no-release: [PE-7420] allow for merge queues

[kivra-pauoli]

Motivation

Increase confidence in our releases by preventing integration bugs.

Description

Currently, concurrent pull requests are often merged out of sequence. This can introduce undetected issues because the changes are tested in isolation against an older base branch rather than the combined latest state.

To prevent this, we are enabling merge queues. This ensures every PR is tested against the most up-to-date state before it is merged. This is particularly helpful for increasing confidence in PRs that modify state-dependent external services.

[Copilot]

🟡 Changes recommended

Three moderate workflow issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates GitHub Actions CI to support merge queues and test current pull-request and queued states before merging.

Changes:

• Adds pull_request and merge_group triggers.
• Restricts push-triggered CI to main.
• Adjusts checkout and Renovate lockfile push behavior.

File summaries

File	Summary	Findings
.github/workflows/ci.yml	Adds merge-queue CI support and updates checkout/push logic.	Three moderate issues: deterministic head SHA checkout (3 votes), preserving required check context (2 votes), and restricting lockfile pushes to same-repository PRs (1 vote).

Review details

Suppressed comments (1)

.github/workflows/ci.yml:67

• This condition also allows fork-originated PRs with a renovate/... head branch into the push logic. Their GITHUB_TOKEN is read-only and origin is the base repository, so the git push fails and marks the PR check unsuccessful; restrict the lock-file push to PRs whose head repository is the current repository.

    - if: github.event_name == 'pull_request'

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The workflow exposes write-capable credentials and weakens base-branch validation.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/ci.yml:31

• This changes pull_request runs from GitHub's synthetic merge ref to the PR head commit. As a result, the check can pass even when the PR no longer builds against the current base branch; the combined-state check only runs after the PR enters a merge queue, so ordinary PR validation and any consumers of this check lose merge-result coverage. Keep the CI checkout on the base repository's merge ref, and use a separate head-branch checkout/push path for the Renovate lock update if that behavior is required.

        repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
        ref: ${{ github.event.pull_request.head.sha || github.ref }}

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite