@plainconceptsplatform/workflows 1.6.47 → 1.7.0

package/loops/actions/identify-gate-subject/action.yml

@@ -144,7 +144,15 @@ runs:
         if [ -n "$ci_run_id" ]; then
           run_sha="$(gh api "repos/$REPO/actions/runs/$ci_run_id" --jq '.head_sha' 2>/dev/null || true)"
           current_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
-          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ]; then
+          # A conflicting pull request has no merge ref, so CI never runs on its head: the gate keeps
+          # the carried verdict and resolves the conflict. Pliny-Bot #862 was handed to the gate and
+          # declined every five minutes for an hour waiting for a run that could not start.
+          conflicting="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || true)"
+          # A merge-queue run is built on the queue's own branch, so its commit is never the head;
+          # it is the verdict when the train hands over a pull request the queue ejected.
+          run_event="$(gh api "repos/$REPO/actions/runs/$ci_run_id" --jq '.event' 2>/dev/null || true)"
+          [ "$run_event" != merge_group ] || run_sha="$current_sha"
+          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ] && [ "$conflicting" != CONFLICTING ]; then
             echo "::notice::CI run $ci_run_id judged ${run_sha:0:7}, but the head is ${current_sha:0:7}; reading the verdict again from the head."
             ci_conclusion=""
             ci_run_id=""
@@ -154,6 +162,8 @@ runs:
             fi
             ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$fresh")"
             ci_run_id="$(jq -r '.id' <<<"$fresh")"
+          elif [ "$conflicting" = CONFLICTING ]; then
+            echo "::notice::PR #$PR_NUMBER conflicts with its base, so CI cannot run on its head; the gate resolves the conflict."
           fi
         fi
 

package/loops/actions/land-pull-request/action.yml

@@ -0,0 +1,43 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/land-pull-request/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Land pull request
+description: >-
+  Land one pull request the gate or a person approved: into the base branch's merge queue when it
+  has one, otherwise by merging it. The head must still be the commit that was judged.
+
+inputs:
+  token:
+    description: App token with pull-requests and contents write, plus merge queues write where a queue is on.
+    required: true
+  pr:
+    description: The pull request number.
+    required: true
+  head-sha:
+    description: The head commit that was judged. Landing is refused once the branch has moved.
+    required: true
+  approve:
+    description: "'true' to approve the pull request first, so a ruleset's required approval is met by the gate."
+    required: false
+    default: 'false'
+  approval-body:
+    description: The review body that goes with the approval.
+    required: false
+    default: Approved by the merge gate.
+
+outputs:
+  landed:
+    description: "'merged', 'enqueued', or empty when nothing happened."
+    value: ${{ steps.land.outputs.landed }}
+
+runs:
+  using: composite
+  steps:
+    - id: land
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR: ${{ inputs.pr }}
+        HEAD_SHA: ${{ inputs.head-sha }}
+        APPROVE: ${{ inputs.approve }}
+        APPROVAL_BODY: ${{ inputs.approval-body }}
+      run: bash "${GITHUB_ACTION_PATH}/land-pull-request.sh"

