From c3953f2cae1834bd56bdcb8ac96f248a63213d73 Mon Sep 17 00:00:00 2001 From: Byron Williams Date: Mon, 29 Jun 2026 08:59:23 -0700 Subject: [PATCH 1/2] fix(ci): wire required checks for the merge queue Adds a `merge_group` trigger to the four required-check workflows so each required context reports inside the merge queue. Part of the org-wide merge-queue stall remediation. A required merge queue stalls when required-check workflows do not trigger on the merge_group event; the queue dispatches merge_group, waits for checks that never report, and times out. See reference-library PR #64 for the reference fix. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/ci.yml | 1 + .github/workflows/pr-validation.yml | 1 + .github/workflows/reuse.yml | 1 + .github/workflows/security-analysis.yml | 1 + 4 files changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0b5cddc..c0fee2e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,6 +10,7 @@ name: CI on: + merge_group: push: branches: [main, master, develop] pull_request: diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index d89b8c7..10e29fa 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -8,6 +8,7 @@ name: PR Validation on: + merge_group: pull_request: types: [opened, synchronize, reopened] branches: diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index fd721d3..7b4ef0d 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -6,6 +6,7 @@ name: REUSE Compliance on: + merge_group: # No paths filter: "Check REUSE Compliance" is a REQUIRED status check, so it # must report on every PR. A paths filter would skip the workflow on changes # that do not match (e.g. root-only files like renovate.json, since "**/*" diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml index 438e58e..f5866db 100644 --- a/.github/workflows/security-analysis.yml +++ b/.github/workflows/security-analysis.yml @@ -10,6 +10,7 @@ name: Security Analysis "on": + merge_group: push: branches: [main, master] pull_request: From 73d93b276dd4d2c12679831b6258de426909f1a7 Mon Sep 17 00:00:00 2001 From: Byron Williams Date: Thu, 3 Sep 2026 17:40:11 -0700 Subject: [PATCH 2/2] fix(ci): make pr-validation concurrency group merge_group-safe The concurrency group for pr-validation.yml was keyed solely on github.event.pull_request.number, which is null under the merge_group event. Every merge-group build for this workflow would collapse into the same group key, so unrelated merge-group runs could cancel each other via cancel-in-progress, producing flaky-looking merge queue behavior with no visible error. Add a github.ref fallback, matching the pattern already used in this repo's ci.yml and security-analysis.yml concurrency groups. Audited the rest of this workflow for merge_group hazards: dead-code (vulture) has no PR-field references. supplemental-checks calls the org-level python-supplemental-checks.yml reusable workflow with enable-changelog-check and enable-link-check; changelog-check in that workflow already gates on github.event_name == 'pull_request' (the per-PR CHANGELOG.md check was deprecated to a no-op precisely because it conflicted in this org's ALLGREEN merge queue, per prior work), and link-check has no PR-specific fields and this repo sets link-check-fail: false, so neither can fail this gate under merge_group. validate-dependencies (the required Dependency & Standards Validation context) therefore needs no skip-tolerance change here, unlike repos with locally duplicated PR-title/PR-body jobs. Builds on #58 (claude/merge-queue-merge-group-0), which added the missing merge_group trigger to the four workflows that emit this repo's required status-check contexts (CI Gate, Check REUSE Compliance, Dependency & Standards Validation, Security Gate Validation, already correctly bare-named with no naming mismatch) but left this concurrency group unguarded. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/pr-validation.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index 10e29fa..f71c959 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -18,7 +18,12 @@ on: # Cancel in-progress runs for same PR concurrency: - group: pr-validation-${{ github.event.pull_request.number }} + # #ASSUME github.event.pull_request.number is null under merge_group; + # fall back to github.ref (unique per merge-group ref) so a merge-group + # build never collides with, or is cancelled by, a PR build's group. + # #VERIFY confirm no cross-cancellation between a PR run and its + # corresponding merge-group run after the first live merge-queue pass. + group: pr-validation-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true permissions: