Fix CI checks to run in merge queue - #1654

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/docs-style-check.yml:
- Line 11: The workflow currently uses github.base_ref when building the git
diff for the merge_group run, but github.base_ref is undefined for merge_group
events; update the git diff logic (the step that constructs origin/${{
github.base_ref }}...HEAD) to conditionally use
github.event.merge_group.base_ref when the event is merge_group (i.e., detect
github.event_name == 'merge_group' or check existence of
github.event.merge_group.base_ref) and fall back to github.base_ref otherwise,
ensuring the git diff command uses either github.event.merge_group.base_ref or
github.base_ref appropriately.

---

Outside diff comments:
In @.github/workflows/docs-style-check.yml:
- Around line 45-52: The Vale action step ("🔍 Run Vale" using
errata-ai/[email protected]) currently hard-codes reporter: github-pr-check
which can fail for merge_group/other event contexts; update the workflow to
choose the reporter conditionally (e.g., use github-pr-check only when
github.event_name == 'pull_request' or when running in a PR context, and fall
back to a different reporter like 'github' or 'console' otherwise) so the step
behaves correctly across merge_group runs; locate the step by its name/uses and
change how the reporter input is set (conditional input or separate steps) to
ensure annotations are produced only when PR context supports them.

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In @.github/workflows/pr-builder.yml:
- Around line 100-116: The Dependency Review step using
actions/dependency-review-action@v4 fails for merge_group events because
base/head refs and PR context are not auto-detected; update the "🔎 Dependency
Review" step to explicitly supply base-ref and head-ref when github.event_name
== 'merge_group' (e.g., base-ref: ${{ github.event.pull_request.base.ref }} and
head-ref: ${{ github.event.pull_request.head.ref }} or equivalent fields from
the merge_group payload) and make comment-summary-in-pr conditional (disable or
set to 'never' for merge_group) so the action has required refs and does not
attempt to post a PR summary when PR context is missing.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/pr-builder.yml:
- Line 102: The dependency-review-action@v4 step needs explicit base-ref and
head-ref inputs when run by non-pull_request events (like merge_group); update
the "🔎 Dependency Review" step that uses actions/dependency-review-action@v4 to
add with inputs base-ref and head-ref using the merge_group fallback expressions
(use github.event.merge_group.base_sha || github.event.pull_request.base.sha for
base-ref and github.event.merge_group.head_sha ||
github.event.pull_request.head.sha for head-ref) alongside the existing
fail-on-severity, deny-licenses, and comment-summary-in-pr settings so the
action works for both pull_request and merge_group triggers.
- Line 717: The paths-filter@v3 step is missing explicit base/ref inputs needed
for correct detection on merge_group events; update the step's with block for
the paths-filter action (the paths-filter@v3 step) to include base and ref using
the provided conditional expressions so merge_group uses
github.event.merge_group.base_sha and github.sha while pull_request uses
pull_request.base.sha and pull_request.head.sha (i.e., add base: ${{
github.event_name == 'merge_group' && github.event.merge_group.base_sha ||
github.event.pull_request.base.sha }} and ref: ${{ github.event_name ==
'merge_group' && github.sha || github.event.pull_request.head.sha }}).

---

Nitpick comments:
In @.github/workflows/pr-builder.yml:
- Around line 134-135: The git fetch invocation currently uses a fail-open
pattern ("git fetch origin main:main --update-head-ok || true") which can hide
failures and produce incorrect Nx affected-range calculations; update the fetch
step used in the workflow by removing the "|| true" fallback so that the step
fails on fetch errors (or replace it with an explicit retry/exit-on-failure
strategy), ensuring the command referenced ("git fetch origin main:main
--update-head-ok") returns a nonzero exit code on failure and the workflow/job
halts so Nx's base calculation runs against a valid main branch state.

In `@codecov.yml`:
- Line 61: The codecov.yml currently sets coverage statuses to non-blocking by
using "informational: true" for the project and patch statuses; either change
those flags to "informational: false" in the codecov.yml entries that define the
project and patch status checks (search for the "informational: true" lines and
the surrounding "project" and "patch" status blocks) to make coverage checks
blocking again, or keep them informational and update your branch protection
rules in your repository settings to require the corresponding Codecov status
checks instead.