ci: prepare for merge queue

.github/workflows/actionlint.yml

@@ -8,6 +8,7 @@ on:
     branches:
       - main
       - release-*
+  merge_group:
   pull_request:
 
 # Cancel superseded runs of the same pull request. For everything else
@@ -28,10 +29,3 @@ jobs:
         with:
           persist-credentials: false
       - uses: kjanat/actionlint@1a9278318c43b72cdf644214128fb0786d210147 # v1.17
-
-  all-done-actionlint:
-    needs:
-      - actionlint
-    runs-on: ubuntu-26.04
-    steps:
-    - run: echo "All jobs completed"

.github/workflows/review-policy.yml

@@ -12,6 +12,11 @@ name: review-policy
 on:
   pull_request_review:
     types: [submitted, edited, dismissed]
+  # All required checks must pass in the merge queue, too. The reusable
+  # workflow does nothing for merge_group, since a pull request can only be
+  # added to the queue once this check has passed for it. Note that the
+  # triggers must be set here, as those of a reusable workflow are ignored.
+  merge_group:
 
 permissions: {}
 

.github/workflows/test.yml

@@ -6,6 +6,7 @@ on:
     branches:
       - main
       - release-*
+  merge_group:
   pull_request:
   schedule:
     # Runs at 00:00 UTC every Monday
@@ -75,9 +76,25 @@ jobs:
       run: LIMA_WORKDIR=/tmp/cgroups lima sudo GOTOOLCHAIN=auto CGROUPS_ALLOW_UNSAFE_TESTS=true go test -v ./...
 
   all-done:
+    # Without a status function this job is skipped (not failed) when a needed
+    # job fails, and a skipped required check counts as passing. Run it anyway
+    # and fail if any of the needed jobs has failed or was cancelled (skipped
+    # jobs, e.g. ones not applicable to the event, are fine).
+    if: ${{ !cancelled() }}
     needs:
       - cgroup-v2
       - cgroup-v1
     runs-on: ubuntu-26.04
     steps:
-    - run: echo "All jobs completed"
+    - name: check that all jobs succeeded
+      env:
+        NEEDS: ${{ toJSON(needs) }}
+      run: |
+        failed=$(jq -r 'to_entries[]
+            | select(.value.result != "success" and .value.result != "skipped")
+            | "::error::Job \(.key) result: \(.value.result)"' <<<"$NEEDS")
+        if [ -n "$failed" ]; then
+          echo "$failed"
+          exit 1
+        fi
+        echo "All jobs completed"

.github/workflows/validate.yml

@@ -6,6 +6,7 @@ on:
     branches:
       - main
       - release-*
+  merge_group:
   pull_request:
   schedule:
     # Runs at 00:00 UTC every Monday
@@ -90,6 +91,11 @@ jobs:
         annotations: true
 
   all-done-validate:
+    # Without a status function this job is skipped (not failed) when a needed
+    # job fails, and a skipped required check counts as passing. Run it anyway
+    # and fail if any of the needed jobs has failed or was cancelled (skipped
+    # jobs, e.g. ones not applicable to the event, are fine).
+    if: ${{ !cancelled() }}
     needs:
       - codespell
       - deps
@@ -99,4 +105,15 @@ jobs:
       - zizmor
     runs-on: ubuntu-26.04
     steps:
-    - run: echo "All jobs completed"
+    - name: check that all jobs succeeded
+      env:
+        NEEDS: ${{ toJSON(needs) }}
+      run: |
+        failed=$(jq -r 'to_entries[]
+            | select(.value.result != "success" and .value.result != "skipped")
+            | "::error::Job \(.key) result: \(.value.result)"' <<<"$NEEDS")
+        if [ -n "$failed" ]; then
+          echo "$failed"
+          exit 1
+        fi
+        echo "All jobs completed"