[FH-550] prevent pushes from non-default branch

.github/workflows/action.yml

@@ -1,6 +1,7 @@
 name: TypeScript-based Action
 
 on:
+  merge_group:
   pull_request:
   push:
     branches: [main]
@@ -15,7 +16,7 @@
     steps:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
         with:
           use-gha-cache: false
       - name: Install pnpm dependencies

.github/workflows/build.yaml

@@ -1,6 +1,7 @@
 name: Build artifacts
 
 on:
+  merge_group:
   workflow_dispatch:
   workflow_call:
   pull_request:
@@ -20,7 +21,7 @@
 
       - uses: DeterminateSystems/nix-installer-action@main
 
       - uses: DeterminateSystems/magic-nix-cache-action@main
         with:
           use-gha-cache: false
 
@@ -65,7 +66,7 @@
 
       - uses: DeterminateSystems/nix-installer-action@main
 
       - uses: DeterminateSystems/magic-nix-cache-action@main
         with:
           use-gha-cache: false
 

.github/workflows/production-test.yml

@@ -1,27 +1,16 @@
 name: Production test
 
 on:
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - labeled
+  merge_group:
 
 jobs:
   build:
     uses: ./.github/workflows/build.yaml
-    if: |
-      (github.event.action == 'labeled' && github.event.label.name == 'production test')
-      || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'production test'))
 
   production-test:
     needs: build
     runs-on: UbuntuLatest32Cores128G
     timeout-minutes: 5
-    if: |
-      (github.event.action == 'labeled' && github.event.label.name == 'production test')
-      || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'production test'))
     permissions:
       id-token: write # In order to request a JWT for AWS auth
       contents: read # Specifying id-token wiped this out, so manually specify that this action is allowed to checkout this private repo
@@ -30,7 +19,7 @@
 
       - uses: DeterminateSystems/nix-installer-action@main
 
       - uses: DeterminateSystems/magic-nix-cache-action@main
         with:
           use-gha-cache: false
 
@@ -40,9 +29,6 @@
           path: flakehub-push-X64-Linux
 
       - name: Production test
-        if: |
-          (github.event.action == 'labeled' && github.event.label.name == 'production test')
-          || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'production test'))
         uses: ./
         with:
           visibility: "hidden"

.github/workflows/release-prs.yml

@@ -1,6 +1,7 @@
 name: Release PR
 
 on:
+  merge_group:
   pull_request:
     types:
       - opened