ci: migrate workflows to shared reusable workflows

.github/workflows/dependabot-auto-merge.yml

@@ -1,83 +1,14 @@
-# .github/workflows/dependabot-auto-merge.yml
-#
-# Automatically enables auto-merge on Dependabot PRs for minor and patch
-# version bumps. GitHub holds the actual merge until all required status
-# checks in the 'main-status-checks' Ruleset pass.
-#
-# Major version bumps are explicitly skipped and require human review
-# from the aws/bedrock-agentcore-maintainers team.
-#
-# PREREQUISITES (already completed):
-#   ✅ Ruleset 'main-status-checks' — CI must pass, no bypass for anyone
-#   ✅ Ruleset 'main' — approval requirement, Dependabot bypass added
-#   ✅ Settings → General → Allow auto-merge enabled
-
 name: Dependabot Auto-merge
 
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
-  contents: write      # required to execute the squash merge
-  pull-requests: write # required to enable auto-merge
+  contents: write
+  pull-requests: write
 
 jobs:
-  dependabot-auto-merge:
-    name: Auto-merge minor/patch PRs
-    runs-on: ubuntu-latest
-
-    # Only act on PRs opened by the Dependabot bot.
-    # The correct login is 'dependabot[bot]' — the bare string 'dependabot'
-    # never matches and would silently skip all runs.
-    if: github.actor == 'dependabot[bot]'
-
-    steps:
-      - name: Generate GitHub App Token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Fetch Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v2
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-
-      # patch and minor bumps: enable auto-merge.
-      # GitHub holds the merge until all required status checks pass.
-      # If CI fails the PR stays open — no merge happens.
-      - name: Enable auto-merge for minor/patch bumps
-        if: |
-          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-          steps.metadata.outputs.update-type == 'version-update:semver-minor'
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
-          PREV_VERSION: ${{ steps.metadata.outputs.previous-version }}
-          NEW_VERSION: ${{ steps.metadata.outputs.new-version }}
-          UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
-        run: |
-          gh pr merge --auto --squash "$PR_URL"
-          echo "✓ Auto-merge enabled: $DEP_NAMES \
-          ($PREV_VERSION → \
-          $NEW_VERSION, \
-          $UPDATE_TYPE)"
-
-      # major bumps: log clearly and do nothing.
-      # The PR stays open and is assigned to aws/bedrock-agentcore-maintainers
-      # via dependabot.yml for human review.
-      - name: Skip major bumps — human review required
-        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
-        env:
-          DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
-          PREV_VERSION: ${{ steps.metadata.outputs.previous-version }}
-          NEW_VERSION: ${{ steps.metadata.outputs.new-version }}
-        run: |
-          echo "⏭ Skipped: $DEP_NAMES \
-          is a major bump ($PREV_VERSION → \
-          $NEW_VERSION). \
-          Requires review from aws/bedrock-agentcore-maintainers."
+  call:
+    uses: aws/agentcore-devx-devtools/.github/workflows/reusable-dependabot-auto-merge.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab
+    secrets: inherit

.github/workflows/pr-automerge.yml

@@ -9,58 +9,6 @@ permissions:
   pull-requests: write
 
 jobs:
-  auto-merge:
-    name: Auto-merge Release PRs
-    runs-on: ubuntu-latest
-    # Only run when PR is approved and it's a release PR
-    if: |
-      github.event.review.state == 'approved' &&
-      github.event.pull_request.user.login == 'github-actions[bot]' &&
-      startsWith(github.event.pull_request.head.ref, 'release/') &&
-      github.event.pull_request.base.ref == 'main'
-
-    steps:
-      - name: Check CI status
-        id: ci-status
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const { data: checkRuns } = await github.rest.checks.listForRef({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              ref: context.payload.pull_request.head.sha
-            });
-
-            // Include ALL required checks
-            const requiredChecks = [
-              'Lint',
-              'Test Python 3.10',
-              'Test Python 3.11',
-              'Test Python 3.12',
-              'Test Python 3.13',
-              'Build Package'
-            ];
-
-            const allPassed = requiredChecks.every(checkName => {
-              const check = checkRuns.check_runs.find(run => run.name === checkName);
-              return check && check.conclusion === 'success';
-            });
-
-            console.log(`All required checks passed: ${allPassed}`);
-            return allPassed;
-
-      - name: Auto-merge PR
-        if: steps.ci-status.outputs.result == 'true'
-        uses: actions/github-script@v8
-        with:
-          script: |
-            await github.rest.pulls.merge({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.pull_request.number,
-              merge_method: 'squash',
-              commit_title: `Release v${context.payload.pull_request.head.ref.split('/')[1]}`,
-              commit_message: 'Auto-merged by release workflow'
-            });
-
-            console.log('✓ PR auto-merged successfully');
+  call:
+    uses: aws/agentcore-devx-devtools/.github/workflows/reusable-pr-automerge.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab
+    secrets: inherit