@plainconceptsplatform/workflows 1.6.48 → 1.7.1

package/loops/actions/identify-gate-subject/action.yml

@@ -148,6 +148,10 @@ runs:
           # the carried verdict and resolves the conflict. Pliny-Bot #862 was handed to the gate and
           # declined every five minutes for an hour waiting for a run that could not start.
           conflicting="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || true)"
+          # A merge-queue run is built on the queue's own branch, so its commit is never the head;
+          # it is the verdict when the train hands over a pull request the queue ejected.
+          run_event="$(gh api "repos/$REPO/actions/runs/$ci_run_id" --jq '.event' 2>/dev/null || true)"
+          [ "$run_event" != merge_group ] || run_sha="$current_sha"
           if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ] && [ "$conflicting" != CONFLICTING ]; then
             echo "::notice::CI run $ci_run_id judged ${run_sha:0:7}, but the head is ${current_sha:0:7}; reading the verdict again from the head."
             ci_conclusion=""

package/loops/actions/land-pull-request/action.yml

@@ -0,0 +1,43 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/land-pull-request/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Land pull request
+description: >-
+  Land one pull request the gate or a person approved: into the base branch's merge queue when it
+  has one, otherwise by merging it. The head must still be the commit that was judged.
+
+inputs:
+  token:
+    description: App token with pull-requests and contents write, plus merge queues write where a queue is on.
+    required: true
+  pr:
+    description: The pull request number.
+    required: true
+  head-sha:
+    description: The head commit that was judged. Landing is refused once the branch has moved.
+    required: true
+  approve:
+    description: "'true' to approve the pull request first, so a ruleset's required approval is met by the gate."
+    required: false
+    default: 'false'
+  approval-body:
+    description: The review body that goes with the approval.
+    required: false
+    default: Approved by the merge gate.
+
+outputs:
+  landed:
+    description: "'merged', 'enqueued', or empty when nothing happened."
+    value: ${{ steps.land.outputs.landed }}
+
+runs:
+  using: composite
+  steps:
+    - id: land
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR: ${{ inputs.pr }}
+        HEAD_SHA: ${{ inputs.head-sha }}
+        APPROVE: ${{ inputs.approve }}
+        APPROVAL_BODY: ${{ inputs.approval-body }}
+      run: bash "${GITHUB_ACTION_PATH}/land-pull-request.sh"

