ci: prepare checks for merge queue

[jbeckwith-oai]

Summary

• run all required Python CI checks for GitHub merge-group commits
• compare breaking changes against the merge group base SHA
• exclude gh-readonly-queue/** from ordinary push runs

Why

GitHub Actions required checks must subscribe to the separate merge_group: checks_requested event before merge queue can be enabled. Without this prerequisite, queued pull requests can wait indefinitely for checks that never report.

The queue-branch push exclusion makes the merge-group run authoritative and avoids duplicate queue-ref push runs.

Impact

Once the merge queue is enabled, required CI will run again when an approved PR enters the queue, validating the queued commit against the latest main. Existing fork, Stainless staging, Release Please, schedule, and manual-dispatch behavior remains unchanged.

The breaking-change check uses merge_group.base_sha for queued commits while retaining the existing PR and manual base-SHA paths.

Validation

• YAML parsed successfully
• git diff --check
• ./scripts/lint
• required-check trigger and job-gate audit
• thermo-nuclear code-quality review (no findings)

Follow-up

After this PR lands, update the existing main ruleset to enable the merge queue while preserving every existing protection and bypass actor, then independently read back the effective rules and live queue configuration.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 12.204s for Python SDK PR #3574.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	248ms
tests/chat-completions-create.test.ts	✅ Passed	261ms
tests/chat-completions-stream.test.ts	✅ Passed	142ms
tests/files-content-binary.test.ts	✅ Passed	263ms
tests/files-create-multipart.test.ts	✅ Passed	265ms
tests/files-list-pagination.test.ts	✅ Passed	160ms
tests/initialize-config.test.ts	✅ Passed	220ms
tests/instance-isolation.test.ts	✅ Passed	251ms
tests/models-list.test.ts	✅ Passed	209ms
tests/responses-background-lifecycle.test.ts	✅ Passed	243ms
tests/responses-body-method-errors.test.ts	✅ Passed	378ms
tests/responses-cancel-timeout.test.ts	✅ Passed	243ms
tests/responses-cancel.test.ts	✅ Passed	254ms
tests/responses-compact-retries.test.ts	✅ Passed	345ms
tests/responses-compact.test.ts	✅ Passed	246ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	149ms
tests/responses-create-advanced.test.ts	✅ Passed	236ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.292s
tests/responses-create-errors.test.ts	✅ Passed	205ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	253ms
tests/responses-create-retries.test.ts	✅ Passed	358ms
tests/responses-create-stream-failures.test.ts	✅ Passed	142ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	216ms
tests/responses-create-stream-wire.test.ts	✅ Passed	3.967s
tests/responses-create-stream.test.ts	✅ Passed	348ms
tests/responses-create-terminal-states.test.ts	✅ Passed	277ms
tests/responses-create-timeout.test.ts	✅ Passed	241ms
tests/responses-create.test.ts	✅ Passed	365ms
tests/responses-delete.test.ts	✅ Passed	235ms
tests/responses-input-items-errors.test.ts	✅ Passed	396ms
tests/responses-input-items-list.test.ts	✅ Passed	340ms
tests/responses-input-items-options.test.ts	✅ Passed	305ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	270ms
tests/responses-input-tokens-count.test.ts	✅ Passed	270ms
tests/responses-malformed-inputs.test.ts	✅ Passed	3.022s
tests/responses-not-found-errors.test.ts	✅ Passed	348ms
tests/responses-parse.test.ts	✅ Passed	490ms
tests/responses-retrieve-retries.test.ts	✅ Passed	319ms
tests/responses-retrieve.test.ts	✅ Passed	235ms
tests/responses-stored-method-errors.test.ts	✅ Passed	758ms
tests/retry-behavior.test.ts	✅ Passed	3.306s
tests/sdk-error-shape.test.ts	✅ Passed	379ms

View OkTest run #30853018924

_{SDK merge (4bedcd6aa7c2) · head (5099bfb9a017) · base (dd1202d5dacf) · OkTest (91635c6a2723)}

[HAYDEN-OAI]

Approved at 5099bfb9a017f8d71a705a79adebcc330cae6c8c.

All seven required GitHub Actions contexts are covered by merge_group: checks_requested: lint, build, test (Python 3.10), test (Python 3.14), test (HTTPX2), Python support policy, and detect-breaking-changes. Their job gates admit merge-group events, and breaking-change detection compares against the required github.event.merge_group.base_sha with full Git history.

The !gh-readonly-queue/** exclusion follows the positive ** pattern, preventing the competing queue-branch push run and the cancellation failure previously identified in openai/openai-ruby#332. Existing fork PR, Release Please/manual-dispatch, scheduled compatibility, CodeQL/code-quality, and privileged Stainless/PyPI behavior remains appropriately scoped.

The current main ruleset, required reviews and Code Owners, linear history, code-quality protection, all seven required checks, and both bypass actors remain intact; merge queue is correctly still disabled until the separate SQUASH / ALLGREEN / 5 concurrent builds / 1 PR per merge / minimum 1 / 60-minute activation. No substantive issues found.