ci: run only required checks in the merge queue

Merged
JU
1d ago
+73-93

Description

The merge queue on main now runs only the jobs behind its 7 required checks. Integration, Playwright and the Golang coverage snapshot move to a post-merge run on main.

Why

  • The queue merges as soon as the 7 required checks pass: quality-checks, playwright-required, database-tests, backend-check, mypy-check, Jest Tests, required. required and playwright-required come from merge-group.yml, which reuses the PR's verdict (#7080, tested-base #14682).
  • 12 more workflows also ran on merge_group, and nothing waited for them. They are ~27% of runs-on compute, and each queued PR started a full CI run (~470 vCPU per group, 5 at a time). Those bursts fill the vCPU quota and the spot pools.
  • Last 14 days (640 merge groups, from ci.onyx.app): in the queue, Integration failed 91 times, Ext-dep 81, Playwright 40, TF provider 29 and MCP 28. The PRs merged anyway, and none of it left main broken. Push-to-main failures were only Connector Tests, Golang (3) and the Helm release (1). So removing these runs does not lower protection; they never gated a merge.
  • Precedent: #11673 already moved Connector Tests out of the queue to PR + push-to-main, for the same reasons.

Kept on merge_group (required checks): merge-group.yml, pr-quality-checks, pr-database-tests, pr-python-tests, pr-python-checks, pr-jest-tests. The release-branch queue requires only quality / database / backend / mypy, and release branches use their own workflow files.

Removed from merge_group: mcp-compatibility, craft compose integration, craft compose tests, craft k8s, desktop build, external-dependency unit tests, golang, helm chart testing, storybook, terraform provider, integration, playwright. Their PR triggers do not change.

Moved to push to main

  • Integration: full EE + MIT matrix. This keeps the MIT coverage that only the queue ran (#5413). reindex_port is not run on main; PRs (related changes) and the daily run still cover it.
  • Playwright: full suite, the S3 visual-baseline update (only from a fully green run, #8410), and the Okta job (informational on push).
  • Golang: the coverage snapshot for main is published by the push run instead of the queue run.
  • Concurrency: pushes to main share one group and queue (cancel-in-progress: false for push), with one run in progress and the newest pending. A burst of merges gives about 2 runs, and every run finishes. PRs still cancel older runs.

Trade-off: a conflict between two PRs that only integration or Playwright catches shows up on main right after the merge, not before it. That was already the case: nothing in the queue waited for these jobs.

How Has This Been Tested?

  • pre-commit on the changed files: actionlint, zizmor and check-yaml pass. All workflows parse. merge_group stays only in the 6 kept files.
  • After merge, on ci.onyx.app: merge_group compute (Merge queue dashboard) drops; queue time to merge is unchanged; post-merge integration and Playwright runs appear on main (Workflows dashboard); baselines and the golang snapshot keep updating.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

🤖 Generated with Claude Code

Summary by cubic

The merge queue now runs only its required checks. Twelve workflows previously ran on merge_group without gating the merge and consumed ~27% of CI compute, so they are removed from the queue; Integration, Playwright, and the Golang coverage snapshot move to post-merge runs on main.

  • Kept on merge_group: merge-group.yml, pr-quality-checks, pr-database-tests, pr-python-tests, pr-python-checks, and pr-jest-tests; all other workflows keep their PR triggers unchanged.
  • Integration and Playwright now run the full suite on push to main; Playwright also updates S3 baselines (only from a fully green run, #8410) and runs the informational real-Okta job.
  • The Golang coverage snapshot for main is published by the push run instead of the queue run.
  • Push-to-main runs share a concurrency group that queues instead of cancelling, so a burst of merges still produces finished runs.
  • Trade-off: conflicts only Integration or Playwright catch now surface on main after the merge, not before — nothing in the queue waited on those jobs either way.

Summary by CodeRabbit

  • Chores
    • Updated automated validation workflows to run on pull requests, scheduled jobs, manual runs, tagged releases, and selected branch pushes instead of merge-queue events.
    • Standardized change detection so path-based filtering applies to pull requests, while scheduled, manual, and release runs continue with their intended defaults.
    • Improved push handling for the main branch, including integration and browser test execution, baseline updates, coverage publishing, and run cancellation behavior.
    • Updated required-check messaging and workflow documentation.