feat(automerge): add risk-bypass via approval label or Codex pass

[topcoder1]

Summary

Adds two bypass paths to the risk-tier gate in `claude-author-automerge.yml`. Today the gate forces manual click-merge on every Claude-authored PR that touches auth / secrets / migrations / billing / Dockerfile / `.github/workflows/**` / IaC / deploy scripts. These additions preserve the gate's trust signal while removing the click-merge round-trip in two well-defined cases.

Option A — `auto-merge-approved` label

New input `risk_bypass_label` (default `auto-merge-approved`). When that label is present on a Claude-authored risky PR, the risk check is overridden and `gh pr merge --auto --squash` fires.

This is a NEW label distinct from the existing `auto-merge` label. The existing one is a Claude-authorship DETECTION signal (marks the PR as Claude's, risk gate still runs). The new one is an explicit "I read this and approve" signal.

Workflow: human sees the existing "blocked — risk-tier paths touched" comment, applies the label from the PR list page (one click, no PR-detail navigation, no merge-button click). The caller already listens on `pull_request.labeled`, so the re-run happens immediately.

Option B — Codex Review SUCCESS

New input `codex_check_name` (default `review / Codex Review`). When that status check is SUCCESS on the PR's head SHA, the risk gate is overridden.

Reads from the check-runs API first, falls back to the commit-status API for callers that post Codex output as a status rather than a check-run.

Re-trigger semantics: the bypass fires on the next `pull_request.synchronize` (any push) or `pull_request.labeled` (any label change) AFTER Codex completes. Fully-automatic `workflow_run` re-trigger was scoped out for v1 because `workflow_run` events come without `pull_request` payload, requiring a separate PR-lookup job that doesn't fit cleanly into the existing reusable. Worth doing in a v1.1 follow-up if anyone hits the limitation in practice.

Updated "blocked" comment

The comment that gets posted when the gate fires now mentions both bypass options inline, so the human sees the path forward without leaving the PR. Marker string `` unchanged — existing comment-update logic continues to edit-in-place rather than spam.

Test plan

• `actionlint` clean.
• No new shell errors in the inline scripts.
• First Claude-authored PR after this lands that hits the risk gate is the smoke test. Apply `auto-merge-approved`; expect immediate flip to auto-merge.
• On a repo with Codex installed (e.g. wxa-jake-ai), a future Claude PR that hits a risk path should auto-merge after Codex completes + the next push.

Backward compatibility

• Default behaviour is unchanged for callers that don't set the new inputs and don't apply the new label and don't have Codex installed. The gate fires exactly as before.
• The reusable's caller template doesn't need updates to opt in — the new inputs default sensibly. The label needs to be created in each fleet repo's labels list (or auto-created by GitHub on first apply).

Auto-merge rationale: NOT eligible — touches `.github/workflows/**` (production infrastructure surface in the fleet policy). This PR will dogfood its own "blocked" comment until merged. Manual click-merge required (or apply the new label after this lands and an updated install-policy script picks up the new defaults).

Codex pre-review: skipped — change is mechanical workflow plumbing. Mirrors the existing risk-check / enable-auto-merge gate shape; no new business logic. (Once this lands, the next Claude PR on a Codex-installed repo will exercise Option B end-to-end.)

🤖 Generated with Claude Code

[claude]

jq injection / silent bypass failure: $CHECK_NAME is shell-interpolated directly into the --jq filter string on both API calls. If the check name ever contains a " (or other jq syntax), jq exits with an error, codex_state is empty, and the bypass silently falls back to bypass=0 — the risk gate stays up with no indication of why.

The safe pattern uses standalone jq --arg instead of gh api --jq:

Suggested change

	--jq ".check_runs[] | select(.name == \"$CHECK_NAME\") | .conclusion" | head -1)
	if [ -z "$codex_state" ]; then
	codex_state=$(gh api "/repos/${{ github.repository }}/commits/$HEAD_SHA/status" \
	--jq ".statuses[] | select(.context == \"$CHECK_NAME\") | .state" | head -1)
	codex_state=$(gh api "/repos/${{ github.repository }}/commits/$HEAD_SHA/check-runs" \
	| jq -r --arg name "$CHECK_NAME" '.check_runs[] | select(.name == $name) | .conclusion' | head -1)
	if [ -z "$codex_state" ]; then
	codex_state=$(gh api "/repos/${{ github.repository }}/commits/$HEAD_SHA/status" \
	| jq -r --arg name "$CHECK_NAME" '.statuses[] | select(.context == $name) | .state' | head -1)

The default value "review / Codex Review" has no special chars so this won't trigger today, but any caller that customises codex_check_name to something with a " will get a silent no-op.

[claude]

Flagged 1 issue inline — jq shell-interpolation of $CHECK_NAME in the Codex bypass step causes silent bypass=0 if the check name ever contains a double-quote; fix is to pipe to jq --arg instead of gh api --jq.

[claude]

No blocking issues found. One notable limitation: the check-runs API call omits ?per_page=100 (defaults to 30), so on repos with >30 check-runs per SHA the Codex bypass could silently miss the check — gate stays up rather than breaks, but worth a follow-up fix.