ci: add merge_group trigger to required-check workflows

.github/workflows/ci.yml

@@ -15,6 +15,7 @@
   pull_request:
     types: [opened, synchronize, reopened]
     branches: [main, master, develop]
+  merge_group:
   workflow_dispatch:
 
 # Cancel in-progress runs for same PR/branch
@@ -95,11 +96,11 @@
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install workspace dependencies
         run: uv sync --all-extras
 
       - name: Run tests with coverage
         run: |
           uv run pytest packages/cloudflare-auth/tests \
             --cov=packages/cloudflare-auth/src/cloudflare_auth \
             --cov-report=xml:coverage-cloudflare-auth.xml \
             --cov-report=term-missing \
@@ -108,10 +109,10 @@
             -v
 
       - name: Run type checker
         run: uv run basedpyright packages/cloudflare-auth/src/
 
       - name: Run linter
         run: uv run ruff check packages/cloudflare-auth/
 
       - name: Upload coverage artifact
         if: matrix.python-version == '3.12'
@@ -150,11 +151,11 @@
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install workspace dependencies
         run: uv sync --all-extras
 
       - name: Run tests with coverage
         run: |
           uv run pytest packages/gcs-utilities/tests \
             --cov=packages/gcs-utilities/src/gcs_utilities \
             --cov-report=xml:coverage-gcs-utilities.xml \
             --cov-report=term-missing \
@@ -163,10 +164,10 @@
             -v
 
       - name: Run type checker
         run: uv run basedpyright packages/gcs-utilities/src/
 
       - name: Run linter
         run: uv run ruff check packages/gcs-utilities/
 
       - name: Upload coverage artifact
         if: matrix.python-version == '3.12'
@@ -201,11 +202,11 @@
         run: uv python install 3.12
 
       - name: Install dependencies
         run: uv sync --all-extras
 
       - name: Run Bandit security scan
         run: |
           uv run bandit -r packages/cloudflare-auth/src/ packages/gcs-utilities/src/ -c pyproject.toml || true
 
   # Upload combined coverage to Codecov
   coverage:

.github/workflows/pr-validation.yml

@@ -14,6 +14,7 @@
       - main
       - master
       - develop
+  merge_group:
 
 # Cancel in-progress runs for same PR
 concurrency:
@@ -72,12 +73,12 @@
         run: uv python install 3.12
 
       - name: Install dependencies
         run: uv sync --all-extras
 
       - name: Run vulture
         run: |
           echo "## Dead Code Report" >> $GITHUB_STEP_SUMMARY
           uv run vulture src/ packages/ --min-confidence 90 | tee vulture-report.txt || true
           if [ -s vulture-report.txt ]; then
             echo '```' >> $GITHUB_STEP_SUMMARY
             cat vulture-report.txt >> $GITHUB_STEP_SUMMARY

.github/workflows/reuse.yml

@@ -12,6 +12,7 @@ on:
   # does not match repository-root paths), leaving the required context pending
   # forever and silently blocking the PR.
   pull_request:
+  merge_group:
   push:
     branches:
       - main

.github/workflows/security-analysis.yml

@@ -14,6 +14,7 @@
     branches: [main, master]
   pull_request:
     branches: [main, master]
+  merge_group:
   schedule:
     # Run security scans weekly on Monday at 9 AM UTC
     - cron: '0 9 * * 1'
@@ -51,10 +52,10 @@
         run: uv python install 3.12
 
       - name: Install dependencies
         run: uv sync --all-extras
 
       - name: Run Bandit security scan
         run: uv run bandit -r src/ -c pyproject.toml -f json -o bandit-report.json || true
 
       - name: Run OSV-Scanner dependency scan
         uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8