ci: init pr.yml and merge-queue.yml workflows

These workflows will serve as top-level entry points for running GHA
jobs against PRs and merge groups in the merge queue.

Currently, the only required job is `lint`, which runs treefmt.

Author: MattSturgeon

.github/workflows/lint.yml

@@ -1,13 +1,7 @@
 name: lint
 
 on:
-  pull_request:
-    paths-ignore:
-      - "**.md"
-      - "**.svg"
-      - ".gitignore"
-      - "LICENSE"
-      - "flake.lock"
+  workflow_call:
 
 jobs:
   treefmt:

.github/workflows/merge-queue.yml

@@ -0,0 +1,29 @@
+name: Merge Queue
+
+on:
+  merge_group:
+
+permissions: {}
+
+jobs:
+  lint:
+    uses: ./.github/workflows/lint.yml
+
+  # This job's only purpose is to serve as a target for the "Required Status Checks" branch ruleset.
+  # It "needs" all the jobs that should block the Merge Queue.
+  # If they pass, it is skipped — which counts as "success" for purposes of the branch ruleset.
+  # However, if any of them fail, this job will also fail — thus blocking the branch ruleset.
+  no-pr-failures:
+    # Modify this list to add or remove jobs from required status checks.
+    needs:
+      - lint
+
+    # WARNING:
+    # Do NOT change the name of this job, otherwise the rule will not catch it anymore.
+    # This would prevent all PRs from passing the merge queue.
+    name: no PR failures
+    # The "cancelled()" function only checks the whole workflow, but not individual jobs.
+    if: ${{ failure() || contains(needs.*.result, 'cancelled') }}
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - run: exit 1

.github/workflows/pr.yml

@@ -0,0 +1,33 @@
+name: PR
+
+on:
+  pull_request:
+
+concurrency:
+  group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  lint:
+    uses: ./.github/workflows/lint.yml
+
+  # This job's only purpose is to serve as a target for the "Required Status Checks" branch ruleset.
+  # It "needs" all the jobs that should block merging a PR.
+  # If they pass, it is skipped — which counts as "success" for purposes of the branch ruleset.
+  # However, if any of them fail, this job will also fail — thus blocking the branch ruleset.
+  no-pr-failures:
+    # Modify this list to add or remove jobs from required status checks.
+    needs:
+      - lint
+
+    # WARNING:
+    # Do NOT change the name of this job, otherwise the rule will not catch it anymore.
+    # This would prevent all PRs from merging.
+    name: no PR failures
+    # The "cancelled()" function only checks the whole workflow, but not individual jobs.
+    if: ${{ failure() || contains(needs.*.result, 'cancelled') }}
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - run: exit 1