fix(golden): listen on merge_group event so gate posts status under merge queue

This repo uses GitHub's merge queue (per build.yml's existing
merge_group trigger). When a PR enters the queue, GitHub dispatches a
merge_group event against an ephemeral ref, not pull_request. A
required check that only declares on.pull_request never reports a
status on the merge_group event, so the merge queue treats it as
missing/pending and blocks the merge — the same skipped-but-required
failure mode the path-filter pitfall was about, just under a different
trigger.

Mirror build.yml's pattern: listen on both pull_request and
merge_group with the same branch filters. The check_semver_bump.py
script's self-gating (exit 0 when no expected.*.yaml changed) only
helps when the workflow runs at all; this fix makes it run.

Add a small "resolve base ref" step because the two event types
expose the target branch differently: pull_request sets
github.base_ref to the bare branch name; merge_group leaves
base_ref empty and exposes the full ref at
github.event.merge_group.base_ref (e.g. "refs/heads/develop"),
which we strip to match the pull_request shape before passing to
check_semver_bump.py.

Caught by review on PR #9057.

Author: bnusunny

.github/workflows/golden-semver-gate.yml

@@ -1,20 +1,35 @@
 name: Golden Templates Semver Gate
 
-# Always run on PRs to develop / feat branches. The check_semver_bump.py
+# Run on every PR AND on every merge_group event. The check_semver_bump.py
 # script self-gates: it returns exit 0 when no expected.*.yaml files
 # changed, so an unconditional run is cheap and posts a definitive
-# status on every PR. Do NOT use `on.pull_request.paths:` filtering —
-# path filtering skips the whole workflow when no path matches, which
-# means no status is posted, which means branch protection treats a
-# required check as missing/pending and blocks the PR. Self-gating in
-# the script is the canonical fix for the "skipped but required check"
-# pitfall.
+# status on every event.
+#
+# Two pitfalls this trigger configuration avoids — both flavors of the
+# "skipped but required check" problem:
+#
+# 1. on.pull_request.paths: filtering would skip the workflow entirely
+#    when no matching path changed, posting no status, which branch
+#    protection treats as missing/pending. We self-gate in the script
+#    instead so the status always posts.
+#
+# 2. listening on pull_request alone would skip the workflow when a PR
+#    enters the merge queue (which dispatches merge_group, not
+#    pull_request). The merge queue would then treat the required
+#    check as missing/pending and block the merge. We listen on both
+#    events to match build.yml.
 on:
   pull_request:
     branches:
       - develop
       - "feat/*"
       - "feat-*"
+  merge_group:
+    types: [checks_requested]
+    branches:
+      - develop
+      - "feat/*"
+      - "feat-*"
 
 permissions:
   contents: read
@@ -30,9 +45,24 @@ jobs:
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           python-version: "3.11"
+      - name: Resolve base ref
+        id: baseref
+        env:
+          # github.base_ref is set on pull_request events. On merge_group
+          # events it's empty and the target branch lives at
+          # github.event.merge_group.base_ref as a full ref ("refs/heads/develop");
+          # strip the prefix to match the bare branch name pull_request emits.
+          PR_BASE_REF: ${{ github.base_ref }}
+          MG_BASE_REF: ${{ github.event.merge_group.base_ref }}
+        run: |
+          if [ -n "$PR_BASE_REF" ]; then
+            echo "base=$PR_BASE_REF" >> "$GITHUB_OUTPUT"
+          else
+            echo "base=${MG_BASE_REF#refs/heads/}" >> "$GITHUB_OUTPUT"
+          fi
       - name: Run semver gate
         env:
-          BASE_REF: ${{ github.base_ref }}
+          BASE_REF: ${{ steps.baseref.outputs.base }}
         run: |
           python tests/golden/check_semver_bump.py \
             --base "origin/${BASE_REF}" \