ci: run required checks for the merge queue

.github/workflows/pull-request-metadata.yml

@@ -1,11 +1,13 @@
 name: Pull Request Metadata
 run-name: >-
   ${{ inputs.request_id && format('{0} [{1}]', github.workflow, inputs.request_id)
-  || github.event.pull_request.title || github.event.head_commit.message || github.workflow }}
+  || github.event.pull_request.title || github.event.head_commit.message
+  || github.event.merge_group.head_commit.message || github.workflow }}
 
 on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
+  merge_group:
   workflow_dispatch:
     inputs:
       pr_number:
@@ -26,8 +28,16 @@ jobs:
     name: Pull Request Metadata
     runs-on: ubuntu-24.04
     steps:
+      # The queue only admits pull requests whose metadata check already passed, so a merge group
+      # reports success instead of skipping: a required check must report for the queue to merge.
+      - name: Accept metadata validated on the pull request
+        if: github.event_name == 'merge_group'
+        run: echo "Pull request metadata was validated on the pull request before it was queued."
+
       - uses: actions/checkout@v4
+        if: github.event_name != 'merge_group'
       - name: Resolve pull request metadata
+        if: github.event_name != 'merge_group'
         env:
           EVENT_NAME: ${{ github.event_name }}
           GH_TOKEN: ${{ github.token }}
@@ -41,6 +51,7 @@ jobs:
           fi
 
       - name: Validate branch, title, and description
+        if: github.event_name != 'merge_group'
         env:
           PR_METADATA_PATH: ${{ runner.temp }}/pull-request.json
         run: python -m scripts.validate_pr_metadata --metadata-file "${PR_METADATA_PATH}"

.github/workflows/verify.yml

@@ -2,14 +2,17 @@ name: Verify
 
 on:
   pull_request:
+  merge_group:
   workflow_dispatch:
 
 permissions:
   contents: read
 
+# Each merge group has its own gh-readonly-queue ref, so queued groups never cancel each other; the
+# queue itself discards a group's run when it rebuilds the group.
 concurrency:
-  group: verify-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: verify-${{ github.workflow }}-${{ github.event.merge_group.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
 
 jobs:
   changes:
@@ -32,8 +35,8 @@ jobs:
         id: scope
         env:
           EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
         run: |
           write_scope() {
             {
@@ -48,7 +51,19 @@ jobs:
             } >> "${GITHUB_OUTPUT}"
           }
 
-          if [[ "${EVENT_NAME}" != "pull_request" ]]; then
+          if [[ "${EVENT_NAME}" != "pull_request" && "${EVENT_NAME}" != "merge_group" ]]; then
+            write_scope true true true true true true true true
+            exit 0
+          fi
+
+          # A merge group's head is its base plus every queued pull request ahead of and including
+          # this one, so the base..head diff covers the whole group. Anything that prevents an exact
+          # diff runs everything rather than risk skipping a suite. Three dots compare with the merge
+          # base, so changes that landed on main after a branch started are not counted as its own.
+          changed_paths="${RUNNER_TEMP}/changed-paths"
+          if [[ -z "${BASE_SHA}" || -z "${HEAD_SHA}" ]] || \
+             ! git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}" > "${changed_paths}"; then
+            echo "Could not diff ${BASE_SHA:-<none>}...${HEAD_SHA:-<none>}; running every suite" >&2
             write_scope true true true true true true true true
             exit 0
           fi
@@ -135,9 +150,7 @@ jobs:
                 broad=true
                 ;;
             esac
-          # Three dots: compare with the merge base, so changes that landed on main after the branch
-          # started are not counted as this pull request's changes.
-          done < <(git diff --name-only -z "${BASE_SHA}...${HEAD_SHA}")
+          done < "${changed_paths}"
 
           if [[ "${changed}" != "true" ]]; then
             write_scope true true true true true true true true
@@ -590,7 +603,7 @@ jobs:
       - name: Check out the comparison base
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.base.sha || 'main' }}
+          ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'main' }}
           path: base
       - uses: astral-sh/setup-uv@v5
         with:

.github/workflows/version-guard.yml

@@ -1,7 +1,8 @@
 name: Version Guard
 run-name: >-
   ${{ inputs.request_id && format('{0} [{1}]', github.workflow, inputs.request_id)
-  || github.event.pull_request.title || github.event.head_commit.message || github.workflow }}
+  || github.event.pull_request.title || github.event.head_commit.message
+  || github.event.merge_group.head_commit.message || github.workflow }}
 
 on:
   pull_request:
@@ -10,6 +11,8 @@ on:
   push:
     branches:
       - main
+  # Checks out the merge group's head, so the version that would land on main is the one checked.
+  merge_group:
   workflow_dispatch:
     inputs:
       request_id: