From 3263ea9b615eecddcdd44b524bc40e2f2bc75992 Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Sat, 18 Jul 2026 15:46:22 +0100
Subject: [PATCH 1/2] CI: run on merge_group so the merge queue can gate
 entries

Prerequisite for enabling a merge queue on main. The queue builds each
PR against the exact main it will land on and gates it on the required
checks; those checks must trigger on the merge_group event or the queue
hangs forever waiting for a status that never reports. Adds the
merge_group trigger and excludes queue runs from concurrency
cancellation (each entry must complete to merge). Also drops a stale
'both host OSes' comment left from the reverted macOS matrix.

Must land in main BEFORE the queue is enabled.

Assisted-by: Claude:claude-fable-5
---
 .github/workflows/ci.yml | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 79e5a0a..fac5c55 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,34 +1,35 @@
 name: ci
 
 # Lightweight checks on every push and pull request: format, build, vet, and
-# test on macOS and Linux, plus a smoke test of the merge → report pipeline on
-# the bundled sample, full-history secret scanning, and a workflow audit.
+# test on Linux, plus a smoke test of the merge → report pipeline on the bundled
+# sample, full-history secret scanning, and a workflow audit. Also runs on
+# `merge_group` so the same jobs gate each entry the merge queue builds — the
+# queue tests every PR against the exact main it will land on, and its required
+# checks are these same contexts, so they MUST trigger here or the queue hangs.
 on:
   push:
     branches: ['**']
   pull_request:
+  merge_group:
 
-# Cancel superseded runs of the same ref (PRs and branch pushes); a merged
-# default-branch push is never cancelled mid-run because each ref has its own group.
+# Cancel superseded runs of the same ref (PRs and non-default branch pushes).
+# Never cancel a merge-queue run (each queue entry must complete to merge) or a
+# default-branch push; each already has its own ref, so this only affects
+# rapidly-superseded PR/branch pushes.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' && github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}
 
 permissions:
   contents: read
 
 jobs:
-  # Build + vet + test on both host OSes, plus the pipeline smoke. Race-enabled
-  # unit tests catch data races the plain `go test` would miss. The record
-  # package's avfoundation paths are runtime-gated (they shell out to external
-  # tools only when actually recording), so the darwin build and tests compile
-  # and pass without a TTY or capture tooling — the macOS leg stays green.
-  # Ubuntu-only: the darwin build is covered by the release cross-compile, and a
-  # macos-latest leg aborts the demo/record race binaries with a runner-specific
-  # dyld "missing LC_UUID" trap (a GitHub image + race-detector issue, not our
-  # code — the suite is green on a real Mac). A single job named "check" is also
-  # the context branch protection requires; a matrix would rename it and never
-  # report that context.
+  # Build + vet + test + pipeline smoke, race-enabled. Ubuntu-only: the darwin
+  # build is covered by the release cross-compile, and a macos-latest leg aborts
+  # the demo/record race binaries with a runner-specific dyld "missing LC_UUID"
+  # trap (a GitHub image + race-detector issue, not our code — the suite is green
+  # on a real Mac). A single job named "check" is also the context branch
+  # protection requires; a matrix would rename it and never report that context.
   check:
     timeout-minutes: 10
     runs-on: ubuntu-latest

From 5d19a07edb75abc2508f1fd04788fcea047e1de4 Mon Sep 17 00:00:00 2001
From: Alex Reppel <77722411+REPPL@users.noreply.github.com>
Date: Sat, 18 Jul 2026 15:47:14 +0100
Subject: [PATCH 2/2] CI: fix stale zizmor header comment (SARIF upload is off)

The job-header comment still claimed zizmor uploads SARIF to Code
Scanning, contradicting the advanced-security: false config below it
(Code Scanning is not enabled on this repo). Landed via #13; corrected
here alongside the merge_group change to the same file.

Assisted-by: Claude:claude-fable-5
---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fac5c55..5c663da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -112,9 +112,9 @@ jobs:
         run: gitleaks git --redact --no-banner .
 
   # Audit the workflows themselves (pwn requests, template injection, cache
-  # poisoning, unpinned uses). Testimony is public, so zizmor uploads its SARIF
-  # to Code Scanning, surfacing findings in the Security tab; the job also gates
-  # on those findings. A non-zero exit means a finding.
+  # poisoning, unpinned uses). The action runs zizmor and gates on its findings
+  # (a non-zero exit means a finding); SARIF upload to Code Scanning is off — see
+  # the advanced-security note below.
   zizmor:
     timeout-minutes: 10
     runs-on: ubuntu-latest