fix(automerge): check branch status again before automerge

Catches an edge case where a PR is configured for automerge and a new update comes right before automerge. If branch protection wasn’t configured, Renovate was using a “stale” branch status to think it’s OK to merge. Added an additional check before automerging that should catch it.

Fixes #3099

lib/workers/pr/index.js

@@ -31,6 +31,7 @@ async function ensurePr(prConfig) {
         branchName,
         config.requiredStatusChecks
       );
+      logger.debug({ branchStatus, branchName }, 'getBranchStatus() result');
     }
     return branchStatus;
   }
@@ -388,6 +389,16 @@ async function checkAutoMerge(pr, config) {
       logger.info('PR is not ready for merge');
       return false;
     }
+    const branchStatus = await platform.getBranchStatus(
+      branchName,
+      requiredStatusChecks
+    );
+    if (branchStatus !== 'success') {
+      logger.info(
+        `PR is not ready for merge (branch status is ${branchStatus})`
+      );
+      return false;
+    }
     // Check if it's been touched
     if (!pr.canRebase) {
       logger.info('PR is ready for automerge but has been modified');