package/loops/actions/land-pull-request/land-pull-request.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/land-pull-request/land-pull-request.sh. Update with workflows update --force; consumer edits may be overwritten.
+#
+# Lands one approved pull request. A base branch with a merge queue gets the pull request in the
+# queue, where GitHub builds it on top of what is ahead and merges it; any other base gets a squash
+# merge, as before. The asynchronous merge endpoint is the one that enqueues: the older merge
+# endpoint and auto-merge do not take stacked pull requests.
+set -euo pipefail
+
+: "${REPO:?}" "${PR:?}" "${HEAD_SHA:?}"
+[[ "$PR" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid pull request number: $PR"; exit 1; }
+[[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || { echo "::error::Invalid head commit for #$PR: $HEAD_SHA"; exit 1; }
+
+out() { echo "landed=$1" >> "${GITHUB_OUTPUT:-/dev/null}"; }
+
+pr_json=$(gh pr view "$PR" --repo "$REPO" --json headRefOid,baseRefName,headRefName,state)
+state=$(jq -r .state <<<"$pr_json")
+[ "$state" = OPEN ] || { echo "#$PR is $state; nothing to land."; out ""; exit 0; }
+current=$(jq -r .headRefOid <<<"$pr_json")
+if [ "$current" != "$HEAD_SHA" ]; then
+  echo "::warning::#$PR moved from ${HEAD_SHA:0:7} to ${current:0:7} after it was judged; not landing it."
+  out ""
+  exit 0
+fi
+base=$(jq -r .baseRefName <<<"$pr_json")
+head_ref=$(jq -r .headRefName <<<"$pr_json")
+
+owner=${REPO%%/*}
+name=${REPO#*/}
+queue=$(gh api graphql -f query='query($o:String!,$n:String!,$b:String!){repository(owner:$o,name:$n){mergeQueue(branch:$b){id}}}' \
+  -f o="$owner" -f n="$name" -f b="$base" --jq '.data.repository.mergeQueue.id // ""' 2>/dev/null || true)
+
+if [ "${APPROVE:-false}" = true ]; then
+  # A ruleset that requires an approval counts the App's. Without one this is a record of the verdict.
+  gh api -X POST "repos/$REPO/pulls/$PR/reviews" -f commit_id="$HEAD_SHA" -f event=APPROVE \
+    -f body="${APPROVAL_BODY:-Approved by the merge gate.}" >/dev/null ||
+    echo "::warning::Could not approve #$PR; a required approval will hold it."
+fi
+
+if [ -z "$queue" ]; then
+  gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$HEAD_SHA"
+  # The branch goes as well: nothing else deletes it where `delete_branch_on_merge` is off.
+  gh api -X DELETE "repos/$REPO/git/refs/heads/$head_ref" >/dev/null 2>&1 || true
+  echo "Merged #$PR into $base."
+  out merged
+  exit 0
+fi
+
+pr_id=$(gh pr view "$PR" --repo "$REPO" --json id --jq .id)
+# GraphQL first: the asynchronous merge endpoint refuses a GitHub App with "Enqueuer is not
+# authorized to merge" (Agentic-Workflow-Dogfood, 2026-10-20), while enqueuePullRequest takes the
+# same token. A stacked pull request refuses GraphQL and only the asynchronous endpoint takes it.
+enqueued=$(gh api graphql -f query='mutation($id:ID!,$sha:GitObjectID!){enqueuePullRequest(input:{pullRequestId:$id,expectedHeadOid:$sha}){mergeQueueEntry{state}}}' \
+  -f id="$pr_id" -f sha="$HEAD_SHA" 2>&1 || true)
+if grep -q '"mergeQueueEntry":{' <<<"$enqueued"; then
+  echo "#$PR is in the $base merge queue; GitHub merges it once its group passes."
+  out enqueued
+  exit 0
+fi
+if ! grep -q 'part of a stack' <<<"$enqueued"; then
+  echo "::error::#$PR could not be added to the $base merge queue: $(tr '\n' ' ' <<<"$enqueued" | cut -c1-400)"
+  out ""
+  exit 1
+fi
+
+answer=$(gh api -X PUT "repos/$REPO/pulls/$PR/merge-async" -f merge_action=merge_queue -f sha="$HEAD_SHA")
+status=$(jq -r .status <<<"$answer")
+uuid=$(jq -r '.details.uuid // ""' <<<"$answer")
+for _ in $(seq 1 12); do
+  case "$status" in enqueued | merged) break ;; failed) break ;; esac
+  [ -n "$uuid" ] || break
+  sleep 5
+  answer=$(gh api "repos/$REPO/pulls/$PR/merge-async/$uuid" 2>/dev/null || echo '{}')
+  status=$(jq -r '.status // "pending"' <<<"$answer")
+done
+
+case "$status" in
+  enqueued)
+    echo "#$PR is in the $base merge queue; GitHub merges it once its group passes."
+    out enqueued
+    ;;
+  merged)
+    echo "#$PR merged into $base."
+    out merged
+    ;;
+  *)
+    message=$(jq -r '.details.message // ""' <<<"$answer")
+    # A stack has no other way in, and GitHub refuses an App on this endpoint: a person enqueues it.
+    echo "::error::Stack #$PR did not reach the $base merge queue (status '${status}'${message:+: $message}). GitHub lets a GitHub App enqueue a stack only through this endpoint, which refuses Apps today; a person adds the stack to the queue from the pull request."
+    out ""
+    exit 1
+    ;;
+esac

package/loops/actions/merge-train/action.yml

@@ -50,6 +50,14 @@ inputs:
     description: Decide and report the move without making it.
     required: false
     default: 'false'
+  merge-queue:
+    description: "true when the base branch has GitHub's merge queue (repository variable MERGE_QUEUE): the train stops ordering and updating, and repairs what the queue ejects."
+    required: false
+    default: 'false'
+  ci-depth-tiered:
+    description: "true when the repository's CI runs only light checks on a bot's push and the full CI when the train asks (repository variable CI_DEPTH_TIERED)."
+    required: false
+    default: 'false'
   ci-run-id:
     description: A CI run that handed its verdict over from inside itself, and so still reads as in progress.
     required: false
@@ -78,6 +86,8 @@ runs:
         MAIN_RED_WAIT_HOURS: ${{ inputs.main-red-wait-hours }}
         MAX_REPAIRS: ${{ inputs.max-repairs }}
         DRY_RUN: ${{ inputs.dry-run }}
+        MERGE_QUEUE: ${{ inputs.merge-queue }}
+        CI_DEPTH_TIERED: ${{ inputs.ci-depth-tiered }}
         HINT_RUN_ID: ${{ inputs.ci-run-id }}
         HINT_CONCLUSION: ${{ inputs.ci-conclusion }}
       run: bash "${GITHUB_ACTION_PATH}/merge-train.sh"

package/loops/actions/merge-train/merge-train.sh

@@ -70,6 +70,8 @@ train_move() {
           success)
             if [ "${BEHIND_BY:-0}" -gt 0 ]; then
               move=update; reason="green but ${BEHIND_BY} commit(s) behind its base branch"
+            elif [ "${CI_SHALLOW:-false}" = true ]; then
+              move=deepen; reason="green on the light checks only; the full CI has not run on this head"
             else
               move=gate; reason="green and up to date"
             fi
@@ -199,6 +201,54 @@ act() {
   "$@"
 }
 
+# Tiered CI: the label that asks a pull request's CI for the full depth. The CI's depth job reads the
+# pull request's labels at run time, so a re-run of the same pull_request run turns full: the event and
+# its context stay the pull request's, which the scope, mutation and coverage jobs rely on (a separate
+# workflow_dispatch run would lose it, and mutation runs on pull_request events only).
+CI_FULL_LABEL="ci-full"
+
+mark_full_ci() {
+  local pr="$1"
+  gh label create "$CI_FULL_LABEL" --repo "$REPO" --color 0E8A16 \
+    --description "The CI runs at full depth on this pull request (set by the merge train)" >/dev/null 2>&1 || true
+  gh api -X POST "repos/$REPO/issues/$pr/labels" -f "labels[]=$CI_FULL_LABEL" >/dev/null 2>&1
+}
+
+deepen_ci() {
+  local pr="$1" run="$2"
+  [ -n "$run" ] || return 1
+  mark_full_ci "$pr" || return 1
+  # A CI handover reaches the train from inside the run, and a run still going cannot be re-run.
+  local i
+  for i in 1 2 3 4 5 6 7 8 9 10 11 12; do
+    [ "$(gh api "repos/$REPO/actions/runs/$run" --jq .status 2>/dev/null)" = completed ] && break
+    sleep 10
+  done
+  gh run rerun "$run" --repo "$REPO" >/dev/null 2>&1
+}
+
+# Where a pull request stands in its base branch's merge queue: QUEUED, AWAITING_CHECKS, LOCKED,
+# UNMERGEABLE or MERGEABLE, or empty when it is not in one.
+queue_state() {
+  local pr="$1"
+  gh api graphql -f query='query($o:String!,$n:String!,$p:Int!){repository(owner:$o,name:$n){pullRequest(number:$p){mergeQueueEntry{state}}}}' \
+    -f o="${REPO%%/*}" -f n="${REPO#*/}" -F p="$pr" \
+    --jq '.data.repository.pullRequest.mergeQueueEntry.state // ""' 2>/dev/null || true
+}
+
+# The failed merge-group CI run behind the queue's last ejection of a pull request since its head
+# was pushed, or nothing. The queue names its branches gh-readonly-queue/<base>/pr-<number>-<sha>.
+queue_ejection_run() {
+  local pr="$1" since="$2" removed
+  removed=$(gh api --paginate "repos/$REPO/issues/$pr/timeline?per_page=100" \
+    --jq '.[] | select(.event == "removed_from_merge_queue") | .created_at' 2>/dev/null | sort | tail -1)
+  [ -n "$removed" ] || return 0
+  [ -z "$since" ] || [ "$removed" \> "$since" ] || return 0
+  gh api "repos/$REPO/actions/runs?event=merge_group&per_page=100" \
+    --jq "[.workflow_runs[] | select(.name == env.CI_WORKFLOW_NAME and .conclusion == \"failure\"
+            and (.head_branch | test(\"/pr-$pr-\")))] | sort_by(.created_at) | last | .id // empty" 2>/dev/null || true
+}
+
 is_trusted_bot() {
   case " $TRUSTED_BOTS " in *" $1 "*) return 0 ;; esac
   return 1
@@ -351,6 +401,9 @@ fi
 
 for line in "${candidates[@]}"; do
   IFS=$'\t' read -r pr author head_sha head_ref base_ref hold <<<"$line"
+  # With GitHub's merge queue (MERGE_QUEUE) the queue orders, builds and merges: nothing here waits
+  # for the pull request ahead, brings a branch up to date or asks for a deeper CI.
+  [ "${MERGE_QUEUE:-false}" = true ] && merge_blocked=false
 
   if ! can_ride "$author"; then
     echo "#$pr: opened by $author, who has no write access; not on the train."
@@ -435,6 +488,33 @@ for line in "${candidates[@]}"; do
       success | failure) ci_status=completed; ci_conclusion="$HINT_CONCLUSION" ;;
     esac
   fi
+  # Tiered CI (CI_DEPTH_TIERED): a bot's push runs the light checks and the full CI runs once, when the
+  # pull request is next in line. Pliny-Bot spent two thirds of its pull request CI on heads that were
+  # replaced before they merged. A green run without a successful "Full CI" job was light and says
+  # nothing about the tests. When the jobs cannot be read the run is taken as full, as before.
+  ci_shallow=false
+  if [ "${CI_DEPTH_TIERED:-false}" = true ] && [ "$ci_status" = completed ] && [ "$ci_conclusion" = success ] && [ -n "${ci_run_id:-}" ]; then
+    full_jobs=$(gh api "repos/$REPO/actions/runs/$ci_run_id/jobs?per_page=100" \
+      --jq '[.jobs[] | select((.name | test("(^|/ )Full CI$")) and .conclusion == "success")] | length' 2>/dev/null || echo "")
+    [ "$full_jobs" = 0 ] && ci_shallow=true
+  fi
+  if [ "${MERGE_QUEUE:-false}" = true ]; then
+    # The pull request's own CI is the light one; the full CI runs on the queue's merge group.
+    ci_shallow=false
+    if [ "$(queue_state "$pr")" != "" ]; then
+      echo "#$pr ($author): skip, it is in the merge queue."
+      summary "| #$pr | $author | skip | in the merge queue |"
+      continue
+    fi
+    # The queue ejected it after this head was pushed: the merge group's CI failed on it, or it
+    # conflicted with what was ahead. That run is the verdict the gate repairs from; the pull
+    # request's own green light CI says nothing about it.
+    if ejected_run=$(queue_ejection_run "$pr" "${head_committed:-}"); [ -n "$ejected_run" ]; then
+      ci_run_id="$ejected_run"
+      ci_status=completed
+      ci_conclusion=failure
+    fi
+  fi
   ci_stuck=false
   if [ "$ci_status" != none ] && [ "$ci_status" != completed ] && [ -n "${ci_created:-}" ]; then
     [ $((now_epoch - $(iso_epoch "$ci_created"))) -lt $((STUCK_HOURS * 3600)) ] || ci_stuck=true
@@ -444,7 +524,7 @@ for line in "${candidates[@]}"; do
   behind_by=0
   if [ "$park" = none ] && [ "$hold" != true ] && [ "$review_decision" != CHANGES_REQUESTED ]; then
     mergeable=$(mergeable_state "$pr")
-    if [ "$ci_status" = completed ] && [ "$ci_conclusion" = success ]; then
+    if [ "$ci_status" = completed ] && [ "$ci_conclusion" = success ] && [ "${MERGE_QUEUE:-false}" != true ]; then
       behind_by=$(gh api "repos/$REPO/compare/$base_ref...$head_sha" --jq '.behind_by' 2>/dev/null || echo 0)
     fi
   fi
@@ -503,7 +583,7 @@ for line in "${candidates[@]}"; do
   decision=$(HOLD="$hold" REVIEW_DECISION="$review_decision" PARK="$park" \
     ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" SILENT_GATE="$silent_gate" MERGEABLE="$mergeable" \
     CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" SAME_AS_MAIN="$same_as_main" \
-    BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" train_move)
+    BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" CI_SHALLOW="$ci_shallow" train_move)
   move=$(sed -n 's/^move=//p' <<<"$decision")
   reason=$(sed -n 's/^reason=//p' <<<"$decision")
 
