feat: add merge queue to osac-test-infra, grant wg-infra bypass on github-config

[omer-vishlitzky]

Summary

osac-test-infra:

• Add merge queue with same settings as osac (REBASE, ALLGREEN, batch 4)
• Add required status checks (e2e gates + check-labels)
• Add wg-infra as ruleset bypass team
• Remove push_allowances (conflicts with merge queue bot)

github-config:

• Add wg-infra team with admin permission
• Add wg-infra as ruleset bypass team (can force merge)

Dependencies

Depends on osac-test-infra PR adding label-gate, e2e gate jobs, and auto-queue workflows.

Test plan

• Verify osac-test-infra PRs go through merge queue after workflow PR lands
• Verify wg-infra members can bypass and merge directly on github-config

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added merge queue support to repository rulesets when configured.
  • Increased merge queue capacity and added required status checks.
  • Added administrative access and ruleset bypass permissions for the GitHub configuration repository.

• Bug Fixes

  • Direct pushes are now blocked when merge queue enforcement is enabled.
  • Replaced legacy push allowance settings with ruleset-based controls for test infrastructure.

[coderabbitai]

Walkthrough

The changes add conditional merge queue bypass and pull-request enforcement to the repository ruleset. Repository configurations grant wg-infra access, replace push allowances with ruleset controls and required status checks, and update merge queue build limits.

Changes

Merge queue rulesets

Layer / File(s)	Summary
Ruleset merge queue support modules/common_repository/main.tf	The ruleset conditionally allows GitHub Merge Queue rebased commits and requires pull requests when merge queue is enabled.
Repository merge queue configuration repositories.tf	The configuration grants wg-infra admin and bypass access, removes classic push allowances, adds required status checks, and configures merge queue build limits.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MergeQueue
  participant RepositoryRuleset
  participant GitHubRepository
  MergeQueue->>RepositoryRuleset: Push rebased commit
  RepositoryRuleset->>GitHubRepository: Apply Integration bypass
  GitHubRepository-->>MergeQueue: Accept commit
  RepositoryRuleset->>GitHubRepository: Require pull request

Loading

Possibly related PRs

• osac-project/github-config#134: Extends the same merge-queue ruleset and repository configuration.
• osac-project/github-config#137: Configures related ruleset bypass actors and status checks.
• osac-project/github-config#185: Extends related merge-queue rules and repository settings.

Suggested reviewers: eliorerz, eranco74, larsks

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: adding merge queue support and granting wg-infra bypass access.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR diff adds only numeric IDs, repository settings, team names, and comments; no API keys, tokens, passwords, credential URLs, private keys, or encoded secret blobs appear.
No-Weak-Crypto	✅ Passed	The PR changes only Terraform repository rules and merge-queue settings; diff and tracked-file searches found no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
No-Injection-Vectors	✅ Passed	The PR changes only Terraform repository and ruleset declarations; the diff and repository scan contain no SQL, shell execution, eval/exec, unsafe YAML/pickle loading, or HTML injection.
Container-Privileges	✅ Passed	The PR changes only Terraform repository and ruleset settings; scans found no container/Kubernetes manifests or prohibited privilege settings.
No-Sensitive-Data-In-Logs	✅ Passed	The pull request adds only Terraform repository and ruleset configuration; no logging, print, command-execution, or output constructs expose sensitive data.
Ai-Attribution	✅ Passed	The PR names Claude Code; all three PR-range commits include an Assisted-by: Claude Code trailer, and no AI Co-Authored-By trailer is present.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch fix/merge-queue-bypass

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@modules/common_repository/main.tf`:
- Around line 150-153: Separate the update restriction from the ruleset that
uses ruleset_bypass_team_ids: create or reuse a dedicated ruleset for update
with only approved bypass actors, and remove update from the shared ruleset
controlled by the update expression in the Terraform configuration. Preserve
merge-queue behavior while ensuring wg-infra cannot bypass the update
restriction.

In `@repositories.tf`:
- Around line 315-334: Do not enable the merge_queue configuration in the
ruleset until osac-test-infra deploys workflows with merge_group triggers that
emit all four required contexts: e2e-vmaas-gate, e2e-bmaas-gate, e2e-caas-gate,
and check-labels. Keep the queue settings unchanged once those workflow changes
are available.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: da619d4d-bbaf-4b9f-9397-a81d7cd46158

📥 Commits

Reviewing files that changed from the base of the PR and between a1dcdb5 and 39cdd99.

📒 Files selected for processing (2)

• modules/common_repository/main.tf
• repositories.tf

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@modules/common_repository/main.tf`:
- Around line 150-159: Move the dynamic pull_request rule out of the ruleset
that grants wg-infra bypass_mode = "always", placing it in a separate ruleset
without that team bypass. Preserve the merge_queue condition and
required_approving_review_count = 0 so direct pushes remain blocked while
merge-queue behavior is unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 32dba2ce-f757-4334-8d13-88a12902d684

📥 Commits

Reviewing files that changed from the base of the PR and between 39cdd99 and 8e92f7f.

📒 Files selected for processing (1)

• modules/common_repository/main.tf