[leowilkin]

Problem

The merge queue waits for the required checks to pass on its gh-readonly-queue/main/pr-* branch. No workflow triggers on merge_group. ci.yml, rubocop.yml, brakeman.yml and vale.yml only run on pull_request and on push to main, and the queue branch matches neither, so the checks never report. A queued PR then sits there until the queue's status-check timeout drops it.

This is what's holding #316. Its queue branch gh-readonly-queue/main/pr-316-0a51127… has no workflow runs, and the repo has never had a merge_group run.

Changes

merge_group: is added to the on: triggers of ci.yml, rubocop.yml, brakeman.yml and vale.yml. None of their jobs read pull-request context:

• The lint cache key falls back to its default suffix off main.
• Brakeman's SARIF upload supports merge-group runs.

bundler-audit.yml is left alone. It runs nightly and on dependency changes, and isn't a per-PR check.

Merging this

This has to land before the queue can merge anything that depends on these checks. A PR going through the queue with these checks required is blocked by the same problem, so it needs merging directly (admin bypass) or with the queue requirement briefly off.

CodeQL (default setup) and Socket Security aren't workflows in this repo. If either is a required check, whether it reports on queue branches is controlled in its own settings, not here.

Testing

• The four workflow files parse as YAML, and each on: now lists merge_group.
• The real test is the next queued PR getting checks on its gh-readonly-queue/* branch.

---

---

Generated by Claude Code