From b51ffc97396b7304bc09f7cf10cd3728cff00677 Mon Sep 17 00:00:00 2001 From: omer-vishlitzky Date: Fri, 17 Jul 2026 00:06:48 +0300 Subject: [PATCH] Add wg-infra team as ruleset bypass actor PR #131 migrated required status checks from branch protection to rulesets but only granted bypass to OrganizationAdmin. This broke manual merges for wg-infra members who previously could bypass via enforce_admins=false on branch protection. Co-Authored-By: Claude Opus 4.6 --- modules/common_repository/main.tf | 9 +++++++++ modules/common_repository/variables.tf | 6 ++++++ repositories.tf | 22 +++++++++++++--------- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index 2161361..85e81da 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -114,6 +114,15 @@ resource "github_repository_ruleset" "status_checks" { bypass_mode = "always" } + dynamic "bypass_actors" { + for_each = var.ruleset_bypass_team_ids + content { + actor_id = bypass_actors.value + actor_type = "Team" + bypass_mode = "always" + } + } + conditions { ref_name { include = ["~DEFAULT_BRANCH"] diff --git a/modules/common_repository/variables.tf b/modules/common_repository/variables.tf index ea9f192..e99f247 100644 --- a/modules/common_repository/variables.tf +++ b/modules/common_repository/variables.tf @@ -178,6 +178,12 @@ variable "environments" { } } +variable "ruleset_bypass_team_ids" { + description = "Team database IDs allowed to bypass the CI status checks ruleset" + type = list(number) + default = [] +} + variable "all_members_permission" { description = "Permission for all organization members" type = string diff --git a/repositories.tf b/repositories.tf index 9fb3027..f2f1e88 100644 --- a/repositories.tf +++ b/repositories.tf @@ -109,8 +109,9 @@ module "repo_fulfillment_service" { required_status_checks = [ { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, ] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] - environments = [{ name = "e2e-test" }] + ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + environments = [{ name = "e2e-test" }] pages = { build_type = "workflow" source = { @@ -139,8 +140,9 @@ module "repo_cloudkit_operator" { required_status_checks = [ { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, ] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] - environments = [{ name = "e2e-test" }] + ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + environments = [{ name = "e2e-test" }] } module "repo_cloudkit_aap" { @@ -162,8 +164,9 @@ module "repo_cloudkit_aap" { required_status_checks = [ { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, ] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] - environments = [{ name = "e2e-test" }] + ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + environments = [{ name = "e2e-test" }] } module "repo_cloudkit_aap_ee" { @@ -212,9 +215,10 @@ module "repo_osac_installer" { { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, ] - required_approvals = null - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] - environments = [{ name = "e2e-test" }] + required_approvals = null + ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + environments = [{ name = "e2e-test" }] } module "repo_enhancement_proposals" {