Modernize bot-auto-merge; allow update-lockfile bot merge

.github/actionlint.yaml

@@ -0,0 +1,17 @@
+paths:
+  .github/workflows/*.yml:
+    ignore:
+      # actionlint's bundled metadata for actions/create-github-app-token@v3
+      # predates the "client-id" input added upstream in v3.1.0 (2026-04-11),
+      # so it still reports app-id as required and client-id as unknown.
+      # Remove once actionlint ships a release newer than v1.7.12 with
+      # updated action metadata for this action.
+      - 'missing input "app-id" which is required by action "actions/create-github-app-token@v3"'
+      - 'input "client-id" is not defined in action "actions/create-github-app-token@v3"'
+# these are GitHub-hosted but for some reason actionlint couldn't find them
+self-hosted-runner:
+  labels:
+    - ubuntu-latest-4core
+    - ubuntu-latest-8core
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404

.github/workflows/bot-auto-merge.yml

@@ -15,21 +15,22 @@ jobs:
   bot-auto-merge:
     name: Auto-merge passing bot PRs
     runs-on: ubuntu-latest
+    # Gate on who *opened* the PR, not github.actor -- for a `synchronize` event,
+    # github.actor is whoever pushed the latest commit (e.g. pre-commit-ci fixing up
+    # a human-authored PR), which must not by itself trigger auto-merge.
     if: >-
       github.event.pull_request.user.login == 'dependabot[bot]' ||
-      github.event.pull_request.user.login == 'pre-commit-ci[bot]'
+      github.event.pull_request.user.login == 'pre-commit-ci[bot]' ||
+      github.event.pull_request.user.login == 'catalyst-workflow-triggerer[bot]'
     steps:
       - name: Impersonate auto merge PR bot
         uses: actions/create-github-app-token@v3
         id: generate-token
         with:
-          app-id: ${{ secrets.BOT_AUTO_MERGE_PRS_APP_ID }}
+          client-id: ${{ secrets.BOT_AUTO_MERGE_PRS_CLIENT_ID }}
           private-key: ${{ secrets.BOT_AUTO_MERGE_PRS_APP_KEY }}
 
       - name: Approve and enable auto-merge
-        # `gh pr merge --auto` just flags the PR for GitHub to merge on its own once
-        # every required check passes (via branch protection, or a merge queue if
-        # one is configured) -- no polling or retry logic needed here.
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
           PR_URL: ${{ github.event.pull_request.html_url }}