molecule-core/.github/workflows/check-merge-group-trigger.yml

name: Check merge_group trigger on required workflows

# Stub workflow — Gitea Actions has no merge queue (post-2026-05-06
# SCM migration off GitHub).
#
# Why this is a stub, not a real linter:
#
# 1. The original workflow existed exclusively to lint that any
#    workflow producing a required status check on the staging branch
#    also declares a `merge_group:` trigger. Without that trigger,
#    GitHub's merge queue dead-locks at AWAITING_CHECKS forever
#    because the required check can't fire on `gh-readonly-queue/...`
#    refs (a GitHub-merge-queue-specific ref shape).
#
# 2. Gitea has no merge queue. There is no `gh-readonly-queue/...`
#    ref shape on Gitea. There is no `merge_group` event type in the
#    Gitea Actions trigger surface. The deadlock pattern this linter
#    catches CANNOT occur on the new SCM, by construction.
#
# 3. The original linter additionally called
#    `gh api repos/.../branches/staging/protection/required_status_checks`,
#    which on Gitea returns 404 — Gitea's branch-protection API lives
#    at `/repos/{owner}/{repo}/branch_protections/{name}` (different
#    path), and the response shape uses `status_check_contexts`
#    instead of `contexts`. So the linter would have failed to fetch
#    the required-check list even if Gitea had a merge queue.
#
# What this stub preserves:
#
# - Workflow name `Check merge_group trigger on required workflows`
#   is unchanged so any external surface that referenced it (none
#   confirmed via branch-protection audit 2026-05-07) keeps resolving.
# - Trigger surface (pull_request, push, merge_group). The
#   merge_group: trigger is a no-op on Gitea (the event never fires)
#   but kept declared so the workflow file itself stays a faithful
#   subscriber to anything that DID fire it on the GitHub side, in
#   case we ever migrate back.
#
# Re-enabling real linting (future work):
#
# - If/when Gitea grows a merge queue (none on the roadmap as of
#   2026-05-07), reinstate the linter using
#   `/api/v1/repos/.../branch_protections/{branch}` to read the
#   required-check list (.status_check_contexts), then walk
#   workflow files for the appropriate Gitea-shape trigger.
# - Alternative invariant worth checking on Gitea today: that any
#   workflow producing a status_check_context declared in branch
#   protection has at least one non-skipped path through to a
#   terminal step (the "required check name needs a job that always
#   runs" invariant from saved memory
#   feedback_branch_protection_check_name_parity). That linter
#   exists separately as `branch-protection-drift.yml` so this stub
#   doesn't need to also cover it.
#
# Until merge-queue semantics return to this fleet, the stub keeps
# the workflow surface visible in Gitea's Actions UI so the next
# operator notices it's a stub instead of a missing surface, and
# emits success so the surrounding chain isn't artificially red.
#
# Issue tracking: post-#66 sweep tracked in #75 (class D — `gh api`
# REST passthroughs that have no Gitea v1 equivalent).

on:
  pull_request:
    paths:
      - '.github/workflows/**.yml'
      - '.github/workflows/**.yaml'
  push:
    branches: [staging, main]
    paths:
      - '.github/workflows/**.yml'
      - '.github/workflows/**.yaml'
  # Self-listen on merge_group is structurally a no-op on Gitea; kept
  # declared for parity with the GitHub-era contract.
  merge_group:
    types: [checks_requested]

jobs:
  check:
    name: Required workflows have merge_group trigger
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Stub — Gitea has no merge queue
        shell: bash
        run: |
          set -euo pipefail
          cat <<'EOF'
          merge_group-trigger linter is a no-op on Gitea Actions.

          Reason: Gitea has no merge queue. The dead-lock pattern this
          linter catches (required check missing merge_group: trigger
          → AWAITING_CHECKS forever on gh-readonly-queue refs) cannot
          occur on this SCM by construction.

          Adjacent live linters that DO catch real Gitea-shape failure
          modes:
            - branch-protection-drift.yml — guards the protection rules
            - check-name parity gate (PR #56, issue #144) — guards
              that path-filtered workflows still emit required checks

          Issue: #75 (post-#66 gh-CLI sweep, class D — gh api REST
          calls that have no Gitea v1 equivalent).
          EOF
          echo "::notice::merge_group-trigger linter is a stub on Gitea — see workflow file header for context."