fix(auto-merge): replace drifted hardcoded check names with configurable wait_checks input

The hardcoded matrix waited for `tfsec / tfsec sarif report`, but the
shared `security-tfsec.yml` now produces `tfsec / 🧪 tfsec SARIF Report`
(emoji + title case). The wait-on-check step therefore never matched,
causing every dependabot auto-merge attempt to stall and skip both
autoapprove and automerge jobs.

Replace the hardcoded matrix with a `wait_checks` JSON-array input so
callers can supply the exact check-run names their repo produces. The
default covers the org-wide tflint + tfsec reports with the current
(correct) names. `tfcheck` is retained as a no-op input for backward
compatibility; callers should migrate to `wait_checks`.

Author: anmolnagpal

.github/workflows/pr-auto-merge.yml

@@ -5,9 +5,14 @@ on:
   workflow_call:
     inputs:
       tfcheck:
-        description: 'Enter the tfcheck action name.'
+        description: 'DEPRECATED — use `wait_checks`. Kept for backward compatibility; ignored.'
         required: false
         type: string
+      wait_checks:
+        description: 'JSON array of required check-run names to wait on before auto-approving. Must match the exact names GitHub reports (including emoji, casing, and parentheses).'
+        required: false
+        type: string
+        default: '["tf-lint / tflint", "tfsec / 🧪 tfsec SARIF Report"]'
       tfchecks_azure:
         description: 'List of Azure TF checks (JSON array as string)'
         required: false
@@ -29,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        tf-checks: ["tf-lint / tflint", "tfsec / tfsec sarif report", "${{ inputs.tfcheck }}"]
+        tf-checks: ${{ fromJSON(inputs.wait_checks) }}
     if: github.actor == 'dependabot[bot]' && !inputs.azure_cloud
     steps:
       - name: Wait for 2 Minutes