From 73dcb329358e0b6983f7bb2400576c63fb4a8078 Mon Sep 17 00:00:00 2001 From: omer-vishlitzky Date: Tue, 11 Aug 2026 23:40:58 +0300 Subject: [PATCH] fix: remove pull_request ruleset rule, restore push_allowances MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pull_request rule in the ruleset blocks PRs when CodeRabbit (or any bot) has an outstanding CHANGES_REQUESTED review — even with required_approving_review_count=0. Since approval is handled by Prow labels and the check-labels gate, not native GitHub reviews, this rule is incompatible. Direct push protection comes from classic branch protection's restrict_pushes (push_allowances) instead. The merge queue bot is auto-allowed by GitHub when restrict_pushes is active, confirmed working in production. Assisted-by: Claude Code Signed-off-by: omer-vishlitzky --- modules/common_repository/main.tf | 11 ----------- repositories.tf | 11 +++-------- 2 files changed, 3 insertions(+), 19 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index a3d200e..e1056fa 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -147,17 +147,6 @@ resource "github_repository_ruleset" "status_checks" { } rules { - # When merge queue is enabled, require a PR for all changes. This - # blocks direct `git push` to main (unlike `update = true` which also - # breaks auto-merge evaluation). Native review count is 0 because - # approval is handled by Prow labels + check-labels gate. - dynamic "pull_request" { - for_each = var.merge_queue != null ? [1] : [] - content { - required_approving_review_count = 0 - } - } - required_status_checks { # When merge queue is enabled, strict is unnecessary — the queue tests # each PR against latest main before merging. diff --git a/repositories.tf b/repositories.tf index 4d6747d..2a80a5c 100644 --- a/repositories.tf +++ b/repositories.tf @@ -161,11 +161,7 @@ module "repo_osac" { # it's disabled at the GitHub level, not just by convention. allow_squash_merge = false ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - # push_allowances removed: classic branch protection's "Restrict who can push" - # overrides the merge queue bot's implicit push access and cannot include it - # (the bot is an internal GitHub app with no discoverable slug). The ruleset's - # merge_queue rule prevents unauthorized merges; force_push_bypassers (above) - # controls force pushes. + push_allowances = ["osac-project/wg-infra", "osac-project/org-admins"] merge_queue = { merge_method = "REBASE" @@ -319,9 +315,8 @@ module "repo_osac_test_infra" { { context = "check-labels", integration_id = 15368 }, ] ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - # push_allowances removed: classic branch protection's "Restrict who can - # push" blocks the merge queue bot. Ruleset update rule handles this instead. - environments = [{ name = "e2e-test" }] + push_allowances = ["osac-project/wg-infra", "osac-project/org-admins"] + environments = [{ name = "e2e-test" }] merge_queue = { merge_method = "REBASE"