From 4ef6bf0663b5b99d5bba473e7db89ec4b3932a6f Mon Sep 17 00:00:00 2001
From: Louis Parkin <louis.parkin@suse.com>
Date: Tue, 25 Aug 2026 11:09:36 +0200
Subject: [PATCH] STAC-25458: run the CI workflows on merge_group

Prerequisite for enabling a merge queue on the default branch. The queue
requires the three 'CI success (...)' roll-up checks to report on the
speculative merge commit, so the workflows have to listen on merge_group
before the ruleset is created. Enabling the queue first would leave every
queued PR waiting on checks that never start until it is ejected.

The trigger is inert until a queue exists, so this is safe to merge on its
own.

No publishing runs on merge_group: every publish, sign and Cerberus job is
already gated on event_name == 'push', as is the await-verification barrier.
The fork guards are spelled event_name != 'pull_request', which is true for
merge_group, so the build and test jobs do run in the queue - which is the
point.

Cache saves are excluded from merge_group. Actions caches written from a
merge_group run are scoped to the throwaway gh-readonly-queue ref, so they
could never be restored by a later build; only the ~270MB per arch of
storage churn would be real. Restores are left ungated, so queue runs still
read the default branch caches.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/build-binaries.yml      | 1 +
 .github/workflows/build-deb.yml           | 5 +++--
 .github/workflows/lint-and-unit-tests.yml | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 686d745eeb09..d995d4f2a76f 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -2,6 +2,7 @@ name: Binary builds
 
 on:
   pull_request:
+  merge_group:
   push:
     branches:
       - stackstate-7.78.2
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 599eefb81c23..6fbfe3a4179a 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -2,6 +2,7 @@ name: DEB package build
 
 on:
   pull_request:
+  merge_group:
   push:
     branches:
       - stackstate-7.78.2
@@ -191,14 +192,14 @@ jobs:
             --install-directory /opt/stackstate-agent
 
       - name: Save omnibus git cache (${{ matrix.arch }})
-        if: github.event_name != 'pull_request' && steps.omnibus-git-cache.outputs.cache-hit != 'true'
+        if: github.event_name != 'pull_request' && github.event_name != 'merge_group' && steps.omnibus-git-cache.outputs.cache-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ env.OMNIBUS_GIT_CACHE_DIR }}
           key: omnibus-git-${{ matrix.arch }}-${{ hashFiles('omnibus/**', 'release.json') }}
 
       - name: Save bazel caches (${{ matrix.arch }})
-        if: github.event_name != 'pull_request' && steps.bazel-cache.outputs.cache-hit != 'true'
+        if: github.event_name != 'pull_request' && github.event_name != 'merge_group' && steps.bazel-cache.outputs.cache-hit != 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
diff --git a/.github/workflows/lint-and-unit-tests.yml b/.github/workflows/lint-and-unit-tests.yml
index dabd08eda56e..52d7a41b0fc2 100644
--- a/.github/workflows/lint-and-unit-tests.yml
+++ b/.github/workflows/lint-and-unit-tests.yml
@@ -2,6 +2,7 @@ name: Lint and unit tests
 
 on:
   pull_request:
+  merge_group:
   push:
     branches:
       - stackstate-7.78.2