            -f query='query($owner:String!,$name:String!){repository(owner:$owner,name:$name){autoMergeAllowed}}' \
+            -f owner="${GITHUB_REPOSITORY_OWNER}" \
+            -f name="${GITHUB_REPOSITORY#*/}" \
+            --jq '.data.repository.autoMergeAllowed')"
+
+          if [[ "$allow_auto_merge" != "true" ]]; then
+            echo "::error::GitHub auto-merge is not enabled for this repository. Enable 'Allow auto-merge' in Settings > General > Pull Requests."
+            exit 1
+          fi
+
       - name: Enable auto-merge
         env:
           GITHUB_TOKEN: ${{ steps.get-app-token.outputs.token }}
diff --git a/docs/reusable-pr-dependabot-automerge.md b/docs/reusable-pr-dependabot-automerge.md
index f0843b8..e6821fd 100644
--- a/docs/reusable-pr-dependabot-automerge.md
+++ b/docs/reusable-pr-dependabot-automerge.md
@@ -6,6 +6,16 @@ This workflow only runs when the PR actor is `dependabot[bot]`. For all other ac
 
 A GitHub App token is used to perform the merge rather than `GITHUB_TOKEN`. This ensures that the resulting push to the default branch is attributed to the GitHub App rather than `dependabot[bot]`, which allows downstream workflows (such as a release process) to be triggered as expected. When Dependabot performs the merge directly, GitHub suppresses re-triggering of actions to prevent infinite loops.
 
+## Prerequisite
+
+GitHub auto-merge must be enabled on the repository using this workflow.
+
+Go to:
+
+`Settings > General > Pull Requests > Allow auto-merge`
+
+If auto-merge is disabled, the workflow stops before attempting the merge and reports a clear configuration error.
+
 ## Usage
 
 Add the following workflow to your repository (suggested name: `.github/workflows/pr-dependabot-automerge.yml`):