@@ -544,11 +624,30 @@ for line in "${candidates[@]}"; do
       merge_blocked=true
       continue
       ;;
+    deepen)
+      if [ "$merge_blocked" = true ]; then
+        echo "  #$pr waits for the pull request ahead of it before its full CI runs."
+        continue
+      fi
+      if act "Running the full CI on #$pr, which is next in line." deepen_ci "$pr" "${ci_run_id:-}"; then
+        merge_blocked=true
+        continue
+      fi
+      # Never a gate on the light run: it could merge code no test has run on. The pull request is
+      # skipped this tick and the line moves on, so one that cannot be deepened does not stop the rest.
+      echo "::warning::Could not start the full CI on #$pr; it is skipped this tick."
+      continue
+      ;;
     update)
       if [ "$merge_blocked" = true ]; then
         echo "  #$pr waits for the pull request ahead of it before it is brought up to date."
         continue
       fi
+      # Next in line: with tiered CI the run this update starts is the one that decides, so it runs full.
+      if [ "${CI_DEPTH_TIERED:-false}" = true ]; then
+        act "Asking for the full CI on #$pr before it is brought up to date." mark_full_ci "$pr" ||
+          echo "::warning::Could not label #$pr for the full CI; its update runs the light checks."
+      fi
       # Merge, never rebase: the gate's pushes are fast-forward only, and so are a person's.
       if act "Merging $base_ref into #$pr so CI judges it against what it will land on." \
         update_branch "$pr" "$head_sha"; then

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2863,6 +2863,40 @@ else
   FAIL=$((FAIL + 1))
   echo "FAIL: the gate measures a stack child's comments and tests against the default branch" >&2
 fi
+# Tiered CI: the train deepens a light green run instead of gating it, and never gates a light run.
+if grep -qF 'move=deepen' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF 'deepen_ci "$pr" "${ci_run_id:-}"' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF "ci-depth-tiered: \${{ vars.CI_DEPTH_TIERED || 'false' }}" "${WORKFLOWS_DIR}/work-router.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge train does not ask for the full CI before gating a light run" >&2
+fi
+# The implement agent tests only what it changed; the repository's CI runs the full suite.
+if grep -qF 'Test only what you changed; CI tests the rest.' "${WORKFLOWS_DIR}/agent-implement.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: implement tests only what it changed is missing from the prompt" >&2
+fi
+# A conflicting pull request is gated on its carried verdict: CI cannot run on a head with no merge ref.
+if grep -qF '[ "$conflicting" != CONFLICTING ]' "${HERE}/../identify-gate-subject/action.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the gate waits for CI on a conflicting pull request, which never gets a run" >&2
+fi
+# Merge queue: the train hands the queue what it can, repairs what the queue ejects, and the gate lands
+# through the queue when the base branch has one.
+if grep -qF 'queue_ejection_run' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF "merge-queue: \${{ vars.MERGE_QUEUE || 'false' }}" "${WORKFLOWS_DIR}/work-router.yml" &&
+  grep -qF 'enqueuePullRequest' "${HERE}/../land-pull-request/land-pull-request.sh" &&
+  grep -qF 'uses: ./.github/actions/land-pull-request' "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge queue path is incomplete" >&2
+fi
 # An empty AGENT_TIER_MODEL must remove an override a reused runner kept from an earlier job.
 if grep -qF 'rm -f .opencode/harness.user.json' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   PASS=$((PASS + 1))

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -3,6 +3,8 @@ name: "App: CI"
 
 on:
   pull_request:
+  # GitHub's merge queue builds the base plus the pull requests ahead; the full CI runs there.
+  merge_group:
   schedule:
     - cron: "0 6 * * 1"
   workflow_dispatch:
@@ -61,7 +63,7 @@ concurrency:
 jobs:
   api:
     name: API (.NET)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     timeout-minutes: 30
     services:
@@ -168,7 +170,7 @@ jobs:
 
   web:
     name: Web (Next.js)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     timeout-minutes: 15
     steps:
@@ -280,6 +282,23 @@ jobs:
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
 
