name: Auto-merge icon PRs

# Enables GitHub's native auto-merge on icon-add / icon-update PRs once
# the triage workflow has labeled them triage:ready and the submitter
# isn't a first-time contributor (so we still eyeball brand-new sources
# before shipping). CI gates the actual merge — this just removes the
# manual "click merge" step once everything's green.
#
# Required check chain (configured at branch protection level):
#   - Validate SVG
#   - Lint & Build
#
# Skipped (left for manual merge):
#   - First-time contributors (author_association is FIRST_TIME_CONTRIBUTOR
#     or NONE) — we want a human to read the diff for those
#   - PRs marked needs-review, blocked-on-maintainer, or any triage:needs-*
#   - Draft PRs

on:
  pull_request:
    types: [opened, reopened, synchronize, labeled, ready_for_review]

permissions:
  contents: write
  pull-requests: write

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: >-
      !github.event.pull_request.draft &&
      github.event.pull_request.user.login != 'dependabot[bot]' &&
      contains(github.event.pull_request.labels.*.name, 'triage:ready') &&
      !contains(github.event.pull_request.labels.*.name, 'needs-review') &&
      !contains(github.event.pull_request.labels.*.name, 'blocked-on-maintainer') &&
      !contains(github.event.pull_request.labels.*.name, 'triage:needs-svg') &&
      !contains(github.event.pull_request.labels.*.name, 'triage:needs-license') &&
      !contains(github.event.pull_request.labels.*.name, 'triage:invalid-svg') &&
      !contains(github.event.pull_request.labels.*.name, 'triage:svg-oversize') &&
      github.event.pull_request.author_association != 'FIRST_TIME_CONTRIBUTOR' &&
      github.event.pull_request.author_association != 'NONE'
    steps:
      - name: Enable auto-merge
        run: gh pr merge --auto --squash --delete-branch "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}