Repository navigation
A merge no longer repeats the code checks its pull request already passed. PHPCS, PHPStan, YAML lint and PHPUnit depend on nothing but the code, so when the merged tree is identical to the one the pull request tested, and GitHub resolved drupal-qa to the same commit for both runs, a pass is reused and the summary links the run it came from. Deploy checks, Behat, Composer audit and the secret scan still run on every merge: dev is not the multidev, advisories change daily, and the scan reads the merge's own commits.
Anything that can't be proven runs everything, as before: main moved after the pull request's run, a check failed or only warned, a fork, a re-run, a run started by hand, or a workflow without actions: read, which gets a notice saying so. reuse_pr_checks: false turns it off.
The workflow needs actions: read to read the pull request's run. The wizard writes it, and running the wizard again on a v2.1 site shows the one-line change before replacing the file. Composer audit now reads composer.lock directly, so a merge that reuses PHPCS and PHPStan installs nothing.
Validated end to end on a throwaway repository: a merge commit reused all four checks (29 s of runner time against 86 s for a full run); a squash merge ran a PHPCS warning again and reused the rest; a moved main, a missing actions: read and a re-run each ran everything.