package/loops/actions/land-pull-request/land-pull-request.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/land-pull-request/land-pull-request.sh. Update with workflows update --force; consumer edits may be overwritten.
+#
+# Lands one approved pull request. A base branch with a merge queue gets the pull request in the
+# queue, where GitHub builds it on top of what is ahead and merges it; any other base gets a squash
+# merge, as before. The asynchronous merge endpoint is the one that enqueues: the older merge
+# endpoint and auto-merge do not take stacked pull requests.
+set -euo pipefail
+
+: "${REPO:?}" "${PR:?}" "${HEAD_SHA:?}"
+[[ "$PR" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid pull request number: $PR"; exit 1; }
+[[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || { echo "::error::Invalid head commit for #$PR: $HEAD_SHA"; exit 1; }
+
+out() { echo "landed=$1" >> "${GITHUB_OUTPUT:-/dev/null}"; }
+
+pr_json=$(gh pr view "$PR" --repo "$REPO" --json headRefOid,baseRefName,headRefName,state)
+state=$(jq -r .state <<<"$pr_json")
+[ "$state" = OPEN ] || { echo "#$PR is $state; nothing to land."; out ""; exit 0; }
+current=$(jq -r .headRefOid <<<"$pr_json")
+if [ "$current" != "$HEAD_SHA" ]; then
+  echo "::warning::#$PR moved from ${HEAD_SHA:0:7} to ${current:0:7} after it was judged; not landing it."
+  out ""
+  exit 0
+fi
+base=$(jq -r .baseRefName <<<"$pr_json")
+head_ref=$(jq -r .headRefName <<<"$pr_json")
+
+owner=${REPO%%/*}
+name=${REPO#*/}
+queue=$(gh api graphql -f query='query($o:String!,$n:String!,$b:String!){repository(owner:$o,name:$n){mergeQueue(branch:$b){id}}}' \
+  -f o="$owner" -f n="$name" -f b="$base" --jq '.data.repository.mergeQueue.id // ""' 2>/dev/null || true)
+
+if [ "${APPROVE:-false}" = true ]; then
+  # A ruleset that requires an approval counts the App's. Without one this is a record of the verdict.
+  gh api -X POST "repos/$REPO/pulls/$PR/reviews" -f commit_id="$HEAD_SHA" -f event=APPROVE \
+    -f body="${APPROVAL_BODY:-Approved by the merge gate.}" >/dev/null ||
+    echo "::warning::Could not approve #$PR; a required approval will hold it."
+fi
+
+if [ -z "$queue" ]; then
+  gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$HEAD_SHA"
+  # The branch goes as well: nothing else deletes it where `delete_branch_on_merge` is off.
+  gh api -X DELETE "repos/$REPO/git/refs/heads/$head_ref" >/dev/null 2>&1 || true
+  echo "Merged #$PR into $base."
+  out merged
+  exit 0
+fi
+
+pr_id=$(gh pr view "$PR" --repo "$REPO" --json id --jq .id)
+# GraphQL first: the asynchronous merge endpoint refuses a GitHub App with "Enqueuer is not
+# authorized to merge" (Agentic-Workflow-Dogfood, 2026-10-20), while enqueuePullRequest takes the
+# same token. A stacked pull request refuses GraphQL and only the asynchronous endpoint takes it.
+enqueued=$(gh api graphql -f query='mutation($id:ID!,$sha:GitObjectID!){enqueuePullRequest(input:{pullRequestId:$id,expectedHeadOid:$sha}){mergeQueueEntry{state}}}' \
+  -f id="$pr_id" -f sha="$HEAD_SHA" 2>&1 || true)
+if grep -q '"mergeQueueEntry":{' <<<"$enqueued"; then
+  echo "#$PR is in the $base merge queue; GitHub merges it once its group passes."
+  out enqueued
+  exit 0
+fi
+if ! grep -q 'part of a stack' <<<"$enqueued"; then
+  echo "::error::#$PR could not be added to the $base merge queue: $(tr '\n' ' ' <<<"$enqueued" | cut -c1-400)"
+  out ""
+  exit 1
+fi
+
+# A stack enters the queue only through merge-async, which refuses a GitHub App there. The App lands
+# it directly instead, through the ruleset's bypass list (it must be on it): every layer has passed its
+# own checks and the gate, and the whole stack lands as one operation.
+answer=$(gh api -X PUT "repos/$REPO/pulls/$PR/merge-async" -f merge_action=direct_merge -f merge_method=squash \
+  -F bypass_rules=true -f sha="$HEAD_SHA")
+status=$(jq -r .status <<<"$answer")
+uuid=$(jq -r '.details.uuid // ""' <<<"$answer")
+for _ in $(seq 1 12); do
+  case "$status" in enqueued | merged) break ;; failed) break ;; esac
+  [ -n "$uuid" ] || break
+  sleep 5
+  answer=$(gh api "repos/$REPO/pulls/$PR/merge-async/$uuid" 2>/dev/null || echo '{}')
+  status=$(jq -r '.status // "pending"' <<<"$answer")
+done
+
+case "$status" in
+  enqueued)
+    echo "#$PR is in the $base merge queue; GitHub merges it once its group passes."
+    out enqueued
+    ;;
+  merged)
+    echo "#$PR merged into $base."
+    out merged
+    ;;
+  *)
+    message=$(jq -r '.details.message // ""' <<<"$answer")
+    echo "::error::Stack #$PR was not merged (status '${status}'${message:+: $message}). The App lands a stack by bypassing the base branch's ruleset, so it must be on that ruleset's bypass list."
+    out ""
+    exit 1
+    ;;
+esac

