push_to_pull_request_branch: merge commits blocked by both signed and unsigned push paths

[mrjf]

Problem

When an agent merges main into a PR branch locally, the resulting merge commit cannot be pushed through any safe-outputs path:

1. Signed push (GraphQL createCommitOnBranch) — can't represent merge commits (multiple parents)
2. Unsigned push fallback (git push) — blocked by PushSignedCommitsUnsupportedShape in v0.74.2, which intentionally refuses to fall back

Result:

pushSignedCommits: refusing unsigned push for branch 'autoloop/build-tsb-pandas-typescript-migration': 
merge commit detected. GitHub's createCommitOnBranch GraphQL mutation cannot represent merge commits...
Rewrite the commits to use only regular files (mode 100644) with no merge commits, 
or set push-signed-commits: false if the repository does not require signed commits.

The error message suggests push-signed-commits: false but this config option doesn't exist in the schema.

Context

Long-running branch workflows (like autoloop) need to merge main into the PR branch to stay current. The agent can't push directly (credentials are cleaned), so all pushes go through safe-outputs. But safe-outputs can't push merge commits through either path.

This blocks all three push mechanisms we've tried:

• git am patches — can't represent merges (Auto-switch push_to_pull_request_branch to bundle transport when merge commits are detected #30287)
• Bundle transport — shallow checkout issues (Bundle transport fails with 'refusing to merge unrelated histories' in shallow checkout #31345, Bundle transport still fails in shallow checkout: git fetch rejects bundle prerequisites #31600, fixed in v0.74.2)
• pushSignedCommits — GraphQL can't handle multiple parents (this issue)

Suggested fixes

1. Implement push-signed-commits: false as a workflow config option — allow the git push fallback for repos that don't require signed commits
2. Squash the merge before pushing — flatten the merge + iteration commits into a single non-merge commit
3. Use the GitHub merge API (POST /repos/{owner}/{repo}/merges) to merge main into the branch remotely before the agent runs, so the agent never creates a local merge commit

Example

• Run: https://github.com/githubnext/tsb/actions/runs/25898338317
• Repo: githubnext/tsb (v0.74.2)
• The bundle transport successfully fetched and applied, but the push step refused the merge commit

Related

• Auto-switch push_to_pull_request_branch to bundle transport when merge commits are detected #30287 — introduced bundle transport for merge commits
• Bundle transport fails with 'refusing to merge unrelated histories' in shallow checkout #31345, Bundle transport still fails in shallow checkout: git fetch rejects bundle prerequisites #31600, Fix bundle transport in shallow checkouts #31603 — bundle shallow checkout fixes
• fallback-to-issue creates a new issue per push failure instead of reusing existing issue #32024 — fallback-to-issue creates duplicate issues