ci: run the merge queue build in its own reusable workflow

.github/workflows/queue-build.yml

@@ -0,0 +1,32 @@
+name: Queue build
+
+# The merge queue's build of a group, on the host's self-hosted runner. Only
+# queue.yml calls it. Once queue.yml calls it at main and the rust2-queue runner
+# group admits only this workflow at refs/heads/main, no other workflow can
+# reach the runner, an approved fork run's included; a PR's edit to this file
+# then runs only after it lands.
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build
+    # A caller's own event decides this, so a pull request's workflow that
+    # calls this file still gets no runner.
+    if: github.event_name == 'merge_group'
+    runs-on: [self-hosted, rust2-queue]
+    # Below the queue's 90-minute response window, so a hung build reports
+    # before the group expires.
+    timeout-minutes: 60
+    env:
+      BASE: ${{ github.event.merge_group.base_sha }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Check and test the merge group
+        run: nix develop --command quest gate just ci "$BASE"

.github/workflows/queue.yml

@@ -39,24 +39,33 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # The build runs in queue-build.yml so its runner group can admit that
+  # workflow alone; see that file. This calls the merge group's own copy until
+  # that file is on main, when the call moves to
+  # moq-dev/rust2/.github/workflows/queue-build.yml@main.
+  build:
+    name: Queue build
+    if: github.event_name == 'merge_group'
+    uses: ./.github/workflows/queue-build.yml
+
+  # The required context. A reusable workflow's jobs report as
+  # `Queue build / Build`, so this job reports the build's result under the
+  # name main's ruleset requires. It skips with the build on pull requests, and
+  # runs even when the build fails or is cancelled, since a skipped context
+  # would pass the group.
   queue:
     name: Queue
-    if: github.event_name == 'merge_group'
-    runs-on: [self-hosted, rust2-queue]
-    # Below the queue's 90-minute response window, so a hung build reports
-    # before the group expires.
-    timeout-minutes: 60
-    env:
-      BASE: ${{ github.event.merge_group.base_sha }}
+    needs: build
+    if: always() && github.event_name == 'merge_group'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-      - name: Check and test the merge group
-        run: nix develop --command quest gate just ci "$BASE"
+      - name: Require the build to pass
+        env:
+          RESULT: ${{ needs.build.result }}
+        run: '[[ "$RESULT" == success ]] || { echo "::error::the queue build ended $RESULT" >&2; exit 1; }'
 
-  # The merge queue still builds every group with the job above; this only
+  # The merge queue still builds every group with the jobs above; this only
   # satisfies the PR-side requirement, as a pull_request run's skipped job does.
   report:
     name: Report Queue