Add mergify merge queue configuration file (#4917)

* Add mergify.yml.

* Abstract out CI jobs to a "success" job so that a change in the CI jobs don't require modification to mergify configuration on stable branch.

* Add new jobs to the `needs` list of  `test-suite-success`.

* Set `batch_max_wait_time` to 60 s.

.github/mergify.yml

@@ -0,0 +1,13 @@
+queue_rules:
+  - name: default
+    batch_size: 8
+    batch_max_wait_time: 60 s
+    checks_timeout: 10800 s
+    merge_method: squash
+    queue_conditions:
+      - "#approved-reviews-by >= 1"
+      - "check-success=license/cla"
+      - "check-success=target-branch-check"
+    merge_conditions:
+      - "check-success=test-suite-success"
+      - "check-success=local-testnet-success"

.github/workflows/local-testnet.yml

@@ -87,3 +87,14 @@ jobs:
       - name: Stop local testnet with blinded block production
         run: ./stop_local_testnet.sh
         working-directory: scripts/local_testnet
+
+  # This job succeeds ONLY IF all others succeed. It is used by the merge queue to determine whether
+  # a PR is safe to merge. New jobs should be added here.
+  local-testnet-success:
+    name: local-testnet-success
+    runs-on: ubuntu-latest
+    needs: ["run-local-testnet"]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Check that success job is dependent on all others
+        run: ./scripts/ci/check-success-job.sh ./.github/workflows/local-testnet.yml local-testnet-success

.github/workflows/test-suite.yml

@@ -423,3 +423,36 @@ jobs:
         cache-target: release
     - name: Run Makefile to trigger the bash script
       run: make cli
+  # This job succeeds ONLY IF all others succeed. It is used by the merge queue to determine whether
+  # a PR is safe to merge. New jobs should be added here.
+  test-suite-success:
+    name: test-suite-success
+    runs-on: ubuntu-latest
+    needs: [
+      'target-branch-check',
+      'release-tests-ubuntu',
+      'release-tests-windows',
+      'beacon-chain-tests',
+      'op-pool-tests',
+      'network-tests',
+      'slasher-tests',
+      'debug-tests-ubuntu',
+      'state-transition-vectors-ubuntu',
+      'ef-tests-ubuntu',
+      'dockerfile-ubuntu',
+      'eth1-simulator-ubuntu',
+      'merge-transition-ubuntu',
+      'no-eth1-simulator-ubuntu',
+      'syncing-simulator-ubuntu',
+      'doppelganger-protection-test',
+      'execution-engine-integration-ubuntu',
+      'check-code',
+      'check-msrv',
+      'cargo-udeps',
+      'compile-with-beta-compiler',
+      'cli-check',
+    ]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Check that success job is dependent on all others
+        run: ./scripts/ci/check-success-job.sh ./.github/workflows/test-suite.yml test-suite-success

scripts/ci/check-success-job.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Check that $SUCCESS_JOB depends on all other jobs in the given $YAML
+
+set -euf -o pipefail
+
+YAML=$1
+SUCCESS_JOB=$2
+
+yq '... comments="" | .jobs | map(. | key) | .[]' < "$YAML" | grep -v "$SUCCESS_JOB" | sort > all_jobs.txt
+yq "... comments=\"\" | .jobs.$SUCCESS_JOB.needs[]" < "$YAML" | grep -v "$SUCCESS_JOB" | sort > dep_jobs.txt
+diff all_jobs.txt dep_jobs.txt || (echo "COMPLETENESS CHECK FAILED" && exit 1)
+rm all_jobs.txt dep_jobs.txt
+echo "COMPLETENESS CHECK PASSED"