package/loops/actions/merge-train/action.yml

@@ -50,6 +50,10 @@ inputs:
     description: Decide and report the move without making it.
     required: false
     default: 'false'
+  merge-queue:
+    description: "true when the base branch has GitHub's merge queue (repository variable MERGE_QUEUE): the train stops ordering and updating, and repairs what the queue ejects."
+    required: false
+    default: 'false'
   ci-depth-tiered:
     description: "true when the repository's CI runs only light checks on a bot's push and the full CI when the train asks (repository variable CI_DEPTH_TIERED)."
     required: false
@@ -82,6 +86,7 @@ runs:
         MAIN_RED_WAIT_HOURS: ${{ inputs.main-red-wait-hours }}
         MAX_REPAIRS: ${{ inputs.max-repairs }}
         DRY_RUN: ${{ inputs.dry-run }}
+        MERGE_QUEUE: ${{ inputs.merge-queue }}
         CI_DEPTH_TIERED: ${{ inputs.ci-depth-tiered }}
         HINT_RUN_ID: ${{ inputs.ci-run-id }}
         HINT_CONCLUSION: ${{ inputs.ci-conclusion }}

package/loops/actions/merge-train/merge-train.sh

@@ -227,6 +227,28 @@ deepen_ci() {
   gh run rerun "$run" --repo "$REPO" >/dev/null 2>&1
 }
 
+# Where a pull request stands in its base branch's merge queue: QUEUED, AWAITING_CHECKS, LOCKED,
+# UNMERGEABLE or MERGEABLE, or empty when it is not in one.
+queue_state() {
+  local pr="$1"
+  gh api graphql -f query='query($o:String!,$n:String!,$p:Int!){repository(owner:$o,name:$n){pullRequest(number:$p){mergeQueueEntry{state}}}}' \
+    -f o="${REPO%%/*}" -f n="${REPO#*/}" -F p="$pr" \
+    --jq '.data.repository.pullRequest.mergeQueueEntry.state // ""' 2>/dev/null || true
+}
+
+# The failed merge-group CI run behind the queue's last ejection of a pull request since its head
+# was pushed, or nothing. The queue names its branches gh-readonly-queue/<base>/pr-<number>-<sha>.
+queue_ejection_run() {
+  local pr="$1" since="$2" removed
+  removed=$(gh api --paginate "repos/$REPO/issues/$pr/timeline?per_page=100" \
+    --jq '.[] | select(.event == "removed_from_merge_queue") | .created_at' 2>/dev/null | sort | tail -1)
+  [ -n "$removed" ] || return 0
+  [ -z "$since" ] || [ "$removed" \> "$since" ] || return 0
+  gh api "repos/$REPO/actions/runs?event=merge_group&per_page=100" \
+    --jq "[.workflow_runs[] | select(.name == env.CI_WORKFLOW_NAME and .conclusion == \"failure\"
+            and (.head_branch | test(\"/pr-$pr-\")))] | sort_by(.created_at) | last | .id // empty" 2>/dev/null || true
+}
+
 is_trusted_bot() {
   case " $TRUSTED_BOTS " in *" $1 "*) return 0 ;; esac
   return 1
@@ -379,6 +401,9 @@ fi
 
 for line in "${candidates[@]}"; do
   IFS=$'\t' read -r pr author head_sha head_ref base_ref hold <<<"$line"
+  # With GitHub's merge queue (MERGE_QUEUE) the queue orders, builds and merges: nothing here waits
+  # for the pull request ahead, brings a branch up to date or asks for a deeper CI.
+  [ "${MERGE_QUEUE:-false}" = true ] && merge_blocked=false
 