+  # The merge queue requires this check. On a pull request with MERGE_QUEUE on, the heavy jobs are
+  # skipped and the full CI runs on the merge group instead; skipped counts as passed.
+  full-ci:
+    name: Full CI
+    needs: [api, web]
+    if: always()
+    runs-on: agents-arc
+    timeout-minutes: 5
+    steps:
+      - name: Every heavy job passed
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for result in $RESULTS; do
+            case "$result" in failure | cancelled | timed_out) echo "A heavy job ended $result."; exit 1 ;; esac
+          done
+
   # Hands this run's verdict to the router's merge train, which decides whether this pull request
   # is the one in front and what it needs. A pull request opened or updated with a bot token gets
   # no workflow_run event for its CI (the run's actor is the bot), and the train brings people's

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -3,6 +3,8 @@ name: "App: CI (Node monorepo)"
 
 on:
   pull_request:
+  # GitHub's merge queue builds the base plus the pull requests ahead; the full CI runs there.
+  merge_group:
   schedule:
     - cron: "0 6 * * 1"
   workflow_dispatch:
@@ -50,7 +52,7 @@ jobs:
 
   web:
     name: Web (Next.js static export)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -101,7 +103,7 @@ jobs:
 
   e2e:
     name: E2E (Playwright)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     needs: web
     runs-on: agents-arc
     steps:
@@ -126,7 +128,7 @@ jobs:
 
   desktop:
     name: Desktop (Electron)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     needs: web
     runs-on: agents-arc
     steps:
@@ -151,7 +153,7 @@ jobs:
 
   mobile:
     name: Mobile (Capacitor)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -210,6 +212,23 @@ jobs:
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
 
+  # The merge queue requires this check. On a pull request with MERGE_QUEUE on, the heavy jobs are
+  # skipped and the full CI runs on the merge group instead; skipped counts as passed.
+  full-ci:
+    name: Full CI
+    needs: [web, e2e, desktop, mobile]
+    if: always()
+    runs-on: agents-arc
+    timeout-minutes: 5
+    steps:
+      - name: Every heavy job passed
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for result in $RESULTS; do
+            case "$result" in failure | cancelled | timed_out) echo "A heavy job ended $result."; exit 1 ;; esac
+          done
+
   # Hands this run's verdict to the router's merge train, which decides whether this pull request
   # is the one in front and what it needs. A pull request opened or updated with a bot token gets
   # no workflow_run event for its CI (the run's actor is the bot), and the train brings people's

package/loops/templates/release/github-release.yml

@@ -1,30 +1,30 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/release/github-release.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: Publish GitHub release
-
-on:
-  push:
-    tags:
-      - "v*"
-
-permissions:
-  contents: write
-
-jobs:
-  publish:
-    name: Publish release
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Create or update GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if gh release view "$TAG" >/dev/null 2>&1; then
-            gh release edit "$TAG" --title "$TAG" --generate-notes
-          else
-            gh release create "$TAG" --title "$TAG" --generate-notes
-          fi
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/release/github-release.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Publish GitHub release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: Publish release
+    runs-on: agents-arc
+    timeout-minutes: 10
+    steps:
+      - name: Create or update GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            gh release edit "$TAG" --title "$TAG" --generate-notes
+          else
+            gh release create "$TAG" --title "$TAG" --generate-notes
+          fi

package/loops/workflows/agent-implement.md

@@ -839,6 +839,16 @@ timeout-minutes: 180
 
      Never open a pull request that does not pass them.
 
+     **Test only what you changed; CI tests the rest.** In this run, run the tests that cover the
+     code you touched and nothing wider: the test files you added or edited, and the tests next to
+     the code you changed (web: `pnpm exec vitest related --run <changed files>`; .NET:
+     `dotnet test <the test project> --filter <the test classes>`). Do not run integration,
+     end-to-end, mutation or coverage suites here, and do not run the whole test suite to be safe:
+     the repository's CI runs all of it on your pull request before anything merges, on a runner
+     that has the database and the browsers this sandbox lacks. The verification commands above are
+     the repository's quick check for that reason. A full suite in the agent is the slowest part of
+     a run and repeats what CI does anyway.
+
      **Run them once, on the final tree.** They are slow: Pliny-Bot's `pnpm verify` is about
      twenty minutes of work on this runner. `pc-plan-apply` runs them in its verify step, and
      that run is this one: do not run them again when nothing changed since. Order the end of

package/loops/workflows/agent-merge-gate.md

@@ -610,16 +610,24 @@ jobs:
 
