ci: add merge_group trigger to required-check workflows

[williaby]

Problem

This repository's merge_queue ruleset requires four status checks
(CI Gate, Check REUSE Compliance, Dependency & Standards Validation,
Security Gate Validation) with grouping_strategy: ALLGREEN and a
60 minute response timeout, but none of the workflows that emit those
checks had a merge_group: trigger. A merge-group build never dispatches
those workflows, so the required contexts never report, every queue entry
waits out the 60 minute timeout, and gets ejected UNMERGEABLE. Without
this fix the merge queue can never merge anything.

Workflows changed and why

• .github/workflows/ci.yml: added merge_group:. Job ci (name:
  CI Gate) is the emitter. Concurrency group already had a
  || github.ref fallback. No hazards.

• .github/workflows/reuse.yml: added merge_group:. Job reuse (name:
  Check REUSE Compliance) is the emitter; the on: block is
  deliberately unfiltered (no paths:) so this required check reports on
  every PR; no concurrency block, no PR-field references. Safe as-is.

• .github/workflows/security-analysis.yml: added merge_group:. Job
  security-gate-success (name: Security Gate Validation) is already a
  normal job, not a reusable-workflow caller, so it was already correctly
  bare-named with no naming mismatch (unlike the bug found in several
  other repos in this batch). Concurrency already had a || github.ref
  fallback. No hazards.

• .github/workflows/pr-validation.yml: added merge_group:. Job
  validate-dependencies (name: Dependency & Standards Validation) is
  the emitter, gated on needs: [supplemental-checks, dead-code] with a
  real exit 1 only when supplemental-checks fails. Audited both
  upstream jobs:

  • dead-code (vulture scan) has no PR-field references and is safe.
  • supplemental-checks calls the org-level
    python-supplemental-checks.yml reusable workflow with
    enable-changelog-check: true and enable-link-check: true. Read
    that workflow directly: its changelog-check job already gates on
    github.event_name == 'pull_request' (the per-PR CHANGELOG.md edit
    requirement was deprecated to a no-op specifically because it
    conflicted with this org's ALLGREEN merge queue, per prior work), so
    it reports skipped under merge_group rather than running or
    failing. link-check has no PR-specific fields and this repo sets
    link-check-fail: false, so it cannot fail this gate either way.
    cruft-check, automerge, and commit-lint are all disabled via
    input in this repo's call and never run. The reusable workflow's own
    summary job is a pure report, no gating. Given all of this,
    supplemental-checks reports success under merge_group with no
    guard changes needed, unlike repos with locally duplicated
    PR-title/PR-body jobs, so no skip-tolerance change was needed in
    validate-dependencies here.

  This PR does fix one real hazard: the concurrency group was keyed
  solely on github.event.pull_request.number, null under merge_group,
  which would collapse every merge-group build for this workflow into one
  group and risk cross-cancellation via cancel-in-progress: true. Added
  a || github.ref fallback, matching the pattern already used in this
  repo's ci.yml and security-analysis.yml.

There is no PR title/body validation job among this repo's required
contexts.

Hazards audited

• Job-level if: github.event_name == 'pull_request' guards on a
  required-context job: none needed; the one job that reads PR-specific
  fields transitively (changelog-check, inside the shared org reusable
  workflow) already has the correct guard.
• github.event.pull_request.* / github.base_ref references: found
  only inside the shared python-supplemental-checks.yml reusable
  workflow (changelog-check's label checks, already guarded), none in
  this repo's own four required-context workflows.
• concurrency: groups keyed on the PR ref that could collapse under
  merge_group: found and fixed in pr-validation.yml; ci.yml and
  security-analysis.yml already had the correct fallback.

Verification

• actionlint run against pr-validation.yml: identical finding count
  before and after (24 pre-existing shellcheck notices in an untouched
  run: block, verified via git stash).
• yamllint run against pr-validation.yml: no findings.
• pre-commit run --files .github/workflows/pr-validation.yml: all
  applicable hooks passed.
• Each required context still has exactly one emitting job, and each
  emitter now runs on both pull_request and merge_group.

Other open PRs touching these files

• ci: add merge_group trigger to required-check workflows #56 (chore/merge-queue-triggers): naive merge_group:-only add across
  all four files; does not fix the pr-validation.yml concurrency
  fallback. Recommend closing in favor of this PR.
• ci(pr-validation): replace deprecated changelog gate with commit-lint #60 (ci/migrate-off-changelog-check-gate) and ci: retire deprecated per-PR changelog gate #63
  (claude/retire-changelog-gate-0): both address migrating this repo off
  enable-changelog-check toward enable-commit-lint/semantic-release,
  the same deprecated changelog gate discussed above. Neither touches
  merge_group triggers. Independent of this PR; no conflict expected
  since this PR only adds a trigger and a concurrency fallback, not a
  change to the supplemental-checks with: block.
• chore(ci): remove GitHub Advanced Security dependent CI #62 (ci/drop-ghas): unrelated scope (GHAS removal); not evaluated
  here.

Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 15da4e57-ef38-4318-b086-1105effb35e1

📥 Commits

Reviewing files that changed from the base of the PR and between e3ea1fc and 73d93b2.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/pr-validation.yml
• .github/workflows/reuse.yml
• .github/workflows/security-analysis.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/merge-queue-merge-group-0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[williaby]

Auto-merge disabled on this pending review; not closing it, and no work here is lost.

This PR adds merge_group: to the required-check workflows but does not adapt the jobs to a merge-group event. Under merge_group there is no pull request, so github.event.pull_request.* is null. Two concrete consequences in this repo:

• pr-validation.yml keys its concurrency group on github.event.pull_request.number. Under merge_group that collapses to a single shared group for every merge-group run, so they cancel one another.
• Jobs reading github.event.pull_request.title, .body or .labels.*.name evaluate against null. A title regex match against an empty string fails and exits non-zero, and any gate that aggregates those jobs then fails a required context.

Net effect: instead of the current failure mode, where the merge group waits out the 60 minute check_response_timeout_minutes and is ejected as UNMERGEABLE, every merge-group build would hard-fail a required check immediately. The queue still merges nothing; it just fails faster and louder.

A revised version is being prepared that adds the same triggers and additionally guards the PR-metadata jobs with if: github.event_name == 'pull_request', makes the aggregating gate tolerate a per-job skipped while still failing on a real failure, and rekeys concurrency off github.event.pull_request.number || github.ref.

Re-arm or supersede once that lands.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[Copilot]

🟢 Approval recommended

The changes are minimal, valid for GitHub Actions syntax, and directly address required-check reporting and concurrency behavior under merge_group.

Pull request overview

Enables GitHub merge queue (merge_group) runs for the workflows that emit this repo’s required status checks, ensuring required contexts report during merge-group builds and preventing merge-queue timeouts/ejections.

Changes:

• Added merge_group: trigger to required-check workflows (ci.yml, reuse.yml, security-analysis.yml, pr-validation.yml).
• Updated pr-validation.yml concurrency group to fall back to github.ref when github.event.pull_request.number is null under merge_group, avoiding cross-run cancellation.

File summaries

File	Description
.github/workflows/ci.yml	Adds merge_group so the CI Gate check reports for merge queue builds.
.github/workflows/reuse.yml	Adds merge_group so REUSE compliance reports for merge queue builds.
.github/workflows/security-analysis.yml	Adds merge_group so the security gate required check reports for merge queue builds.
.github/workflows/pr-validation.yml	Adds merge_group and fixes concurrency grouping for merge-queue safety.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.