   if ! can_ride "$author"; then
     echo "#$pr: opened by $author, who has no write access; not on the train."
@@ -473,6 +498,23 @@ for line in "${candidates[@]}"; do
       --jq '[.jobs[] | select((.name | test("(^|/ )Full CI$")) and .conclusion == "success")] | length' 2>/dev/null || echo "")
     [ "$full_jobs" = 0 ] && ci_shallow=true
   fi
+  if [ "${MERGE_QUEUE:-false}" = true ]; then
+    # The pull request's own CI is the light one; the full CI runs on the queue's merge group.
+    ci_shallow=false
+    if [ "$(queue_state "$pr")" != "" ]; then
+      echo "#$pr ($author): skip, it is in the merge queue."
+      summary "| #$pr | $author | skip | in the merge queue |"
+      continue
+    fi
+    # The queue ejected it after this head was pushed: the merge group's CI failed on it, or it
+    # conflicted with what was ahead. That run is the verdict the gate repairs from; the pull
+    # request's own green light CI says nothing about it.
+    if ejected_run=$(queue_ejection_run "$pr" "${head_committed:-}"); [ -n "$ejected_run" ]; then
+      ci_run_id="$ejected_run"
+      ci_status=completed
+      ci_conclusion=failure
+    fi
+  fi
   ci_stuck=false
   if [ "$ci_status" != none ] && [ "$ci_status" != completed ] && [ -n "${ci_created:-}" ]; then
     [ $((now_epoch - $(iso_epoch "$ci_created"))) -lt $((STUCK_HOURS * 3600)) ] || ci_stuck=true
@@ -482,7 +524,7 @@ for line in "${candidates[@]}"; do
   behind_by=0
   if [ "$park" = none ] && [ "$hold" != true ] && [ "$review_decision" != CHANGES_REQUESTED ]; then
     mergeable=$(mergeable_state "$pr")
-    if [ "$ci_status" = completed ] && [ "$ci_conclusion" = success ]; then
+    if [ "$ci_status" = completed ] && [ "$ci_conclusion" = success ] && [ "${MERGE_QUEUE:-false}" != true ]; then
       behind_by=$(gh api "repos/$REPO/compare/$base_ref...$head_sha" --jq '.behind_by' 2>/dev/null || echo 0)
     fi
   fi

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2886,6 +2886,17 @@ else
   FAIL=$((FAIL + 1))
   echo "FAIL: the gate waits for CI on a conflicting pull request, which never gets a run" >&2
 fi
+# Merge queue: the train hands the queue what it can, repairs what the queue ejects, and the gate lands
+# through the queue when the base branch has one.
+if grep -qF 'queue_ejection_run' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF "merge-queue: \${{ vars.MERGE_QUEUE || 'false' }}" "${WORKFLOWS_DIR}/work-router.yml" &&
+  grep -qF 'enqueuePullRequest' "${HERE}/../land-pull-request/land-pull-request.sh" &&
+  grep -qF 'uses: ./.github/actions/land-pull-request' "${WORKFLOWS_DIR}/agent-merge-gate.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge queue path is incomplete" >&2
+fi
 # An empty AGENT_TIER_MODEL must remove an override a reused runner kept from an earlier job.
 if grep -qF 'rm -f .opencode/harness.user.json' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   PASS=$((PASS + 1))

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -3,6 +3,8 @@ name: "App: CI"
 
 on:
   pull_request:
+  # GitHub's merge queue builds the base plus the pull requests ahead; the full CI runs there.
+  merge_group:
   schedule:
     - cron: "0 6 * * 1"
   workflow_dispatch:
@@ -61,7 +63,7 @@ concurrency:
 jobs:
   api:
     name: API (.NET)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     timeout-minutes: 30
     services:
@@ -168,7 +170,7 @@ jobs:
 
   web:
     name: Web (Next.js)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     timeout-minutes: 15
     steps:
@@ -280,6 +282,23 @@ jobs:
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
 
