ci: add merge_group trigger to required-check workflows

[williaby]

Summary

• Add merge_group: to workflows emitting required status checks so they fire in the merge queue
• REUSE.toml already covers all compliance rollout files; no annotation changes needed

GitHub merge queues fire a merge_group event, not pull_request. Without the trigger,
required checks never report and the queue stalls indefinitely waiting for them.

Workflows fixed:

• ci.yml (emits: CI Gate)
• pr-validation.yml (emits: Dependency & Standards Validation)
• reuse.yml (emits: Check REUSE Compliance)
• security-analysis.yml (emits: Security Gate Validation)

Test plan

• Confirm all required checks pass on this PR
• Add to merge queue and confirm it processes without stalling

Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: b46b57ac-d630-402f-b55b-5051fd42afb9

📥 Commits

Reviewing files that changed from the base of the PR and between e3ea1fc and 54b4001.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/pr-validation.yml
• .github/workflows/reuse.yml
• .github/workflows/security-analysis.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/merge-queue-triggers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[williaby]

Auto-merge disabled on this pending review; not closing it, and no work here is lost.

This PR adds merge_group: to the required-check workflows but does not adapt the jobs to a merge-group event. Under merge_group there is no pull request, so github.event.pull_request.* is null. Two concrete consequences in this repo:

• pr-validation.yml keys its concurrency group on github.event.pull_request.number. Under merge_group that collapses to a single shared group for every merge-group run, so they cancel one another.
• Jobs reading github.event.pull_request.title, .body or .labels.*.name evaluate against null. A title regex match against an empty string fails and exits non-zero, and any gate that aggregates those jobs then fails a required context.

Net effect: instead of the current failure mode, where the merge group waits out the 60 minute check_response_timeout_minutes and is ejected as UNMERGEABLE, every merge-group build would hard-fail a required check immediately. The queue still merges nothing; it just fails faster and louder.

A revised version is being prepared that adds the same triggers and additionally guards the PR-metadata jobs with if: github.event_name == 'pull_request', makes the aggregating gate tolerate a per-job skipped while still failing on a real failure, and rekeys concurrency off github.event.pull_request.number || github.ref.

Re-arm or supersede once that lands.

[williaby]

Closing in favor of #58, which is a strict superset of this change.

This PR adds the merge_group: trigger but misses the concurrency fallback in pr-validation.yml. Under merge_group there is no pull request, so a concurrency.group keyed on github.event.pull_request.number collapses to a constant and every merge-group run cancels the previous one. #58 adds the || github.ref fallback.

#58 also verifies that the shared org reusable workflow this repo delegates to, python-supplemental-checks.yml, is already merge_group-safe: its changelog job already gates on github.event_name == 'pull_request' and reports skipped cleanly, and link-check has no PR-specific fields. So no skip-tolerance change is needed here, unlike in fragrance-rater.

Generated with Claude Code