ci: enable GitHub merge queue with required CI gates

[kevinjqliu]

Which issue does this PR close?

• Closes [discuss] enable github merge queue #3140.

What changes are included in this PR?

Enable GitHub merge queue, same setup as pyiceberg: apache/iceberg-python#3815 (auto-merge) and apache/iceberg-python#3832 (merge queue + required checks).

• .asf.yaml: required check contexts, Merge Queue ruleset (squash, one at a time), allow_auto_merge. Dropped strict since the queue already tests against latest main.
• Required workflows now run on merge_group.
• Removed pull_request path/branch filters from required workflows. A skipped workflow never reports its check, which blocks the PR and the queue entry.
• ci-required and bindings-python-ci-required aggregate jobs so we don't have to list matrix job names in .asf.yaml.

Not required: audit and website.

After this lands, open PRs need a push or close/reopen to pick up the new checks.

Are these changes tested?

Checked that every required context maps to a job that runs on both pull_request and merge_group, and that the aggregate needs lists cover every job. actionlint and zizmor are clean. The ruleset only takes effect once this is on main.

AI Disclosure

Written with Claude Code, reviewed by me.

[kevinjqliu]

this pr changes .asf.yaml which will trigger asf infra to provision merge queue after the pr is merged

[kevinjqliu]

allows this workflow to run in merge queue

[kevinjqliu]

we need to get rid of all paths: filters, otherwise merge queue might be blocked.

i think this is a good tradeoff in order to enable merge queue. and we can look at optimizations at a later time

[kevinjqliu]

add this so we dont need to add all the checks to the contexts: block in .asf.yaml and instead just reference this one check by name.

otherwise we'd have to keep them in sync

[Copilot]

🔵 Needs a closer look

It changes repository-wide merge/branch-protection enforcement and required CI gating, so a human should confirm the new required contexts and merge queue behavior won’t block contributions unexpectedly.

Pull request overview

This PR enables GitHub Merge Queue for the main branch by defining required status check contexts in .asf.yaml, adding a merge-queue ruleset, and ensuring the CI workflows that produce those contexts run on merge_group events without being skipped by path/branch filters.

Changes:

• Configure branch protection required check contexts and a Merge Queue ruleset in .asf.yaml (including enabling auto-merge).
• Update required GitHub Actions workflows to run on merge_group in addition to existing triggers.
• Add “aggregate” required-check jobs (ci-required, bindings-python-ci-required) to avoid having to enumerate matrix job names in branch protection.

File summaries

File	Description
.asf.yaml	Defines required status check contexts for main and adds an active Merge Queue ruleset plus auto-merge enablement.
.github/workflows/ci.yml	Adds merge_group trigger and introduces ci-required aggregate gate over the core Rust CI jobs.
.github/workflows/bindings_python_ci.yml	Adds merge_group trigger and introduces bindings-python-ci-required aggregate gate for the Python bindings CI.
.github/workflows/public-api.yml	Ensures the Public API check runs for merge queue entries via merge_group.
.github/workflows/codeql.yml	Ensures the “Analyze Actions” CodeQL job runs for merge queue entries via merge_group.
.github/workflows/zizmor.yml	Ensures the “Run zizmor 🌈” job runs for merge queue entries via merge_group.
.github/workflows/asf-allowlist-check.yml	Ensures the ASF allowlist checker runs for merge queue entries via merge_group.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.