OSAC-3734: remove classic branch protection required_status_checks

[omer-vishlitzky]

Summary

Remove the required_status_checks block from classic branch protection. It was added in c17e367 to make Tide respect E2E checks — Tide only reads classic branch protection, not rulesets.

With merge queue replacing Tide, this block is unnecessary and actively harmful: its hardcoded strict = true conflicts with merge queue, causing PRs to be ejected from the queue after all checks pass.

From GitHub docs:

"You should not combine the merge queue with the 'Require branches to be up to date before merging' option in branch protection rules, as this can lead to unexpected behavior."

Evidence

PRs 180, 212, 182 were repeatedly ejected from the merge queue despite all checks passing. Every ejection correlated with main moving (a bypassed merge of PR 172 at 18:14 caused ejection of all three at 19:15).

What still enforces checks

The repository ruleset (ci-status-checks) has the same required checks with strict = false — merge queue handles freshness by testing against latest main.

Test plan

• After tofu apply: gh api repos/osac-project/osac/branches/main/protection/required_status_checks returns null
• PRs in merge queue are NOT ejected when main moves (queue re-tests instead)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Configuration
  • Updated branch protection behavior so required status checks are managed through repository rulesets.
  • Removed status-check configuration from classic branch protection settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a99de953-cac9-4dcf-b828-2fcfe45dae0c

📥 Commits

Reviewing files that changed from the base of the PR and between 6295c2d and 83662b8.

📒 Files selected for processing (1)

• modules/common_repository/main.tf

💤 Files with no reviewable changes (1)

• modules/common_repository/main.tf

---

Walkthrough

The classic branch protection resource no longer configures required status-check contexts. Status checks remain configured through the repository ruleset.

Changes

Branch protection status checks

Layer / File(s)	Summary
Remove classic status-check configuration modules/common_repository/main.tf	Removes the required_status_checks block from github_branch_protection.repo_protection, including strict enforcement and contexts from var.required_status_checks.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• osac-project/github-config#131: Migrates required status checks from classic branch protection to a repository ruleset.
• osac-project/github-config#153: Adds OSAC status checks to the repository ruleset configuration.
• osac-project/github-config#171: Previously added classic branch protection checks sourced from var.required_status_checks.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the removal of classic branch protection required status checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The commit changes only modules/common_repository/main.tf and removes 14 lines; it adds no content, so it introduces no hardcoded secret.
No-Weak-Crypto	✅ Passed	The PR changes only modules/common_repository/main.tf and deletes a required_status_checks block; the added diff contains no weak-crypto or secret-comparison logic.
No-Injection-Vectors	✅ Passed	The PR only deletes a Terraform required_status_checks block; the PR diff adds no SQL, shell=True, eval/exec, pickle, unsafe YAML, os.system, or dangerouslySetInnerHTML vectors.
Container-Privileges	✅ Passed	The PR only removes 14 lines from a Terraform branch-protection resource; no privileged settings, listed capabilities, escalation settings, or root indicators were added or found.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only removes a Terraform required_status_checks block; it adds no logging or output code, and repository searches found no new sensitive-data logging.
Ai-Attribution	✅ Passed	AI use is disclosed in the PR and commit; the PR tip has an Assisted-by: Claude Code trailer, and no AI Co-Authored-By trailer is present.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eranco74]

/lgtm