[kixelated]

Problem

The rind-queue runner group admits any workflow in moq-dev/rind, so a PR's own workflow, such as an approved fork run, could reach the self-hosted runner. GitHub matches a runner group's selected workflow by its exact ref with no wildcard, and a merge group runs queue.yml from its own gh-readonly-queue/main/pr-<n>-<sha> branch, so the group can't be restricted to queue.yml itself.

Approach

First step of the reusable-workflow restriction the maintainer picked on 2026-11-03 (moq-dev/quest#439, quest runners.md):

• The self-hosted job moves unchanged into .github/workflows/queue-build.yml (on: workflow_call). Its job runs only when the caller's event is merge_group, so a pull request's workflow that calls it still gets no runner.
• queue.yml calls it by its local path for now, so this PR's own merge group runs the new file.
• A reusable workflow's jobs report as Queue build / Build, so a new Queue job on a hosted runner reports the build's result under the context main's ruleset requires. It runs with always() so a failed or cancelled build fails the context rather than skipping it; it skips on pull requests as before.

Next, once this is on main: switch the call to moq-dev/rind/.github/workflows/queue-build.yml@main (a merge group calling @main before the file lands would find no workflow), then the maintainer restricts the group to that workflow at refs/heads/main.

Impact

No public API change. The required Queue context keeps its name; the build now also shows as Queue build / Build.

Alternatives

• Leave the group unrestricted and rely on the one-repository group plus fork approval for every outside contributor (the maintainer declined it: an approval is a click given by mistake).
• Require Queue build / Build in the ruleset instead of a reporting job: needs a ruleset change timed with the workflow change, and the PR-side skip and workflow_dispatch report would need the new name too.

Follow-ups

The @main switch and the restriction, tracked in moq-dev/quest's runners quest.

Validation

just check origin/main passes, including actionlint.

Review

Codex (quest review, gpt-6.1-sol, medium), round 1 on 2a1dbe9 against origin/main bd5066f: no findings.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The merge-group build now runs through a reusable workflow that checks out the repository and runs the CI gate on the self-hosted runner. The required Queue job waits for that workflow and fails unless the build succeeds.

Merge Risk: Minimal · up to 2a1db

The extraction preserves the merge-group build and required Queue result reporting. No actionable merge-blocking issue was found; mergeable subject to normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely states the main change: moving the merge queue build into a reusable workflow.
Description check		The description directly explains the runner restriction problem, the reusable-workflow approach, the preserved Queue context, follow-up work, and validation.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b176a949-11f8-4f97-89ed-592cedd43d88

Commits

Reviewing files that changed from the base of the PR and between bd5066f and 2a1dbe9.

Files selected for processing: 2

• .github/workflows/queue-build.yml
• .github/workflows/queue.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.