ci: use GitHub merge queue (#40130)

Requiring branches to be up to date reruns the full CI matrix on every
waiting PR after each merge, which saturates our 20 concurrent jobs. A
merge queue still tests against the latest `main`, but once per batch.

This runs the PR workflows on `merge_group` and reports `giteabot/lgtm`
on queue commits, since GiteaBot only sets it on PR heads. Mergers queue
PRs with "Merge when ready" instead of `reviewed/wait-merge`, so
giteabot no longer updates branches. Nothing changes until the
`merge-queue` ruleset is enabled and "Require branches to be up to date"
is turned off. Backport to `release/v28` before the ruleset covers it.

---------

Co-authored-by: silverwind <me@silverwind.io>

.github/workflows/giteabot-backport.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: go-gitea/giteabot@36ea99f821fefa3e8fb26aeac6211735664cd9c0 # v1.3.1
+      - uses: go-gitea/giteabot@b830f7aa810e43afc1b2f8e8968a30754e6ff5d3 # v1.4.1
         with:
           github_token: ${{ secrets.GITEABOT_TOKEN }}
           gitea_fork: giteabot/gitea

.github/workflows/giteabot.yml

@@ -1,16 +1,11 @@
 name: giteabot
 
 on:
-  # When main advances, rerun merge queue maintenance so the oldest
-  # reviewed/wait-merge PR can be updated against the new base promptly.
-  push:
-    branches:
-      - main
   # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
   # forks, which the bot needs to write labels, statuses and comments. Safe here
   # because the job only runs a pinned action and never checks out PR HEAD.
-  # These PR lifecycle events drive label maintenance, queue maintenance, and
-  # explicit bot actions triggered by relevant label changes.
+  # These PR lifecycle events drive label maintenance, lgtm, and explicit bot
+  # actions triggered by relevant label changes.
   pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
@@ -26,8 +21,7 @@ on:
       - giteabot-review
     types:
       - requested
-  # Periodic maintenance is still useful as a backstop for queue cleanup and
-  # other housekeeping, even though main pushes now trigger it promptly.
+  # Daily housekeeping like locks, stale feedback issues, last calls and milestones
   schedule:
     - cron: "15 3 * * *"
   # Allow maintainers to rerun selected checks manually when debugging bot
@@ -37,7 +31,7 @@ on:
       checks:
         description: Comma-separated list of non-backport checks to run
         required: false
-        default: backport_branches,labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
+        default: backport_branches,labels,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
 
 permissions: {}
 
@@ -56,7 +50,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      - uses: go-gitea/giteabot@36ea99f821fefa3e8fb26aeac6211735664cd9c0 # v1.3.1
+      - uses: go-gitea/giteabot@b830f7aa810e43afc1b2f8e8968a30754e6ff5d3 # v1.4.1
         with:
           github_token: ${{ secrets.GITEABOT_TOKEN }}
-          checks: ${{ github.event.inputs.checks || 'backport_branches,labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
+          checks: ${{ github.event.inputs.checks || 'backport_branches,labels,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}

.github/workflows/merge-group.yml

@@ -0,0 +1,16 @@
+name: merge-group
+
+# Reports the required giteabot/lgtm check on merge queue commits. giteabot only sets it
+# on PR heads, which already passed it before entering the queue.
+
+on:
+  merge_group:
+
+permissions: {}
+
+jobs:
+  lgtm:
+    name: giteabot/lgtm
+    runs-on: ubuntu-latest
+    steps:
+      - run: "true"

.github/workflows/pull-compliance.yml

@@ -2,6 +2,7 @@ name: compliance
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/pull-db-tests.yml

@@ -2,6 +2,7 @@ name: db-tests
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/pull-e2e-tests.yml

@@ -2,6 +2,7 @@ name: e2e-tests
 
 on:
   pull_request:
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

docs/community-governance.md

@@ -74,15 +74,13 @@ Changes to Gitea must be reviewed before they are accepted, including changes fr
 
 We require two maintainer approvals for every PR. When that is satisfied, your PR gets the `lgtm/done` label. After that, you mainly fix merge conflicts and respond to or implement maintainer requests; maintainers drive getting the PR merged.
 
-If a PR has `lgtm/done`, no open discussions, and no merge conflicts, any maintainer may add `reviewed/wait-merge`. That puts the PR in the merge queue. PRs are merged from the queue in the order of this list:
+If a PR has `lgtm/done`, no open discussions, and no merge conflicts, a merger rewrites its title and description into the final [commit message](#commit-messages) and clicks **Merge when ready**. That adds the PR to the [merge queue](https://github.com/go-gitea/gitea/queue/main), which tests it on top of the latest `main` and the PRs ahead of it, and merges it once CI passes. Edits to the title and description no longer reach the commit once the queue starts building the PR, so make them before queueing.
 
-<https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>
-
-Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. The backporter:
+Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. It:
 
+- Counts maintainer approvals and sets the `lgtm/*` labels and the `giteabot/lgtm` status.
+- Takes a PR out of the merge queue when it loses its approval.
 - Creates a backport PR when needed after the initial PR merges.
-- Removes the PR from the merge queue after it merges.
-- Keeps the oldest branch in the merge queue up to date with merges.
 
 ### Final call
 
@@ -164,7 +162,7 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:
 
-- Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
+- Adding PRs to the [merge queue](#getting-prs-merged) once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
 - Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
   In particular, mergers should edit the PR description.\
   Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.