feat: bypass reviews for deployment automation

src/tf/modules/repository/main.tf

@@ -31,6 +31,9 @@ resource "github_team_repository" "this" {
 }
 
 resource "github_repository_ruleset" "main" {
+  # Keep approval enforcement in place until the review-only ruleset exists.
+  depends_on = [github_repository_ruleset.required_reviews]
+
   name        = "Protect main"
   repository  = github_repository.this.name
   target      = "branch"
@@ -61,7 +64,7 @@ resource "github_repository_ruleset" "main" {
     pull_request {
       allowed_merge_methods             = ["rebase", "squash"]
       dismiss_stale_reviews_on_push     = true
-      required_approving_review_count   = var.required_approving_review_count
+      required_approving_review_count   = length(var.review_bypass_actors) == 0 ? var.required_approving_review_count : 0
       required_review_thread_resolution = true
     }
 
@@ -83,3 +86,37 @@ resource "github_repository_ruleset" "main" {
     }
   }
 }
+
+resource "github_repository_ruleset" "required_reviews" {
+  count = length(var.review_bypass_actors) == 0 ? 0 : 1
+
+  name        = "Require pull request reviews"
+  repository  = github_repository.this.name
+  target      = "branch"
+  enforcement = var.ruleset_enforcement
+
+  conditions {
+    ref_name {
+      include = ["~DEFAULT_BRANCH"]
+      exclude = []
+    }
+  }
+
+  dynamic "bypass_actors" {
+    for_each = var.review_bypass_actors
+
+    content {
+      actor_id    = bypass_actors.value.actor_id
+      actor_type  = bypass_actors.value.actor_type
+      bypass_mode = "pull_request"
+    }
+  }
+
+  rules {
+    pull_request {
+      allowed_merge_methods           = ["rebase", "squash"]
+      dismiss_stale_reviews_on_push   = true
+      required_approving_review_count = var.required_approving_review_count
+    }
+  }
+}

src/tf/modules/repository/variables.tf

@@ -52,6 +52,15 @@ variable "required_approving_review_count" {
   }
 }
 
+variable "review_bypass_actors" {
+  description = "Actors allowed to bypass required approving reviews through pull requests"
+  type = set(object({
+    actor_id   = number
+    actor_type = string
+  }))
+  default = []
+}
+
 variable "ruleset_enforcement" {
   description = "Main branch ruleset enforcement level"
   type        = string

src/tf/repositories.tf

@@ -1,5 +1,6 @@
 locals {
   github_actions_integration_id = 15368
+  deployment_automation_app_id  = 4527359
 
   super_admin_team = {
     id         = module.super_admins_team.id
@@ -22,6 +23,10 @@ locals {
     }
     infra-k8s-apps = {
       required_check = "checks / Kubernetes checks"
+      review_bypass_actors = [{
+        actor_id   = local.deployment_automation_app_id
+        actor_type = "Integration"
+      }]
     }
     infra-vm-workloads = {
       required_check = "CI checks"
@@ -40,6 +45,7 @@ module "infrastructure_repository" {
     context        = each.value.required_check
     integration_id = local.github_actions_integration_id
   }]
+  review_bypass_actors = try(each.value.review_bypass_actors, [])
   teams = concat(
     [
       {