fix(dependabot): add auto-merge preflight check

.github/workflows/reusable-pr-dependabot-automerge.yml

@@ -36,6 +36,21 @@ jobs:
           app-id: ${{ inputs.skeleton_update_app_id }}
           private-key: ${{ secrets.LAUNCH_SKELETON_UPDATE_KEY }}
 
+      - name: Check auto-merge is enabled
+        env:
+          GH_TOKEN: ${{ steps.get-app-token.outputs.token }}
+        run: |
+          allow_auto_merge="$(gh api graphql \
+            -f query='query($owner:String!,$name:String!){repository(owner:$owner,name:$name){autoMergeAllowed}}' \
+            -f owner="${GITHUB_REPOSITORY_OWNER}" \
+            -f name="${GITHUB_REPOSITORY#*/}" \
+            --jq '.data.repository.autoMergeAllowed')"
+
+          if [[ "$allow_auto_merge" != "true" ]]; then
+            echo "::error::GitHub auto-merge is not enabled for this repository. Enable 'Allow auto-merge' in Settings > General > Pull Requests."
+            exit 1
+          fi
+
       - name: Enable auto-merge
         env:
           GITHUB_TOKEN: ${{ steps.get-app-token.outputs.token }}

docs/reusable-pr-dependabot-automerge.md

@@ -6,6 +6,16 @@ This workflow only runs when the PR actor is `dependabot[bot]`. For all other ac
 
 A GitHub App token is used to perform the merge rather than `GITHUB_TOKEN`. This ensures that the resulting push to the default branch is attributed to the GitHub App rather than `dependabot[bot]`, which allows downstream workflows (such as a release process) to be triggered as expected. When Dependabot performs the merge directly, GitHub suppresses re-triggering of actions to prevent infinite loops.
 
+## Prerequisite
+
+GitHub auto-merge must be enabled on the repository using this workflow.
+
+Go to:
+
+`Settings > General > Pull Requests > Allow auto-merge`
+
+If auto-merge is disabled, the workflow stops before attempting the merge and reports a clear configuration error.
+
 ## Usage
 
 Add the following workflow to your repository (suggested name: `.github/workflows/pr-dependabot-automerge.yml`):