From c4f6dd159f21930eae67482df97f9a263bb8d657 Mon Sep 17 00:00:00 2001
From: Francisco Solla <fsolla@pm.me>
Date: Mon, 17 Aug 2026 22:08:39 -0300
Subject: [PATCH] =?UTF-8?q?fix:=20automerge=20safety=20net=20s=C3=B3=20par?=
 =?UTF-8?q?a=20agent/*=20(espelha=20teqo=20=E2=80=94=20GITHUB=5FTOKEN=20n?=
 =?UTF-8?q?=C3=A3o=20mergea=20em=20repo=20de=20org);=20remove=20workflow?=
 =?UTF-8?q?=20de=20debug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../workflows/agent-pr-ready-automerge.yml    | 17 +++++++++----
 .forgejo/workflows/debug-token.yml            | 24 -------------------
 2 files changed, 12 insertions(+), 29 deletions(-)
 delete mode 100644 .forgejo/workflows/debug-token.yml

diff --git a/.forgejo/workflows/agent-pr-ready-automerge.yml b/.forgejo/workflows/agent-pr-ready-automerge.yml
index 42f739f..eb28312 100644
--- a/.forgejo/workflows/agent-pr-ready-automerge.yml
+++ b/.forgejo/workflows/agent-pr-ready-automerge.yml
@@ -1,7 +1,12 @@
-# Safety net: PRs de entrega (feature → main) devem ser Ready + auto-merge.
-# Cobre o caso de um agente esquecer de armar o merge. Roda
-# scripts/forgejo-pr-automerge.mjs (plain Node): marca draft → ready, espera o
-# status check `checks` (branch protection em main) e mergea por rebase.
+# Safety net (espelha o teqo): PRs de branch `agent/*` → main devem ser Ready +
+# auto-merge. PRs humanos não passam por aqui — o merge deles é feito pelo
+# agente local via `bun run pr -- --automerge` (com o PAT do usuário, que tem
+# permissão de merge; o usuário sintético `forgejo-actions` do GITHUB_TOKEN não
+# consegue mergear em repos de org).
+#
+# Roda scripts/forgejo-pr-automerge.mjs (plain Node): marca draft → ready, espera
+# o contexto `checks` ficar green (ignorando o próprio status do job) e mergea
+# por rebase.
 
 name: Agent PR Ready + auto-merge
 
@@ -12,7 +17,9 @@ on:
 
 jobs:
   ready-automerge:
-    if: github.event.pull_request.state == 'open'
+    if: >-
+      github.event.pull_request.state == 'open' &&
+      startsWith(github.event.pull_request.head.ref, 'agent/')
     runs-on: host
     timeout-minutes: 40
     steps:
diff --git a/.forgejo/workflows/debug-token.yml b/.forgejo/workflows/debug-token.yml
deleted file mode 100644
index 75833de..0000000
--- a/.forgejo/workflows/debug-token.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: Debug token
-
-on:
-  workflow_dispatch:
-  push:
-    branches: [OPS1-setup-workflow-teqo]
-
-jobs:
-  debug:
-    runs-on: host
-    timeout-minutes: 5
-    steps:
-      - name: Quem é o GITHUB_TOKEN
-        run: |
-          echo "GITHUB_TOKEN user:"
-          curl -s -H "Authorization: token $GITHUB_TOKEN" https://git.solla.dev/api/v1/user
-          echo
-          echo "Permissões no repo:"
-          curl -s -H "Authorization: token $GITHUB_TOKEN" "https://git.solla.dev/api/v1/repos/amana/iara-pwa"
-          echo
-          echo "Tentando criar label (escrita):"
-          curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "Authorization: token $GITHUB_TOKEN" -H "Content-Type: application/json" "https://git.solla.dev/api/v1/repos/amana/iara-pwa/labels" -d '{"name":"debug-token-test","color":"ff0000"}'
-          echo "Tentando remover label:"
-          curl -s -o /dev/null -w "%{http_code}\n" -X DELETE -H "Authorization: token $GITHUB_TOKEN" "https://git.solla.dev/api/v1/repos/amana/iara-pwa/labels/debug-token-test"