From f576c81c4c32e44d8218d210d86fefabbbe433cc Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Thu, 2 Jul 2026 14:26:51 +0000
Subject: [PATCH 1/3] Initial plan


From f82a4316b92014ae3415d7ea2cb9c47b9d21d040 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Thu, 2 Jul 2026 14:29:29 +0000
Subject: [PATCH 2/3] ci: add merge_group trigger and skip gitleaks scan on
 unsupported event

Adds merge_group trigger to both CI and Secret Scan workflows for merge
queue support. Guards the gitleaks-action step with an event check since
gitleaks/gitleaks-action@v3 does not support the merge_group event.

The job still runs and succeeds on merge_group (satisfying the required
check), but the actual scan step is skipped. No coverage is lost because
the scan already ran on the pull_request event.

Closes #187

Agent-Logs-Url: https://github.com/BigSimmo/Database/sessions/aa4ae460-f69f-4247-8fa5-0aa6e38244f0

Co-authored-by: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
---
 .github/workflows/ci.yml          | 1 +
 .github/workflows/secret-scan.yml | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b9d9698bd7..ef0db729bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, "release/**"]
   pull_request:
     branches: [main, "release/**"]
+  merge_group:
   workflow_dispatch:
   schedule:
     - cron: "0 18 * * 0"
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index cd49c707f6..a8fb1392aa 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, "release/**"]
   pull_request:
     branches: [main, "release/**"]
+  merge_group:
   workflow_dispatch:
 
 concurrency:
@@ -29,6 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Scan for secrets
+        if: github.event_name != 'merge_group'
         uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 05c03c06b90a80122b8c39ac8d35e205bbc95ee7 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Thu, 2 Jul 2026 14:30:18 +0000
Subject: [PATCH 3/3] ci: add explanatory comment for merge_group skip
 condition

Agent-Logs-Url: https://github.com/BigSimmo/Database/sessions/aa4ae460-f69f-4247-8fa5-0aa6e38244f0

Co-authored-by: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
---
 .github/workflows/secret-scan.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index a8fb1392aa..8d608f2a11 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -30,6 +30,8 @@ jobs:
           persist-credentials: false
 
       - name: Scan for secrets
+        # gitleaks/gitleaks-action@v3 does not support the merge_group event;
+        # the scan already ran on pull_request so skipping here is safe.
         if: github.event_name != 'merge_group'
         uses: gitleaks/gitleaks-action@v3
         env: