infra: add Mergify serial merge queue for dev branch

.github/PULL_REQUEST_TEMPLATE.md

@@ -19,12 +19,17 @@
 ## Testing
 - [ ] Tested against a real Azure free trial subscription
 - [ ] Returns correct JSON output
-- [ ] All seven CI checks pass
+- [ ] All CI checks pass (lint, tests, CodeQL, DCO, dependency-review)
 - [ ] No hardcoded credentials or secrets
 
 ## Related issue
 Closes #
 
+## Dependencies
+<!-- List any PRs or issues that must merge before this one. -->
+<!-- Replace "none" with one or more references, e.g. Depends-On: #123 -->
+Depends-On: none
+
 ## Checklist
 - [ ] Every commit includes a DCO `Signed-off-by` trailer (`git commit -s`; see `docs/dco.md`)
 - [ ] My code follows the rule template in CONTRIBUTING.md

.mergify.yml

@@ -0,0 +1,156 @@
+# .mergify.yml
+# Merge-queue configuration for the OpenShield dev branch.
+#
+# This file is inactive until the Mergify GitHub App is installed and
+# authorized for this repository. GitHub Actions remains the CI system.
+# Mergify reads pull-request state and operates the queue; it does not
+# run CI, replace existing workflows, or bypass GitHub branch protection.
+#
+# Related: https://github.com/OWASP/openshield/issues/334
+
+# Limit speculative checks globally so at most one PR is tested at a time.
+# This enforces serial behaviour across the queue.
+merge_queue:
+  max_parallel_checks: 1
+
+queue_rules:
+  - name: default
+    # Restrict queue entry to PRs targeting dev, including manual
+    # @mergifyio queue commands. Without this, a maintainer could
+    # manually queue a PR targeting any branch.
+    queue_conditions:
+      - base=dev
+      - -draft
+      - -label=blocked
+
+    # One PR merged per operation. Combined with max_parallel_checks: 1
+    # above, this gives a fully serial merge queue.
+    batch_size: 1
+
+    # Dequeue a PR whose required checks have not posted within this
+    # window instead of stalling the entire queue indefinitely. The
+    # default ("auto") applies no timeout until enough queue history has
+    # been gathered, so a stuck check on the very first queued PR would
+    # block every subsequent PR forever.
+    checks_timeout: 2 hours
+
+    # These conditions must hold at the moment Mergify merges the PR.
+    # Mergify re-evaluates them after updating against the current dev HEAD.
+    #
+    # CI Summary aggregates all jobs inside ci.yml, including the frontend
+    # build (Frontend (lint + build)) and Astro build and rendered-site
+    # verification (Website (Astro build + verification)). CodeQL runs in a separate workflow
+    # (codeql.yml) and is NOT included in CI Summary; it posts two check
+    # runs named "Analyze (python)" and "Analyze (javascript)", both listed
+    # below.
+    #
+    # External Semgrep app checks (Semgrep OSS, semgrep-cloud-platform/scan)
+    # are deliberately not gated: their coverage duplicates the SAST
+    # (Semgrep) job already gated through CI Summary, and third-party app
+    # checks can vanish if the app is uninstalled or its plan changes,
+    # which would stall the queue permanently.
+    merge_conditions:
+      - check-success=CI Summary
+      - check-success=DCO sign-off
+      - check-success=dependency-review
+      - check-success=Analyze (python)
+      - check-success=Analyze (javascript)
+      # terraform-plan only runs for PRs touching infra/terraform/**. An
+      # unconditional check-success would stall every non-terraform PR
+      # forever. This condition passes when the PR touches no terraform
+      # files; otherwise the check must be green.
+      - or:
+          - -files~=^infra/terraform/
+          - check-success=Terraform fmt / validate / plan
+      - "#approved-reviews-by>=1"
+      # Governance-policy files require project lead (@Vishnu2707) + one
+      # additional maintainer per GOVERNANCE.md §5. MAINTAINERS.md is included
+      # because it names the role-holders referenced by that policy.
+      # This condition enforces that: either the PR does not touch governance
+      # files, or it has two approvals AND the project lead has approved.
+      - or:
+          - -files~=^(GOVERNANCE\.md|MAINTAINERS\.md|\.mergify\.yml|docs/merge-queue\.md)$
+          - and:
+              - "#approved-reviews-by>=2"
+              - approved-reviews-by=Vishnu2707
+      - "#changes-requested-reviews-by=0"
+      - "#review-threads-unresolved=0"
+      - -draft
+      - -label=blocked
+
+pull_request_rules:
+  # Dismiss stale approvals when a new commit is pushed to a dev-targeted PR.
+  # CHANGES_REQUESTED reviews are intentionally NOT dismissed (changes_requested
+  # is explicitly set to false). A reviewer's objection must survive the
+  # contributor's push and be cleared only by the reviewer re-reviewing, or
+  # by a maintainer manually dismissing it via GitHub after verifying the fix
+  # (see the inactive-reviewer process in docs/merge-queue.md).
+  # Auto-dismissing CHANGES_REQUESTED reviews would allow any push followed
+  # by a third-party approval to silently erase a blocking concern without
+  # the original reviewer ever checking the fix.
+  #
+  # Reviewers: use inline conversation threads for every blocking concern.
+  # Threads survive this dismissal and continue to block via
+  # #review-threads-unresolved=0, giving an independent gate beyond the
+  # review verdict itself.
+  - name: dismiss stale approvals on new push
+    conditions:
+      - base=dev
+      # Exclude Mergify's own queue-rebase commits so they don't strip
+      # approvals mid-flight and cause an infinite dequeue/re-approve cycle.
+      - sender!=mergify[bot]
+    actions:
+      dismiss_reviews:
+        approved: true
+        changes_requested: false
+        message: "A new commit was pushed. Please re-review and re-approve before this PR can merge."
+
+  # Queue an eligible PR automatically once all conditions are met.
+  # Entry conditions mirror merge_conditions so only fully green PRs
+  # enter the queue. A PR admitted while a check is still pending
+  # occupies the single queue slot and stalls every PR behind it.
+  - name: add to merge queue when eligible
+    conditions:
+      - base=dev
+      - check-success=CI Summary
+      - check-success=DCO sign-off
+      - check-success=dependency-review
+      - check-success=Analyze (python)
+      - check-success=Analyze (javascript)
+      - or:
+          - -files~=^infra/terraform/
+          - check-success=Terraform fmt / validate / plan
+      - "#approved-reviews-by>=1"
+      - or:
+          - -files~=^(GOVERNANCE\.md|MAINTAINERS\.md|\.mergify\.yml|docs/merge-queue\.md)$
+          - and:
+              - "#approved-reviews-by>=2"
+              - approved-reviews-by=Vishnu2707
+      - "#changes-requested-reviews-by=0"
+      - "#review-threads-unresolved=0"
+      - -draft
+      - -label=blocked
+    actions:
+      queue:
+        name: default
+
+  # Apply awaiting-author when a reviewer has requested changes.
+  - name: label awaiting-author when changes are requested
+    conditions:
+      - base=dev
+      - "#changes-requested-reviews-by>0"
+    actions:
+      label:
+        add:
+          - awaiting-author
+
+  # Remove awaiting-author once all change requests are resolved.
+  - name: remove awaiting-author when no changes are requested
+    conditions:
+      - base=dev
+      - label=awaiting-author
+      - "#changes-requested-reviews-by=0"
+    actions:
+      label:
+        remove:
+          - awaiting-author