Tom Boucher 02c6955162 chore(#4241): add merge_group trigger to test.yml (#4242) ...

* chore(ci): add merge_group trigger to test.yml (#4241)

GitHub's merge queue fires the `merge_group` event for the temporary
merge-group commit it creates when a PR is added to the queue - not
`pull_request` or `push`. Without this trigger, `required-tests` (the
registered "Required tests" branch-protection check) never schedules
for a queued PR, permanently stalling the queue on a check that never
runs. This is workflow-side prerequisite wiring only; enabling the
merge queue itself is a separate manual branch-protection step.

* fix(#4241): pin AUDIT_BASELINE_REF for merge_group events too

Code review on this branch caught that AUDIT_BASELINE_REF's ternary
only branched on pull_request/push, so a merge_group run silently fell
through to '' -- scripts/npm-audit-baseline.cjs's resolveBaselineRef()
documents its origin/next live-tip fallback as unreachable from CI
specifically because AUDIT_BASELINE_REF is "always set by test.yml".
Reopens the exact race #4196 fixed, but only for merge-queue runs.

Extends all three AUDIT_BASELINE_REF pins (test, test-inert, test-full)
to also branch on merge_group, using github.event.merge_group.base_sha
(confirmed against GitHub's own webhook payload schema: "the SHA of the
merge group's parent commit") -- the base tip the temporary
merge-group commit was built against.

Adds a regression test asserting every AUDIT_BASELINE_REF pin branches
on merge_group with the correct field.

---------

Co-authored-by: sim <sim@local>

2026-09-03 15:00:04 -04:00

60 KiB

Raw Blame History

View Raw