ci: add merge_group trigger to all PR-gating workflows (#5017)

# What does this PR do?

Prepares CI for GitHub merge queue support on main and release-*.x
branches. When merge queues are enabled, queue entries need to trigger
the same checks that run on pull requests.

- Add `merge_group` trigger to all 13 PR-gating workflows
- Fix ci-status.yml concurrency group: use `github.ref` fallback since
`github.event.pull_request.number` is null in merge_group context
- Fix ci-status.yml SHA lookup: use `context.sha` fallback since
`context.payload.pull_request.head.sha` is null in merge_group context
- Scope backward-compat informational jobs (test-integration-release,
check-schema-release-compatibility) to pull_request only — they call `gh
pr comment/view` with the PR number which is unavailable in merge_group
and would crash the job under bash set -e
- Fix integration-tests.yml fork detection: null PR repo field in
merge_group context was incorrectly evaluated as a fork PR

Signed-off-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Francisco Javier Arceo <arceofrancisco@gmail.com>
(cherry picked from commit 1b3623b)

# Conflicts:
#	.github/workflows/ci-status.yml
#	.github/workflows/integration-responses-conversations-auth-tests.yml
#	.github/workflows/openapi-generator-validation.yml
#	.github/workflows/openresponses-conformance.yml

Author: cdoern

.github/workflows/backward-compat.yml

@@ -15,6 +15,10 @@ on:
       - 'src/llama_stack/distributions/**/config.yaml'
       - 'tests/backward_compat/**'
       - '.github/workflows/backward-compat.yml'
+  merge_group:
+    branches:
+      - main
+      - 'release-[0-9]+.[0-9]+.x'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -232,6 +236,7 @@ jobs:
 
   test-integration-release:
     name: Run Integration Tests with Latest Release (Informational)
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
 
     steps:
@@ -401,6 +406,7 @@ jobs:
 
   check-schema-release-compatibility:
     name: Check Schema Compatibility with Latest Release (Informational)
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/ci-status.yml

@@ -0,0 +1,100 @@
+name: CI Status
+
+run-name: Aggregate CI check status
+
+on:
+  pull_request:
+    branches:
+      - main
+      - 'release-[0-9]+.[0-9]+.x'
+  merge_group:
+    branches:
+      - main
+      - 'release-[0-9]+.[0-9]+.x'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci-status:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      checks: read
+    steps:
+      - name: Wait for CI checks to complete
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const sha = context.payload.pull_request?.head.sha ?? context.sha;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Wait for other workflows to get queued
+            core.info('Waiting 60s for CI workflows to get queued...');
+            await new Promise(r => setTimeout(r, 60000));
+
+            const excludedChecks = new Set(['ci-status']);
+            const excludedApps = new Set(['mergify']);
+
+            const terminalStatuses = new Set(['completed']);
+            const successConclusions = new Set(['success', 'skipped', 'neutral']);
+            const failureConclusions = new Set(['failure', 'cancelled', 'timed_out']);
+
+            while (true) {
+              const { data: checkRuns } = await github.rest.checks.listForRef({
+                owner,
+                repo,
+                ref: sha,
+                per_page: 100,
+              });
+
+              // Filter to only GitHub Actions checks, excluding ourselves and bots
+              const relevant = checkRuns.check_runs.filter(cr => {
+                if (excludedChecks.has(cr.name)) return false;
+                if (cr.app && excludedApps.has(cr.app.slug)) return false;
+                // Only include GitHub Actions checks
+                if (!cr.app || cr.app.slug !== 'github-actions') return false;
+                return true;
+              });
+
+              if (relevant.length === 0) {
+                core.info('No other CI checks found yet, waiting...');
+                await new Promise(r => setTimeout(r, 30000));
+                continue;
+              }
+
+              const pending = relevant.filter(cr => !terminalStatuses.has(cr.status));
+              const completed = relevant.filter(cr => terminalStatuses.has(cr.status));
+
+              core.info(`Checks: ${completed.length} completed, ${pending.length} pending out of ${relevant.length} total`);
+
+              for (const cr of completed) {
+                core.info(`  ✓ ${cr.name}: ${cr.conclusion}`);
+              }
+              for (const cr of pending) {
+                core.info(`  ⏳ ${cr.name}: ${cr.status}`);
+              }
+
+              if (pending.length > 0) {
+                core.info('Waiting 30s for pending checks...');
+                await new Promise(r => setTimeout(r, 30000));
+                continue;
+              }
+
+              // All checks completed — evaluate conclusions
+              const failed = completed.filter(cr => failureConclusions.has(cr.conclusion));
+
+              if (failed.length > 0) {
+                for (const cr of failed) {
+                  core.error(`${cr.name} concluded with: ${cr.conclusion}`);
+                }
+                core.setFailed(`${failed.length} CI check(s) failed.`);
+                return;
+              }
+
+              const succeeded = completed.filter(cr => successConclusions.has(cr.conclusion));
+              core.info(`All ${succeeded.length} CI checks passed.`);
+              return;
+            }

.github/workflows/integration-auth-tests.yml

@@ -21,6 +21,10 @@ on:
       - 'requirements.txt'
       - '.github/workflows/integration-auth-tests.yml' # This workflow
       - 'scripts/integration-auth-tests.sh'
+  merge_group:
+    branches:
+      - main
+      - 'release-[0-9]+.[0-9]+.x'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}