feat(sync): auto-merge safe catalog updates (#3958)

* feat(sync): auto-merge safe catalog updates

* fix(sync): count model additions and deletions directly

* fix(sync): require review for reasoning changes

* fix(sync): disable unsafe auto-merge before push

* fix(sync): harden auto-merge check output

.github/workflows/sync-models.yml

@@ -95,6 +95,7 @@ jobs:
         run: bun validate
 
       - name: Report changes
+        id: report
         env:
           GH_TOKEN: ${{ steps.committer.outputs.token }}
           BRANCH: automation/sync-models-${{ matrix.provider }}
@@ -119,9 +120,20 @@ jobs:
           git checkout -B "$BRANCH"
           git add models providers
           git commit -m "$TITLE"
-          git push --force-with-lease origin "$BRANCH"
+          bun sync:auto-merge HEAD^ HEAD
+          safe="$(sed -n 's/^safe=//p' "$GITHUB_OUTPUT" | tail -1)"
 
           pr_number="$(gh pr list --head "$BRANCH" --base dev --json number --jq '.[0].number')"
+          if [ "$safe" != "true" ] && [ -n "$pr_number" ]; then
+            gh pr merge "$pr_number" --disable-auto || true
+            if [ "$(gh pr view "$pr_number" --json autoMergeRequest --jq '.autoMergeRequest == null')" != "true" ]; then
+              echo "Failed to disable auto-merge for unsafe sync PR #$pr_number."
+              exit 1
+            fi
+          fi
+
+          git push --force-with-lease origin "$BRANCH"
+
           if [ -n "$pr_number" ]; then
             gh pr edit "$pr_number" --title "$TITLE" --body-file .sync/model-sync-report.md
             for label in "${labels[@]}"; do
@@ -129,4 +141,12 @@ jobs:
             done
           else
             gh pr create --base dev --head "$BRANCH" --title "$TITLE" --body-file .sync/model-sync-report.md "${label_args[@]}"
+            pr_number="$(gh pr list --head "$BRANCH" --base dev --json number --jq '.[0].number')"
+          fi
+
+          if [ "$safe" = "true" ]; then
+            gh pr merge "$pr_number" --auto --squash
+          elif [ "$(gh pr view "$pr_number" --json autoMergeRequest --jq '.autoMergeRequest == null')" != "true" ]; then
+            echo "Unsafe sync PR #$pr_number still has auto-merge enabled."
+            exit 1
           fi