fix: allow merge queue bot to push to protected branches

[omer-vishlitzky]

Summary

• Add GitHub Merge Queue bot (Integration 262318) as a conditional ruleset bypass actor for repos with merge queue enabled
• Add update = true rule to the ruleset so direct pushes to main are blocked via the ruleset (only bypass actors can push directly)
• Remove push_allowances from osac repo — classic branch protection's "Restrict who can push" overrides the merge queue bot's implicit push access, and the bot cannot be added to it (internal GitHub app with no discoverable slug)
• Increase max_entries_to_build from 3 to 4 (12 self-hosted runners for queue, leaves 28 for PR checks)

Context

The merge queue was dequeuing PRs with all checks passing because the bot couldn't push the rebased result to main — branch_protection_failure. Root cause: classic branch protection's restrict_pushes listed specific teams, which overrides the default list that includes the merge queue bot. Moving push restrictions to the ruleset (via update = true) lets the merge queue bot bypass them as a ruleset bypass actor.

Test plan

• Verify merge queue successfully merges a PR after queue checks pass
• Verify direct git push origin main is rejected for non-bypass actors
• Verify wg-infra and org-admins can still push directly when needed

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added merge queue support to repository rules when merge queue configuration is enabled.
  • Increased the maximum number of entries built concurrently in the merge queue from three to four.
• Bug Fixes
  • Direct pushes are now blocked when merge queue protection is active, ensuring changes follow the required merge workflow.
  • Removed legacy branch-protection exceptions that could bypass the standard review and merge process.

[coderabbitai]

Walkthrough

The repository ruleset now supports merge queue bypass and update enforcement. The osac repository removes push allowances and increases max_entries_to_build from 3 to 4.

Changes

Merge queue ruleset

Layer / File(s)	Summary
Conditional merge queue ruleset behavior modules/common_repository/main.tf	When merge queue configuration exists, the ruleset adds the GitHub Merge Queue integration as a bypass actor and enables the update restriction.
osac merge queue configuration repositories.tf	module.repo_osac removes push_allowances, documents merge queue enforcement and force-push bypass behavior, and increases max_entries_to_build from 3 to 4.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/github-config#131: Introduced the status_checks ruleset extended by this change.
• osac-project/github-config#134: Introduced the merge queue configuration updated by this change.
• osac-project/github-config#180: Added related common ruleset and repo_osac merge queue behavior.

Suggested reviewers: larsks, eliorerz, eranco74

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: allowing the GitHub Merge Queue bot to push to protected branches.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR adds only a GitHub integration ID, Terraform booleans, and a queue-size integer; searches found no secret assignments, credential-bearing URLs, private keys, or secret-shaped blobs.
No-Weak-Crypto	✅ Passed	The PR changes only GitHub ruleset and merge-queue Terraform settings; added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
No-Injection-Vectors	✅ Passed	The commit adds only fixed Terraform values and conditional variables; searches found no SQL concatenation, shell execution, unsafe deserialization, or dangerous HTML sinks.
Container-Privileges	✅ Passed	The PR changes only Terraform repository rules and merge-queue settings; no container/Kubernetes manifests or flagged privilege settings are present.
No-Sensitive-Data-In-Logs	✅ Passed	The patch adds only Terraform ruleset settings and comments; added-content review found no logging markers, sensitive markers, or sensitive assignments.
Ai-Attribution	✅ Passed	The PR mentions Claude Code, and its sole commit includes an Assisted-by: Claude Code trailer; no AI Co-Authored-By trailer appears in the PR range.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

repositories.tf (1)

165-167: 🚀 Performance & Scalability | 🔵 Trivial

Verify runner capacity separately from queue concurrency.

max_entries_to_build = 4 limits queued pull requests requesting checks and workflows concurrently. It does not allocate 12 self-hosted runners or reserve 28 runners for pull-request checks. Confirm that runner labels, workflow concurrency, and pool limits enforce the intended 12/28 split. (docs.github.com)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@repositories.tf` around lines 165 - 167, Review the merge queue configuration
around merge_queue.max_entries_to_build and separately validate the self-hosted
runner labels, workflow concurrency settings, and runner pool limits. Ensure
those controls enforce the intended 12-runner and 28-runner allocation; do not
treat max_entries_to_build = 4 as runner capacity.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@repositories.tf`:
- Around line 165-167: Review the merge queue configuration around
merge_queue.max_entries_to_build and separately validate the self-hosted runner
labels, workflow concurrency settings, and runner pool limits. Ensure those
controls enforce the intended 12-runner and 28-runner allocation; do not treat
max_entries_to_build = 4 as runner capacity.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8ea9eb7b-44a2-4154-8b63-62ab40e03102

📥 Commits

Reviewing files that changed from the base of the PR and between 13575be and d4b7bb1.

📒 Files selected for processing (2)

• modules/common_repository/main.tf
• repositories.tf

[eranco74]

/lgtm
/approve