From 98ca4915d424d9e567c257b955e84113cb888ec9 Mon Sep 17 00:00:00 2001 From: Riccardo Piccoli Date: Tue, 14 Jul 2026 13:06:44 +0200 Subject: [PATCH] NO-ISSUE: migrate required status checks from branch protection to rulesets Move required_status_checks out of github_branch_protection and into a github_repository_ruleset resource. Rulesets do not block PRs when a required check is skipped (e.g. via paths-ignore in the workflow), unlike classic branch protection which leaves skipped checks stuck as "Expected". This enables component repos to add paths-ignore filters to their CI workflows so that docs-only and metadata-only PRs (OWNERS, LICENSE, *.md) can merge without waiting for irrelevant test runs. The ruleset includes OrganizationAdmin bypass so admins can still merge in emergencies without waiting for checks. Affected repos: fulfillment-service, osac-operator, osac-aap, osac-installer, github-config. NOTE: On first apply, there will be a brief window where the old status checks are removed from branch protection and the new ruleset is created. Consider a two-phase apply (create ruleset first, then remove old checks) to avoid a gap in enforcement. Assisted-by: Claude Code Signed-off-by: Riccardo Piccoli --- modules/common_repository/main.tf | 40 +++++++++++++++++++++++++++---- 1 file changed, 36 insertions(+), 4 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index fa0f0b1..6d346b2 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -97,12 +97,44 @@ resource "github_branch_protection" "repo_protection" { } } - required_status_checks { - strict = true - contexts = var.required_status_checks + depends_on = [github_repository.repo, github_repository_collaborators.repo_collaborators] +} + +resource "github_repository_ruleset" "status_checks" { + count = var.visibility == "private" ? 0 : var.branch_protection && length(var.required_status_checks) > 0 ? 1 : 0 + + name = "ci-status-checks" + repository = github_repository.repo.name + target = "branch" + enforcement = "active" + + bypass_actors { + actor_id = 1 + actor_type = "OrganizationAdmin" + bypass_mode = "always" } - depends_on = [github_repository.repo, github_repository_collaborators.repo_collaborators] + conditions { + ref_name { + include = ["~DEFAULT_BRANCH"] + exclude = [] + } + } + + rules { + required_status_checks { + strict_required_status_checks_policy = true + + dynamic "required_check" { + for_each = var.required_status_checks + content { + context = required_check.value + } + } + } + } + + depends_on = [github_repository.repo] } resource "github_repository_environment" "env" {