+  # The merge queue requires this check. On a pull request with MERGE_QUEUE on, the heavy jobs are
+  # skipped and the full CI runs on the merge group instead; skipped counts as passed.
+  full-ci:
+    name: Full CI
+    needs: [api, web]
+    if: always()
+    runs-on: agents-arc
+    timeout-minutes: 5
+    steps:
+      - name: Every heavy job passed
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for result in $RESULTS; do
+            case "$result" in failure | cancelled | timed_out) echo "A heavy job ended $result."; exit 1 ;; esac
+          done
+
   # Hands this run's verdict to the router's merge train, which decides whether this pull request
   # is the one in front and what it needs. A pull request opened or updated with a bot token gets
   # no workflow_run event for its CI (the run's actor is the bot), and the train brings people's

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -3,6 +3,8 @@ name: "App: CI (Node monorepo)"
 
 on:
   pull_request:
+  # GitHub's merge queue builds the base plus the pull requests ahead; the full CI runs there.
+  merge_group:
   schedule:
     - cron: "0 6 * * 1"
   workflow_dispatch:
@@ -50,7 +52,7 @@ jobs:
 
   web:
     name: Web (Next.js static export)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -101,7 +103,7 @@ jobs:
 
   e2e:
     name: E2E (Playwright)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     needs: web
     runs-on: agents-arc
     steps:
@@ -126,7 +128,7 @@ jobs:
 
   desktop:
     name: Desktop (Electron)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     needs: web
     runs-on: agents-arc
     steps:
@@ -151,7 +153,7 @@ jobs:
 
   mobile:
     name: Mobile (Capacitor)
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && (github.event_name != 'pull_request' || vars.MERGE_QUEUE != 'true')
     runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -210,6 +212,23 @@ jobs:
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
 
+  # The merge queue requires this check. On a pull request with MERGE_QUEUE on, the heavy jobs are
+  # skipped and the full CI runs on the merge group instead; skipped counts as passed.
+  full-ci:
+    name: Full CI
+    needs: [web, e2e, desktop, mobile]
+    if: always()
+    runs-on: agents-arc
+    timeout-minutes: 5
+    steps:
+      - name: Every heavy job passed
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for result in $RESULTS; do
+            case "$result" in failure | cancelled | timed_out) echo "A heavy job ended $result."; exit 1 ;; esac
+          done
+
   # Hands this run's verdict to the router's merge train, which decides whether this pull request
   # is the one in front and what it needs. A pull request opened or updated with a bot token gets
   # no workflow_run event for its CI (the run's actor is the bot), and the train brings people's

package/loops/templates/release/github-release.yml

@@ -1,30 +1,30 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/release/github-release.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: Publish GitHub release
-
-on:
-  push:
-    tags:
-      - "v*"
-
-permissions:
-  contents: write
-
-jobs:
-  publish:
-    name: Publish release
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Create or update GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TAG: ${{ github.ref_name }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if gh release view "$TAG" >/dev/null 2>&1; then
-            gh release edit "$TAG" --title "$TAG" --generate-notes
-          else
-            gh release create "$TAG" --title "$TAG" --generate-notes
-          fi
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/release/github-release.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Publish GitHub release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: Publish release
+    runs-on: agents-arc
+    timeout-minutes: 10
+    steps:
+      - name: Create or update GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            gh release edit "$TAG" --title "$TAG" --generate-notes
+          else
+            gh release create "$TAG" --title "$TAG" --generate-notes
+          fi

package/loops/workflows/agent-merge-gate.md

@@ -610,16 +610,24 @@ jobs:
 
