ci: add merge_group trigger to required-check workflows

[williaby]

Summary

• Add merge_group: to workflows emitting required status checks so they fire in the merge queue
• REUSE.toml already covers compliance rollout files; no changes needed there

GitHub merge queues fire a merge_group event, not pull_request. Without the trigger,
required checks never report and the queue stalls indefinitely waiting for them.

Workflows fixed:

• security-analysis.yml (emits: Security Gate Validation)
• pr-validation.yml (emits: Dependency & Standards Validation)
• reuse.yml (emits: Check REUSE Compliance)
• ci.yml (emits: CI Gate)
• sonarcloud.yml (emits: SonarCloud Analysis)

Test plan

• Confirm all required checks pass on this PR
• Add to merge queue and confirm it processes without stalling

Generated with Claude Code

Summary by CodeRabbit

• New Features
  • CI, validation, security, reuse, and code-quality checks now also run for merge queue activity.
  • Existing push, pull request, and manual triggers remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1393b026-03d4-48f6-8b78-ddd69cdb51c3

📥 Commits

Reviewing files that changed from the base of the PR and between 7c2c91e and e73f3e9.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/pr-validation.yml
• .github/workflows/reuse.yml
• .github/workflows/security-analysis.yml
• .github/workflows/sonarcloud.yml

---

Walkthrough

Five GitHub Actions workflows (ci.yml, pr-validation.yml, reuse.yml, security-analysis.yml, sonarcloud.yml) each receive one additional event trigger: merge_group. No job logic, steps, or permissions were modified.

Changes

merge_group Trigger Addition

Layer / File(s)	Summary
Add merge_group trigger to all workflows .github/workflows/ci.yml, .github/workflows/pr-validation.yml, .github/workflows/reuse.yml, .github/workflows/security-analysis.yml, .github/workflows/sonarcloud.yml	Each workflow's on: block gains a merge_group entry so all CI checks run during merge queue events.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

ci

Poem

🐇 Five workflows stood in a row,
Waiting for merges to flow.
A queue came along,
With triggers so strong —
Now merge groups put on quite a show! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding merge_group triggers to required-check workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/merge-queue-triggers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[williaby]

Auto-merge disabled on this pending review; not closing it, and no work here is lost.

This PR adds merge_group: to the required-check workflows but does not adapt the jobs to a merge-group event. Under merge_group there is no pull request, so github.event.pull_request.* is null. Two concrete consequences in this repo:

• pr-validation.yml keys its concurrency group on github.event.pull_request.number. Under merge_group that collapses to a single shared group for every merge-group run, so they cancel one another.
• Jobs reading github.event.pull_request.title, .body or .labels.*.name evaluate against null. A title regex match against an empty string fails and exits non-zero, and any gate that aggregates those jobs then fails a required context.

Net effect: instead of the current failure mode, where the merge group waits out the 60 minute check_response_timeout_minutes and is ejected as UNMERGEABLE, every merge-group build would hard-fail a required check immediately. The queue still merges nothing; it just fails faster and louder.

A revised version is being prepared that adds the same triggers and additionally guards the PR-metadata jobs with if: github.event_name == 'pull_request', makes the aggregating gate tolerate a per-job skipped while still failing on a real failure, and rekeys concurrency off github.event.pull_request.number || github.ref.

Re-arm or supersede once that lands.

[williaby]

Closing in favor of #42, which is a strict superset of this change.

This PR adds the merge_group: trigger but stops there. Under merge_group there is no pull request, so github.event.pull_request.* is null. A concurrency.group keyed on the PR number therefore collapses to a constant across every merge-group run, so each run cancels the previous one. #42 rekeys it off github.event.pull_request.number || github.ref and audits the required-context emitters against the merge-queue path.

#42 carries this PR's trigger change plus those fixes, so nothing here is lost.

Generated with Claude Code