{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/github-merge-queue-required-check-event/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/",
        "slug": "github-merge-queue-required-check-event",
        "url": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/github-merge-queue-required-check-event/"
        },
        "title": "Add merge_group checks before requiring a GitHub merge queue",
        "summary": "A passing pull-request check does not replace the status required for the merge queue’s combined revision.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:26+00:00",
        "modified_at": "2026-10-20T18:34:31+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 281,
        "potentially_affected": "This concerns merge-queue CI integration. It does not establish that every existing workflow should run privileged deployment actions on a merge-group event.",
        "dse_recommendation": "DSE recommends inventorying required status names and the workflows that produce them before enabling the queue.",
        "primary_source": {
            "name": "GitHub — Managing a merge queue",
            "url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue",
            "published_on": null,
            "authority": "docs.github.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A passing pull-request check does not replace the status required for the merge queue’s combined revision.</p>\n<h2>Source facts</h2>\n<p>GitHub’s merge queue tests a pull request with the latest target branch and changes already ahead of it. When Actions supplies required checks, workflows must include the merge_group event. That event is separate from pull_request and push. Without the additional trigger, required statuses are not reported for the merge group and the merge fails. Third-party CI has a separate temporary-branch trigger requirement.</p>\n<p>Source: <a href=\"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue\">GitHub — Managing a merge queue</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns merge-queue CI integration. It does not establish that every existing workflow should run privileged deployment actions on a merge-group event.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends inventorying required status names and the workflows that produce them before enabling the queue. Add the appropriate test trigger and examine assumptions about event payloads and revision identifiers. Keep validation builds separate from release jobs unless the release design explicitly calls for them. Assign someone to diagnose missing statuses rather than repeatedly removing and re-adding the same pull request. Keep the expected status names and merge-group revision in the queue acceptance record. Ask the CI owner to confirm that the additional event runs the intended validation steps, and require a separate release decision before attaching privileged deployment work to that trigger.</p>\n<h2>Verification</h2>\n<p>Proposed verification: in an approved test branch, queue a harmless pull request and trace its temporary merge-group revision to the required CI results. Exercise a failing check and inspect the resulting queue decision. Retain the exact revision, trigger and status names so an ordinary pull-request result cannot be mistaken for the combined test.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue\">GitHub — Managing a merge queue</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A passing pull-request check does not replace the status required for the merge queue’s combined revision.\nSource facts\nGitHub’s merge queue tests a pull request with the latest target branch and changes already ahead of it. When Actions supplies required checks, workflows must include the merge_group event. That event is separate from pull_request and push. Without the additional trigger, required statuses are not reported for the merge group and the merge fails. Third-party CI has a separate temporary-branch trigger requirement.\nSource: GitHub — Managing a merge queue.\nApplicability\nThis concerns merge-queue CI integration. It does not establish that every existing workflow should run privileged deployment actions on a merge-group event.\nDSE recommendation\nDSE recommends inventorying required status names and the workflows that produce them before enabling the queue. Add the appropriate test trigger and examine assumptions about event payloads and revision identifiers. Keep validation builds separate from release jobs unless the release design explicitly calls for them. Assign someone to diagnose missing statuses rather than repeatedly removing and re-adding the same pull request. Keep the expected status names and merge-group revision in the queue acceptance record. Ask the CI owner to confirm that the additional event runs the intended validation steps, and require a separate release decision before attaching privileged deployment work to that trigger.\nVerification\nProposed verification: in an approved test branch, queue a harmless pull request and trace its temporary merge-group revision to the required CI results. Exercise a failing check and inspect the resulting queue decision. Retain the exact revision, trigger and status names so an ordinary pull-request result cannot be mistaken for the combined test.\nOfficial reference\nGitHub — Managing a merge queue. Reviewed October 20, 2026.",
        "content_markdown": "A passing pull-request check does not replace the status required for the merge queue’s combined revision.\n\n## Source facts\n\nGitHub’s merge queue tests a pull request with the latest target branch and changes already ahead of it. When Actions supplies required checks, workflows must include the merge_group event. That event is separate from pull_request and push. Without the additional trigger, required statuses are not reported for the merge group and the merge fails. Third-party CI has a separate temporary-branch trigger requirement.\n\nSource: [GitHub — Managing a merge queue](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue).\n\n## Applicability\n\nThis concerns merge-queue CI integration. It does not establish that every existing workflow should run privileged deployment actions on a merge-group event.\n\n## DSE recommendation\n\nDSE recommends inventorying required status names and the workflows that produce them before enabling the queue. Add the appropriate test trigger and examine assumptions about event payloads and revision identifiers. Keep validation builds separate from release jobs unless the release design explicitly calls for them. Assign someone to diagnose missing statuses rather than repeatedly removing and re-adding the same pull request. Keep the expected status names and merge-group revision in the queue acceptance record. Ask the CI owner to confirm that the additional event runs the intended validation steps, and require a separate release decision before attaching privileged deployment work to that trigger.\n\n## Verification\n\nProposed verification: in an approved test branch, queue a harmless pull request and trace its temporary merge-group revision to the required CI results. Exercise a failing check and inspect the resulting queue decision. Retain the exact revision, trigger and status names so an ordinary pull-request result cannot be mistaken for the combined test.\n\n## Official reference\n\n[GitHub — Managing a merge queue](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/",
                "url": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Add merge_group checks before requiring a GitHub merge queue",
                        "item": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/#article",
                "identifier": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/",
                "url": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/",
                "headline": "Add merge_group checks before requiring a GitHub merge queue",
                "description": "A passing pull-request check does not replace the status required for the merge queue’s combined revision.",
                "abstract": "A passing pull-request check does not replace the status required for the merge queue’s combined revision.",
                "articleBody": "A passing pull-request check does not replace the status required for the merge queue’s combined revision.\nSource facts\nGitHub’s merge queue tests a pull request with the latest target branch and changes already ahead of it. When Actions supplies required checks, workflows must include the merge_group event. That event is separate from pull_request and push. Without the additional trigger, required statuses are not reported for the merge group and the merge fails. Third-party CI has a separate temporary-branch trigger requirement.\nSource: GitHub — Managing a merge queue.\nApplicability\nThis concerns merge-queue CI integration. It does not establish that every existing workflow should run privileged deployment actions on a merge-group event.\nDSE recommendation\nDSE recommends inventorying required status names and the workflows that produce them before enabling the queue. Add the appropriate test trigger and examine assumptions about event payloads and revision identifiers. Keep validation builds separate from release jobs unless the release design explicitly calls for them. Assign someone to diagnose missing statuses rather than repeatedly removing and re-adding the same pull request. Keep the expected status names and merge-group revision in the queue acceptance record. Ask the CI owner to confirm that the additional event runs the intended validation steps, and require a separate release decision before attaching privileged deployment work to that trigger.\nVerification\nProposed verification: in an approved test branch, queue a harmless pull request and trace its temporary merge-group revision to the required CI results. Exercise a failing check and inspect the resulting queue decision. Retain the exact revision, trigger and status names so an ordinary pull-request result cannot be mistaken for the combined test.\nOfficial reference\nGitHub — Managing a merge queue. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:26+00:00",
                "dateModified": "2026-10-20T18:34:31+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/github-merge-queue-required-check-event/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Add merge_group checks before requiring a GitHub merge queue"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 281,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitHub — Managing a merge queue",
                    "url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue"
                }
            }
        ]
    }
}