Re-reading the full snippet — you're already using gh pr merge --auto --squash, so the question isn't how, it's why the warning fires. That message (failed to enable auto-merge) on GHES with the default GITHUB_TOKEN
almost always comes down to one of these:

1. No branch protection on main. --auto enables a queue that waits for required checks/reviews. If main has zero protection rules, there's nothing to queue against and GitHub refuses to enable auto-merge. Fix: add a
   branch protection rule on main with at least one required status check (or required review) — even a minimal "lint" check is enough.

2. GITHUB_TOKEN can't enable auto-merge for PRs it created in some GHES configs. This is a deliberate restriction to prevent runaway automation loops. Workaround: create a fine-grained PAT (or use a GitHub App
   installation token) with contents: write + pull-requests: write, store it as secrets.AUTOMERGE_PAT, and switch the env to GH_TOKEN: ${{ secrets.AUTOMERGE_PAT }} only for the gh pr merge step. The PR opens with
   GITHUB_TOKEN, the merge enables with the PAT.

3. Enterprise/org-level policy. Auto-merge has to be enabled at three levels on GHES: enterprise → org → repo. Repo-level alone is not enough if the enterprise admin disabled it upstream. Check with your GHES admin or look
   in Site admin → Enterprise overview → Policies → Repository policies.

If you can share the GHES version (testcloud.ghe.com is presumably internal), I can be more specific — auto-merge had several bug fixes between 3.6 and 3.10.

For reference, here's a complete working pattern that combines gh pr create + gh pr merge --auto:

jobs:                                                                                                                                                                                                                              
  open-pr:                                                                                                        
    runs-on: ubuntu-latest             
    permissions:
      contents: write
      pull-requests: write                                                                                                                                                                                                         
    steps:
      - uses: actions/checkout@v4                                                                                                                                                                                                  
      - name: Open PR and enable auto-merge                                                                       
        env:                                                                                                                                                                                                                       
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |                                                                                                                                                                                                                     
          PR_URL=$(gh pr create \                                                                                                                                                                                                  
            --base main \              
            --head "${GITHUB_REF_NAME}" \                                                                                                                                                                                          
            --title "FluxCD image update" \                                                                                                                                                                                        
            --body "Automated PR from FluxCD branch" \                                                                                                                                                                             
            --fill)                                                                                                                                                                                                                
          gh pr merge "$PR_URL" --auto --squash --delete-branch                                                                                                                                                                    

Three repo-side prereqs for --auto to actually fire:

1. Repo setting: Settings → General → Pull Requests → check Allow auto-merge
2. Branch protection: required (per cause interactive pr list #1 above)
3. Token: see cause Reimagine how the app determines its context #2 above for GHES specifically

It looks like you have the core logic right, but you are likely hitting a permission boundary with the default GITHUB_TOKEN.

Even when "Allow auto-merge" is enabled in your repository settings, there are a few common reasons why gh pr merge --auto fails in a GitHub Action:

1. Missing "Allow GitHub Actions to create and approve pull requests"

By default, GitHub prevents Actions from creating or approving Pull Requests to prevent accidental loops.

• Go to Settings > Actions > General.
• Scroll down to Workflow permissions.
• Check the box "Allow GitHub Actions to create and approve pull requests".
  Without this, gh will be blocked from performing auto-merge operations even if the token has write permissions.

2. Token Permissions in the Workflow

While you have the pull-requests: write and contents: write permissions in your YAML, auto-merge sometimes requires the workflow scope if the merge would trigger other workflow changes, or if you are using specific branch protection rules.

However, for most GHE/Cloud setups, the most common fix is actually to ensure the "Allow GitHub Actions to create and approve pull requests" setting is enabled at the Repo or Org level.

3. Branch Protection Requirements

Auto-merge can only be enabled if there is actually a "blocker" to wait for (like a required status check or a required review). If the branch has no protection rules, gh pr merge --auto might fail because there is nothing to "auto" about it—it should just be a regular merge. Ensure your main branch has at least one required status check or review enabled.

4. GHE Specifics (GH_HOST)

Since you are on GitHub Enterprise (testcloud.ghe.com), ensure that your environment is consistently using the host. You've set GH_HOST in your environment, which is good. However, when using gh pr merge --auto with the default GITHUB_TOKEN, sometimes the CLI needs to be explicitly told which host to authenticate against if the environment isn't perfectly mapped.

Suggested Troubleshooting Steps:

1. Verify the Workflow permissions setting mentioned in step 1.
2. Try adding a gh auth status check right before your merge command in the script to see exactly which host and account the CLI thinks it is using.
3. If it still fails with the same warning, try using a Personal Access Token (PAT) with repo scope instead of github.token just to rule out a permission limitation of the ephemeral token. If the PAT works, it's definitely a repo-level restriction on the GITHUB_TOKEN.