ci(merge-queue): only run queue job when the queue label is added

[jeduden]

What

Guard the queue job in .github/workflows/merge-queue.yml so the merge-queue action only engages when the label that triggered the run is queue, or on manual workflow_dispatch:

if: >-
  github.event_name == 'workflow_dispatch' ||
  github.event.label.name == 'queue'

Why

The workflow triggers on pull_request: types: [labeled] — i.e. on any label being added — and the job unconditionally ran jeduden/merge-queue-action, which requires token: ${{ secrets.MERGE_QUEUE_TOKEN }}.

On Dependabot PRs, GitHub withholds repository secrets from the run, so the token resolved to empty and the action failed immediately with:

##[error]Input required and not supplied: token

This surfaced on #716 (bump golang.org/x/tools): the queue check went red the moment Dependabot's auto-applied dependencies / go labels landed, even though every other check was green.

Effect

• Non-queue label events (Dependabot's dependencies/go, or any stray human label) skip the job cleanly — a skipped check, not a red failure.
• The merge-queue action still runs exactly as before when a maintainer adds the queue label, or on manual dispatch.
• No secret is exposed to Dependabot-authored runs — the fix is a trigger guard, not a permissions change.

Note: queue is not a required status check (the workflow never runs on an unlabeled PR), so the previous red X was non-blocking but noisy. This removes the noise and stops the action from firing on unrelated labels.

🤖 Generated with Claude Code

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.63%. Comparing base (f012907) to head (dd46c36).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

Components	Coverage Δ
Go	98.62% <ø> (ø)
TypeScript	99.54% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR updates the merge-queue GitHub Actions workflow to avoid running the merge-queue job on unrelated pull_request:labeled events (notably Dependabot’s auto-applied labels), preventing noisy failures when repository secrets are unavailable.

Changes:

• Add a job-level if: guard so the queue job runs only for workflow_dispatch or when the added label is exactly queue.
• Document why the guard is needed (Dependabot-labeled runs do not receive MERGE_QUEUE_TOKEN).

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[jeduden]

🟢 Merge Queue — picked up

This PR is in the queue and will be batched with other queue-labelled PRs.

Next: No action needed — you'll get another comment when CI starts on the batch. View merge queue run.

[jeduden]

🔵 Merge Queue — CI running

Merged into batch branch merge-queue/batch-717-1782928204. View CI run.

Next: No action needed — you'll be notified when CI completes.

[jeduden]

✅ Merge Queue — merged

This PR landed on main via commit 1be6c16. CI run that validated the merge.

Next: Done — nothing more to do here.