Fix repo-sync failures: retry merge and ensure CodeQL runs on all PRs (#59882)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: heiskr

.github/workflows/codeql.yml

@@ -8,10 +8,6 @@ on:
   pull_request:
     branches:
       - main
-    paths:
-      - '**/*.ts'
-      - '**/*.tsx'
-      - '.github/workflows/codeql.yml'
   # This is so that when CodeQL runs on a pull request, it can compare
   # against the state of the base branch.
   push:

.github/workflows/repo-sync.yml

@@ -146,14 +146,30 @@ jobs:
 
             console.log('Merging the pull request')
             // Admin merge pull request to avoid squash
-            await github.rest.pulls.merge({
-              owner,
-              repo,
-              pull_number,
-              merge_method: 'merge',
-            })
-            // Error loud here, so no try/catch
-            console.log('Merged the pull request successfully')
+            // Retry once per minute for up to 15 minutes to wait for required checks (e.g. CodeQL)
+            const maxAttempts = 15
+            const delay = 60_000 // 1 minute
+            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+              try {
+                await github.rest.pulls.merge({
+                  owner,
+                  repo,
+                  pull_number,
+                  merge_method: 'merge',
+                })
+                console.log('Merged the pull request successfully')
+                break
+              } catch (mergeError) {
+                const msg = mergeError.message || mergeError.response?.data?.message || ''
+                const isRuleViolation = mergeError.status === 405 &&
+                  msg.includes('Repository rule violations')
+                if (!isRuleViolation || attempt === maxAttempts) {
+                  throw mergeError
+                }
+                console.log(`Merge blocked by required checks (attempt ${attempt}/${maxAttempts}), retrying in 60s...`)
+                await new Promise(resolve => setTimeout(resolve, delay))
+              }
+            }
 
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() && github.event_name != 'workflow_dispatch' }}