From 949cead05a14a835d6fc4d6713b7cd13005e551b Mon Sep 17 00:00:00 2001 From: omer-vishlitzky Date: Fri, 7 Aug 2026 21:19:38 +0300 Subject: [PATCH] OSAC-3734: enable merge queue for osac monorepo Replace Tide-based merge automation with GitHub's native merge queue: - Add merge_queue variable and rule to common_repository module - Disable strict status checks when merge queue is enabled (queue handles freshness by testing each PR against latest main) - Gate on label-gate workflow (reads Prow-set lgtm/approved/jira labels, converts to a status check the merge queue can gate on) - Keep required_approvals=null (Prow plugins handle approval via OWNERS, not native GitHub reviews) - Remove openshift-merge-robot from push_allowances (merge queue handles merging, Tide no longer pushes) Companion PRs: - osac-project/osac: add label-gate.yml workflow - openshift/release: remove Tide merge queries (keep all Prow plugins) Assisted-by: Claude Code Signed-off-by: omer-vishlitzky --- modules/common_repository/main.tf | 17 ++++++++++++++++- modules/common_repository/variables.tf | 14 ++++++++++++++ repositories.tf | 23 ++++++++++++++++++----- 3 files changed, 48 insertions(+), 6 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index 74aeb4f..5570497 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -133,7 +133,9 @@ resource "github_repository_ruleset" "status_checks" { rules { required_status_checks { - strict_required_status_checks_policy = true + # When merge queue is enabled, strict is unnecessary — the queue tests + # each PR against latest main before merging. + strict_required_status_checks_policy = var.merge_queue != null ? false : true dynamic "required_check" { for_each = var.required_status_checks @@ -143,6 +145,19 @@ resource "github_repository_ruleset" "status_checks" { } } } + + dynamic "merge_queue" { + for_each = var.merge_queue[*] + content { + check_response_timeout_minutes = merge_queue.value.check_response_timeout_minutes + grouping_strategy = merge_queue.value.grouping_strategy + max_entries_to_build = merge_queue.value.max_entries_to_build + max_entries_to_merge = merge_queue.value.max_entries_to_merge + merge_method = merge_queue.value.merge_method + min_entries_to_merge = merge_queue.value.min_entries_to_merge + min_entries_to_merge_wait_minutes = merge_queue.value.min_entries_to_merge_wait_minutes + } + } } depends_on = [github_repository.repo] diff --git a/modules/common_repository/variables.tf b/modules/common_repository/variables.tf index 297e89f..f7a0463 100644 --- a/modules/common_repository/variables.tf +++ b/modules/common_repository/variables.tf @@ -190,6 +190,20 @@ variable "ruleset_bypass_team_ids" { default = [] } +variable "merge_queue" { + description = "Merge queue configuration. When set, enables merge queue on the default branch and disables strict status checks (the queue handles freshness)." + type = object({ + merge_method = optional(string, "MERGE") + max_entries_to_build = optional(number, 5) + max_entries_to_merge = optional(number, 5) + min_entries_to_merge = optional(number, 1) + min_entries_to_merge_wait_minutes = optional(number, 5) + check_response_timeout_minutes = optional(number, 60) + grouping_strategy = optional(string, "ALLGREEN") + }) + default = null +} + variable "all_members_permission" { description = "Permission for all organization members" type = string diff --git a/repositories.tf b/repositories.tf index 2633e10..1345b61 100644 --- a/repositories.tf +++ b/repositories.tf @@ -141,22 +141,35 @@ module "repo_osac" { permission = "admin" } ] + # Prow plugins handle approval via OWNERS (lgtm/approved labels), not native + # GitHub reviews. The label-gate workflow enforces label presence as a status + # check for the merge queue. required_approvals = null - # osac's own CI (all 3 e2e install flavors) is live and has been passing on - # real PRs for a while now -- require all 3, not just vmaas like the - # pre-merge component repos below, since this is now the repo everything - # actually merges into. required_status_checks = [ { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, { context = "e2e-bmaas-full-install / e2e", integration_id = 15368 }, { context = "e2e-caas-full-install / e2e", integration_id = 15368 }, + # Reads Prow-set labels (lgtm, approved, jira/valid-reference) and converts + # them to a status check the merge queue can gate on. + { context = "label-gate / check-labels", integration_id = 15368 }, ] # Preserve subtree-merge history/blame going forward -- squash-merging on the # mono-repo would collapse that history for every commit after cutover, so # it's disabled at the GitHub level, not just by convention. allow_squash_merge = false ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + # openshift-merge-robot removed: Tide no longer merges; merge queue handles it. + push_allowances = ["osac-project/wg-infra", "osac-project/org-admins"] + + merge_queue = { + merge_method = "REBASE" + max_entries_to_build = 3 + max_entries_to_merge = 5 + min_entries_to_merge = 1 + min_entries_to_merge_wait_minutes = 5 + check_response_timeout_minutes = 120 + grouping_strategy = "ALLGREEN" + } } module "repo_cloudkit_operator" {