             ${{ needs.subject.outputs.issue != '' && format('Findings and verification on the linked issue: #{0}.', needs.subject.outputs.issue) || 'Findings and verification are in the review comment above.' }} [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
             ${{ env.EVIDENCE_BEFORE_REVIEW == 'true' && contains(fromJson('["human-review","owner-review"]'), needs.validate_output.outputs.outcome) && 'Screenshots of this head follow in their own comment if it carries a verification plan. Approving the pull request merges it.' || '' }}
-      - name: Merge approved pull request
+      - name: Read the head to land
+        id: landing_head
         if: needs.validate_output.outputs.outcome == 'auto-merge' && (needs.subject.outputs.stack_root != 'true' || needs.subject.outputs.root_complete == 'true')
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           PR: ${{ needs.subject.outputs.pr }}
-        run: |
-          set -euo pipefail
-          head_sha=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$head_sha"
+        run: echo "sha=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')" >> "$GITHUB_OUTPUT"
+      # Into the base branch's merge queue when it has one (approved first, so a ruleset's required
+      # approval is the gate's), otherwise merged as before.
+      - name: Merge approved pull request
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && (needs.subject.outputs.stack_root != 'true' || needs.subject.outputs.root_complete == 'true')
+        uses: ./.github/actions/land-pull-request
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          pr: ${{ needs.subject.outputs.pr }}
+          head-sha: ${{ steps.landing_head.outputs.sha }}
+          approve: 'true'
       # The root's own gate run stops here: children may still be landing on the feature
       # branch, and the merge decision for main belongs to a person. The comment says only
       # what a reader needs: the gate held the root, children merge into the feature branch,

package/loops/workflows/release-tag.yml

@@ -29,7 +29,7 @@ jobs:
     name: Tag and publish the release
     if: >-
       startsWith(github.event.head_commit.message, 'chore(release): v')
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

package/loops/workflows/work-router.yml

@@ -862,7 +862,7 @@ jobs:
     # gate. Those run in a group of their own per pull request, in parallel, while everything that
     # may merge still waits its turn on the one belt.
     concurrency:
-      group: ${{ needs.classify.outputs.ci-conclusion == 'failure' && format('merge-repair-{0}', needs.classify.outputs.pr-number) || 'merge-belt' }}
+      group: ${{ needs.classify.outputs.ci-conclusion == 'failure' && format('merge-repair-{0}', needs.classify.outputs.pr-number) || (vars.MERGE_QUEUE == 'true' && format('merge-gate-{0}', needs.classify.outputs.pr-number) || 'merge-belt') }}
       cancel-in-progress: false
       queue: max
     permissions: write-all
@@ -940,6 +940,7 @@ jobs:
           ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
           # Repository variable, read by the repository's CI as well: one switch for both sides.
           ci-depth-tiered: ${{ vars.CI_DEPTH_TIERED || 'false' }}
+          merge-queue: ${{ vars.MERGE_QUEUE || 'false' }}
 
   # The decision the gate parked for: a person with write access approves a pull request the
   # gate handed to them (human-review or owner-review), and the bot merges the commit they
@@ -1014,8 +1015,9 @@ jobs:
             --jq '[.workflow_runs[] | select(.name == env.CI_WORKFLOW_NAME)] | sort_by(.created_at) | last | .conclusion // ""')
           [ "$ci" = success ] || skip "$CI_WORKFLOW_NAME on ${head_sha:0:7} is '${ci:-not run}'"
 
-          gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$head_sha"
-          echo "merged=true" >> "$GITHUB_OUTPUT"
+          # Into the merge queue where the base branch has one, merged otherwise.
+          landed=$(HEAD_SHA="$head_sha" GITHUB_OUTPUT=/dev/stdout bash ./.github/actions/land-pull-request/land-pull-request.sh | sed -n 's/^landed=//p' | tail -1)
+          if [ -n "$landed" ]; then echo "merged=true" >> "$GITHUB_OUTPUT"; fi
       - name: Clear the issue's labels
         if: steps.merge.outputs.merged == 'true' && needs.classify.outputs.linked-issue != ''
         env:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.48",
+  "version": "1.7.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",