From 8c525da8b7c4dd7f31d75f63972d731e536464fb Mon Sep 17 00:00:00 2001
From: Justin Beckwith <jbeckwith@openai.com>
Date: Wed, 21 Oct 2026 18:55:25 -0700
Subject: [PATCH] ci: qualify next analysis checks for merge groups

---
 .github/workflows/codeql.yml                  |  8 +++++++-
 .github/workflows/detect-breaking-changes.yml | 16 +++++++++++++---
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f59c0560ba..6d0d01286d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,8 +5,12 @@ on:
     branches:
       - main
   pull_request:
+    types: [opened, synchronize, reopened, edited]
     branches:
       - main
+      - next
+  merge_group:
+    types: [checks_requested]
   workflow_dispatch:
 
 permissions:
@@ -15,13 +19,15 @@ permissions:
 
 jobs:
   analyze:
-    name: Analyze Python
+    name: ${{ ((github.event_name == 'pull_request' && github.base_ref == 'next') || (github.event_name == 'merge_group' && github.event.merge_group.base_ref == 'refs/heads/next')) && 'Analyze Python (next)' || 'Analyze Python' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4
diff --git a/.github/workflows/detect-breaking-changes.yml b/.github/workflows/detect-breaking-changes.yml
index e4d332ba65..a192c6e729 100644
--- a/.github/workflows/detect-breaking-changes.yml
+++ b/.github/workflows/detect-breaking-changes.yml
@@ -1,9 +1,12 @@
 name: CI
 on:
   pull_request:
+    types: [opened, synchronize, reopened, edited]
     branches:
       - main
       - next
+  merge_group:
+    types: [checks_requested]
   workflow_dispatch:
     inputs:
       release_pr:
@@ -22,10 +25,10 @@ permissions:
 jobs:
   detect_breaking_changes:
     runs-on: 'ubuntu-latest'
-    name: detect-breaking-changes
-    if: github.repository == 'openai/openai-python' && (github.event_name == 'pull_request' || (inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main'))
+    name: ${{ ((github.event_name == 'pull_request' && github.base_ref == 'next') || (github.event_name == 'merge_group' && github.event.merge_group.base_ref == 'refs/heads/next')) && 'detect-breaking-changes (next)' || 'detect-breaking-changes' }}
+    if: github.repository == 'openai/openai-python' && (github.event_name == 'pull_request' || github.event_name == 'merge_group' || (inputs.release_pr && github.ref == 'refs/heads/release-please--branches--main'))
     env:
-      BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || inputs.base_sha }}
+      BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || (github.event_name == 'merge_group' && github.event.merge_group.base_sha) || inputs.base_sha }}
       FETCH_DEPTH: 0
     steps:
       - name: Calculate fetch-depth
@@ -41,6 +44,13 @@ jobs:
           fetch-depth: ${{ env.FETCH_DEPTH }}
           persist-credentials: false
 
+      - name: Validate comparison baseline
+        shell: bash
+        run: |
+          [[ "$BASE_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "Invalid comparison base SHA"; exit 1; }
+          git cat-file -e "$BASE_SHA^{commit}"
+          git merge-base --is-ancestor "$BASE_SHA" HEAD
+
       - name: Set up uv
         uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with: