ci: add merge_group trigger to required-check workflows

[williaby]

Summary

• Add merge_group: to workflows emitting required status checks so they fire in the merge queue
• REUSE.toml already covers compliance rollout files; no changes needed there

GitHub merge queues fire a merge_group event, not pull_request. Without the trigger,
required checks never report and the queue stalls indefinitely waiting for them.

Workflows fixed:

• security-analysis.yml (emits: Security Gate Validation)
• pr-validation.yml (emits: Dependency & Standards Validation)
• reuse.yml (emits: Check REUSE Compliance)
• ci.yml (emits: CI Gate)
• sonarcloud.yml (emits: SonarCloud Analysis)

Test plan

• Confirm all required checks pass on this PR
• Add to merge queue and confirm it processes without stalling

Generated with Claude Code

Summary by CodeRabbit

• New Features
  • CI, validation, security, reuse, and code-quality checks now also run for merge queue activity.
  • Existing push, pull request, and manual triggers remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1393b026-03d4-48f6-8b78-ddd69cdb51c3

📥 Commits

Reviewing files that changed from the base of the PR and between 7c2c91e and e73f3e9.

📒 Files selected for processing (5)

• .github/workflows/ci.yml
• .github/workflows/pr-validation.yml
• .github/workflows/reuse.yml
• .github/workflows/security-analysis.yml
• .github/workflows/sonarcloud.yml

---

Walkthrough

Five GitHub Actions workflows (ci.yml, pr-validation.yml, reuse.yml, security-analysis.yml, sonarcloud.yml) each receive one additional event trigger: merge_group. No job logic, steps, or permissions were modified.

Changes

merge_group Trigger Addition

Layer / File(s)	Summary
Add merge_group trigger to all workflows .github/workflows/ci.yml, .github/workflows/pr-validation.yml, .github/workflows/reuse.yml, .github/workflows/security-analysis.yml, .github/workflows/sonarcloud.yml	Each workflow's on: block gains a merge_group entry so all CI checks run during merge queue events.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

ci

Poem

🐇 Five workflows stood in a row,
Waiting for merges to flow.
A queue came along,
With triggers so strong —
Now merge groups put on quite a show! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding merge_group triggers to required-check workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/merge-queue-triggers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None