ci: add merge_group trigger to required-check workflows

.github/workflows/ci.yml

@@ -10,6 +10,7 @@
 name: CI
 
 on:
+  merge_group:
   push:
     branches: [main, master, develop]
   pull_request:
@@ -95,11 +96,11 @@
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install workspace dependencies
         run: uv sync --all-extras
 
       - name: Run tests with coverage
         run: |
           uv run pytest packages/cloudflare-auth/tests \
             --cov=packages/cloudflare-auth/src/cloudflare_auth \
             --cov-report=xml:coverage-cloudflare-auth.xml \
             --cov-report=term-missing \
@@ -108,10 +109,10 @@
             -v
 
       - name: Run type checker
         run: uv run basedpyright packages/cloudflare-auth/src/
 
       - name: Run linter
         run: uv run ruff check packages/cloudflare-auth/
 
       - name: Upload coverage artifact
         if: matrix.python-version == '3.12'
@@ -150,11 +151,11 @@
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install workspace dependencies
         run: uv sync --all-extras
 
       - name: Run tests with coverage
         run: |
           uv run pytest packages/gcs-utilities/tests \
             --cov=packages/gcs-utilities/src/gcs_utilities \
             --cov-report=xml:coverage-gcs-utilities.xml \
             --cov-report=term-missing \
@@ -163,10 +164,10 @@
             -v
 
       - name: Run type checker
         run: uv run basedpyright packages/gcs-utilities/src/
 
       - name: Run linter
         run: uv run ruff check packages/gcs-utilities/
 
       - name: Upload coverage artifact
         if: matrix.python-version == '3.12'
@@ -201,11 +202,11 @@
         run: uv python install 3.12
 
       - name: Install dependencies
         run: uv sync --all-extras
 
       - name: Run Bandit security scan
         run: |
           uv run bandit -r packages/cloudflare-auth/src/ packages/gcs-utilities/src/ -c pyproject.toml || true
 
   # Upload combined coverage to Codecov
   coverage:

.github/workflows/pr-validation.yml

@@ -8,6 +8,7 @@
 name: PR Validation
 
 on:
+  merge_group:
   pull_request:
     types: [opened, synchronize, reopened]
     branches:
@@ -17,7 +18,12 @@
 
 # Cancel in-progress runs for same PR
 concurrency:
-  group: pr-validation-${{ github.event.pull_request.number }}
+  # #ASSUME github.event.pull_request.number is null under merge_group;
+  # fall back to github.ref (unique per merge-group ref) so a merge-group
+  # build never collides with, or is cancelled by, a PR build's group.
+  # #VERIFY confirm no cross-cancellation between a PR run and its
+  # corresponding merge-group run after the first live merge-queue pass.
+  group: pr-validation-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:
@@ -72,12 +78,12 @@
         run: uv python install 3.12
 
       - name: Install dependencies
         run: uv sync --all-extras
 
       - name: Run vulture
         run: |
           echo "## Dead Code Report" >> $GITHUB_STEP_SUMMARY
           uv run vulture src/ packages/ --min-confidence 90 | tee vulture-report.txt || true
           if [ -s vulture-report.txt ]; then
             echo '```' >> $GITHUB_STEP_SUMMARY
             cat vulture-report.txt >> $GITHUB_STEP_SUMMARY

.github/workflows/reuse.yml

@@ -6,6 +6,7 @@
 name: REUSE Compliance
 
 on:
+  merge_group:
   # No paths filter: "Check REUSE Compliance" is a REQUIRED status check, so it
   # must report on every PR. A paths filter would skip the workflow on changes
   # that do not match (e.g. root-only files like renovate.json, since "**/*"

.github/workflows/security-analysis.yml

@@ -10,6 +10,7 @@
 name: Security Analysis
 
 "on":
+  merge_group:
   push:
     branches: [main, master]
   pull_request:
@@ -51,10 +52,10 @@
         run: uv python install 3.12
 
       - name: Install dependencies
         run: uv sync --all-extras
 
       - name: Run Bandit security scan
         run: uv run bandit -r src/ -c pyproject.toml -f json -o bandit-report.json || true
 
       - name: Run OSV-Scanner dependency scan
         uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8