             ${{ needs.subject.outputs.issue != '' && format('Findings and verification on the linked issue: #{0}.', needs.subject.outputs.issue) || 'Findings and verification are in the review comment above.' }} [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
             ${{ env.EVIDENCE_BEFORE_REVIEW == 'true' && contains(fromJson('["human-review","owner-review"]'), needs.validate_output.outputs.outcome) && 'Screenshots of this head follow in their own comment if it carries a verification plan. Approving the pull request merges it.' || '' }}
-      - name: Merge approved pull request
+      - name: Read the head to land
+        id: landing_head
         if: needs.validate_output.outputs.outcome == 'auto-merge' && (needs.subject.outputs.stack_root != 'true' || needs.subject.outputs.root_complete == 'true')
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           PR: ${{ needs.subject.outputs.pr }}
-        run: |
-          set -euo pipefail
-          head_sha=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$head_sha"
+        run: echo "sha=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')" >> "$GITHUB_OUTPUT"
+      # Into the base branch's merge queue when it has one (approved first, so a ruleset's required
+      # approval is the gate's), otherwise merged as before.
+      - name: Merge approved pull request
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && (needs.subject.outputs.stack_root != 'true' || needs.subject.outputs.root_complete == 'true')
+        uses: ./.github/actions/land-pull-request
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          pr: ${{ needs.subject.outputs.pr }}
+          head-sha: ${{ steps.landing_head.outputs.sha }}
+          approve: 'true'
       # The root's own gate run stops here: children may still be landing on the feature
       # branch, and the merge decision for main belongs to a person. The comment says only
       # what a reader needs: the gate held the root, children merge into the feature branch,

package/loops/workflows/release-tag.yml

@@ -29,7 +29,7 @@ jobs:
     name: Tag and publish the release
     if: >-
       startsWith(github.event.head_commit.message, 'chore(release): v')
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

package/loops/workflows/work-router.yml

@@ -862,7 +862,7 @@ jobs:
     # gate. Those run in a group of their own per pull request, in parallel, while everything that
     # may merge still waits its turn on the one belt.
     concurrency:
-      group: ${{ needs.classify.outputs.ci-conclusion == 'failure' && format('merge-repair-{0}', needs.classify.outputs.pr-number) || 'merge-belt' }}
+      group: ${{ needs.classify.outputs.ci-conclusion == 'failure' && format('merge-repair-{0}', needs.classify.outputs.pr-number) || (vars.MERGE_QUEUE == 'true' && format('merge-gate-{0}', needs.classify.outputs.pr-number) || 'merge-belt') }}
       cancel-in-progress: false
       queue: max
     permissions: write-all
@@ -938,6 +938,9 @@ jobs:
           dry-run: ${{ env.MERGE_TRAIN_DRY_RUN }}
           ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
           ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
+          # Repository variable, read by the repository's CI as well: one switch for both sides.
+          ci-depth-tiered: ${{ vars.CI_DEPTH_TIERED || 'false' }}
+          merge-queue: ${{ vars.MERGE_QUEUE || 'false' }}
 
   # The decision the gate parked for: a person with write access approves a pull request the
   # gate handed to them (human-review or owner-review), and the bot merges the commit they
@@ -1012,8 +1015,9 @@ jobs:
             --jq '[.workflow_runs[] | select(.name == env.CI_WORKFLOW_NAME)] | sort_by(.created_at) | last | .conclusion // ""')
           [ "$ci" = success ] || skip "$CI_WORKFLOW_NAME on ${head_sha:0:7} is '${ci:-not run}'"
 
-          gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$head_sha"
-          echo "merged=true" >> "$GITHUB_OUTPUT"
+          # Into the merge queue where the base branch has one, merged otherwise.
+          landed=$(HEAD_SHA="$head_sha" GITHUB_OUTPUT=/dev/stdout bash ./.github/actions/land-pull-request/land-pull-request.sh | sed -n 's/^landed=//p' | tail -1)
+          if [ -n "$landed" ]; then echo "merged=true" >> "$GITHUB_OUTPUT"; fi
       - name: Clear the issue's labels
         if: steps.merge.outputs.merged == 'true' && needs.classify.outputs.linked-issue != ''
         env:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.47",
+  "version": "1.7.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",