ci: add merge_group trigger to required-check workflows

[williaby]

Summary

• Add merge_group: to workflows emitting required status checks so they fire in the merge queue
• REUSE.toml already uses path = ["**"] catch-all glob, no annotation changes needed

GitHub merge queues fire a merge_group event, not pull_request. Without the trigger,
required checks never report and the queue stalls indefinitely waiting for them.

Workflows updated:

• ci.yml (emits "CI Gate" required check)
• pr-validation.yml (emits "Dependency & Standards Validation" required check)
• reuse.yml (emits "Check REUSE Compliance" required check)
• security-analysis.yml (emits "Security Gate Validation" required check)

Test plan

• Confirm all required checks pass on this PR
• Add to merge queue and confirm it processes without stalling

Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Expanded automated checks to run for merge queue changes, alongside existing pull request and push triggers.
  • Updated CI, validation, compliance, and security workflows to recognize merge group events.

• Bug Fixes

  • Improved coverage so queued merges receive the same verification as other incoming changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9934f16b-9a4c-4a78-b7c2-91efaba850ab

📥 Commits

Reviewing files that changed from the base of the PR and between efcf21f and fdfac08.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/pr-validation.yml
• .github/workflows/reuse.yml
• .github/workflows/security-analysis.yml

---

Walkthrough

Four GitHub Actions workflows (ci.yml, pr-validation.yml, reuse.yml, security-analysis.yml) each gain a merge_group entry under their on: trigger block. No job logic, steps, or other configuration is changed.

Changes

Merge Queue Trigger Support

Layer / File(s)	Summary
Add merge_group trigger to all workflows .github/workflows/ci.yml, .github/workflows/pr-validation.yml, .github/workflows/reuse.yml, .github/workflows/security-analysis.yml	Each workflow adds a single merge_group: line to its on: block, extending execution to merge queue events alongside existing triggers.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

ci, new-feature

Poem

🐇 Hop hop, the queue awaits,
Four workflows guard the merge-group gates.
A single line in each yaml file,
Now merge queues run in proper style.
The rabbit nods — all checks shall pass! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding merge_group triggers to required-check workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/merge-queue-triggers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[williaby]

Closing in favor of #111, which supersedes this.

This PR adds merge_group: to the four required-check workflows but does not guard title-check and body-check. Under a merge_group event there is no pull request, so github.event.pull_request.title and .body are null: title-check's regex match fails against the empty string and exits 1, body-check's emptiness test fails, and validate-dependencies (which needs: both, with if: always()) then sees FAILURE and fails the required Dependency & Standards Validation context.

That converts the current failure mode, a silent 60 minute wait to UNMERGEABLE, into an immediate hard failure of a required check on every merge-group build. The queue still never merges anything.

#111 adds the same triggers and additionally guards the two PR-metadata jobs with if: github.event_name == 'pull_request', then makes the aggregating gate tolerate a per-job skipped result while still failing on a real failure. It also rekeys the concurrency group off github.event.pull_request.number || github.ref so the merge-group run does not cancel the PR run.

No work is lost: #111 covers everything this PR does.