From dcd991882eb01828c8ba129e0d68d00b28317322 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Thu, 2 Jul 2026 22:19:55 +0800
Subject: [PATCH 1/2] ci: trigger required checks on merge_group (prep for
 merge queue)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the merge_group event to the CI and Secret Scan workflows so
verify, ui-smoke, and Gitleaks run on merge-queue entries. This must
land on main BEFORE a merge_queue ruleset rule is enabled — otherwise
enqueued PRs would never receive their required checks and hang.

Main-only steps (deployment boot smoke, release-browser-matrix) stay
gated on github.ref == refs/heads/main, so they do not run for queue
branches (gh-readonly-queue/*), keeping queue builds fast and free of
the secrets-gated / flaky matrix jobs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml          | 3 +++
 .github/workflows/secret-scan.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b9d9698bd7..b720179076 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
     branches: [main, "release/**"]
   pull_request:
     branches: [main, "release/**"]
+  # Required so verify + ui-smoke run on merge-queue entries; without this the
+  # queue would never receive these checks and enqueued PRs would hang.
+  merge_group:
   workflow_dispatch:
   schedule:
     - cron: "0 18 * * 0"
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index cd49c707f6..33cca93917 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -5,6 +5,9 @@ on:
     branches: [main, "release/**"]
   pull_request:
     branches: [main, "release/**"]
+  # Required so Gitleaks runs on merge-queue entries; without this the queue
+  # would never receive this check and enqueued PRs would hang.
+  merge_group:
   workflow_dispatch:
 
 concurrency:

From b104891839689b8c3f92cccf7cddfdbdae7281a5 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Thu, 2 Jul 2026 22:36:28 +0800
Subject: [PATCH 2/2] ci: guard gitleaks-action against unsupported merge_group
 event
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gitleaks-action@v3's supportedEvents excludes merge_group and it exits
with "ERROR: The [merge_group] event is not yet supported" — which would
make the required Gitleaks check fail for every merge-queue entry and
block all merges once the queue is enabled (caught in review).

Run the action for push/pull_request/dispatch (the real scan, which
happens before a PR can enter the queue) and satisfy the required check
on merge_group with a documented no-op: merging already-scanned commits
cannot introduce new secret material, so PR-time scanning is sufficient.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/secret-scan.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 33cca93917..4ecc2290a7 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -31,7 +31,20 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      # gitleaks-action@v3's supportedEvents excludes merge_group; on that event
+      # it exits with "ERROR: The [merge_group] event is not yet supported",
+      # which would make the required Gitleaks check fail for every queued PR.
+      # Run the action for push/pull_request/dispatch, where the real scan
+      # happens before a PR can enter the queue.
       - name: Scan for secrets
+        if: github.event_name != 'merge_group'
         uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # In the merge queue, secrets were already scanned at pull_request time and
+      # merging already-scanned commits cannot introduce new secret material, so
+      # this satisfies the required Gitleaks check without the unsupported event.
+      - name: Secret scan (merge queue)
+        if: github.event_name == 'merge_group'
+        run: echo "Secrets scanned at pull_request time; gitleaks-action does not support merge_group, so the queue relies on that scan."