From 517bf5c89d29f8fc11211cb49abf1b2ebef28ab5 Mon Sep 17 00:00:00 2001
From: Byron Williams <byronawilliams@gmail.com>
Date: Mon, 29 Jun 2026 08:59:35 -0700
Subject: [PATCH] fix(ci): wire required checks for the merge queue

Adds a bare `Security Gate Validation` aggregator job to `security-analysis.yml` (which already triggers on `merge_group`). The reusable security workflow only emitted `Security Analysis / Security Gate Validation` (caller/callee form), which never matched the bare required context, so that check was unsatisfiable on every PR, not just in the queue. The other three required checks were already wired correctly.

Part of the org-wide merge-queue stall remediation. A required merge queue
stalls when required-check workflows do not trigger on the merge_group event;
the queue dispatches merge_group, waits for checks that never report, and times
out. See reference-library PR #64 for the reference fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/security-analysis.yml | 29 +++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml
index 2c4ee46..4e3dd22 100644
--- a/.github/workflows/security-analysis.yml
+++ b/.github/workflows/security-analysis.yml
@@ -46,3 +46,32 @@ jobs:
       run-safety: false  # safety removed from deps; pip-audit covers vulnerability scanning
       run-osv: true
       no-build: false  # project uses hatchling build backend; uv must build the editable install
+
+  # Bare "Security Gate Validation" context required by the org ruleset.
+  # The reusable security workflow surfaces as
+  # "Security Analysis / Security Gate Validation" (caller / reusable job),
+  # which cannot match the bare ruleset context. This in-line aggregator
+  # re-emits the bare context on pull_request and inside the merge queue.
+  security-gate:
+    name: Security Gate Validation
+    runs-on: ubuntu-latest
+    needs: [security]
+    if: always()
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5  # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: ''
+      - name: Aggregate security result
+        run: |
+          result="${{ needs.security.result }}"
+          if [ "$result" = "success" ] || [ "$result" = "skipped" ]; then
+            echo "Security Gate Validation: passed (result: $result)"
+          else
+            echo "::error::Security Gate Validation failed: $result"
+            exit 1
+          fi