fix(autoupdate): test the default branch and handle merge conflicts

The checkout used the triggering ref, so a run started from another
branch tested a stale tree and then hit conflicts. Check out the default
branch explicitly. When a passing PR conflicts, close it and skip, and
when the merge fails, close the PR and fail the job. Only a real test
failure goes to the issue.

.github/workflows/renovate-autoupdate.yaml

@@ -199,9 +199,15 @@ jobs:
       BRANCH: ${{ matrix.branch }}
       GH_TOKEN: ${{ github.token }}
     steps:
+      - name: Find the default branch
+        id: default
+        run: echo "branch=$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)" >> "$GITHUB_OUTPUT"
+
+      # Not the triggering ref: a push or a manual run from another branch must still test the default branch.
       - name: Checkout the default branch
         uses: actions/checkout@v6
         with:
+          ref: ${{ steps.default.outputs.branch }}
           fetch-depth: 0
           lfs: ${{ inputs.lfs }}
 
@@ -338,6 +344,10 @@ jobs:
             fi
           done
 
+      - name: Mark the tests as passed
+        if: steps.merge.outputs.skip != 'true'
+        run: touch "$RUNNER_TEMP/tests-passed"
+
       - name: Open the PR and merge it
         if: steps.merge.outputs.skip != 'true'
         env:
@@ -359,12 +369,22 @@ jobs:
             [ "$state" != UNKNOWN ] && break
             sleep 5
           done
+          if [ "$state" = CONFLICTING ]; then
+            gh pr close "$pr" --repo "$GITHUB_REPOSITORY" \
+              --comment "The tests passed, but the branch conflicts with $default. Renovate rebases it on the next run."
+            echo "::warning::$BRANCH conflicts with $default, so PR #$pr was closed. Renovate rebases it on the next run."
+            echo "\`$BRANCH\` passed its tests but conflicts with \`$default\`. Renovate rebases it on the next run." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
           # --match-head-commit refuses to merge anything newer than the commit that was tested.
-          gh pr merge "$pr" --repo "$GITHUB_REPOSITORY" --squash --delete-branch \
+          if ! gh pr merge "$pr" --repo "$GITHUB_REPOSITORY" --squash --delete-branch \
             --match-head-commit "$HEAD_SHA" \
             --subject "$SUBJECT" \
             --body "Automated dependency update. All tests passed." \
-            ${ADMIN:+--admin}
+            ${ADMIN:+--admin}; then
+            gh pr close "$pr" --repo "$GITHUB_REPOSITORY" --comment "The tests passed, but GitHub refused the merge. See the workflow run. The next run tries again."
+            exit 1
+          fi
           echo "Merged #$pr ($BRANCH)." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Report the failure
@@ -375,6 +395,10 @@ jobs:
           HEAD_SHA: ${{ steps.merge.outputs.head }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
+          if [ -e "$RUNNER_TEMP/tests-passed" ]; then
+            echo "The tests passed for \`$BRANCH\`, but the merge failed. See the log above. The next run tries again." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
           echo "The tests failed for \`$BRANCH\`, so no PR was opened. Renovate retries on the next run." >> "$GITHUB_STEP_SUMMARY"
 
           log="$RUNNER_TEMP/test-output.log"