From d4b7bb1f8e902b23839902e2dadcf632180e84e2 Mon Sep 17 00:00:00 2001 From: omer-vishlitzky Date: Tue, 11 Aug 2026 00:49:06 +0300 Subject: [PATCH] fix: allow merge queue bot to push to protected branches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The GitHub Merge Queue bot (Integration 262318) needs to push rebased commits to main after queue checks pass. Classic branch protection's "Restrict who can push" blocks it — the bot is an internal GitHub app that cannot be added to branch protection push allowances. - Add merge queue bot as a conditional ruleset bypass actor (only when merge_queue is configured) - Add update rule to the ruleset for merge-queue repos so direct pushes are blocked via the ruleset instead of branch protection - Remove push_allowances from osac repo to eliminate the conflicting classic branch protection restriction - Increase max_entries_to_build from 3 to 4 (12 runners for queue, leaves 28 for PR checks with 40 total runners) Assisted-by: Claude Code Signed-off-by: omer-vishlitzky --- modules/common_repository/main.tf | 16 ++++++++++++++++ repositories.tf | 9 ++++++--- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index 54b5771..09007dc 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -119,6 +119,17 @@ resource "github_repository_ruleset" "status_checks" { bypass_mode = "always" } + # GitHub Merge Queue app — must bypass the ruleset to push rebased + # commits to the protected branch after queue checks pass. + dynamic "bypass_actors" { + for_each = var.merge_queue != null ? [1] : [] + content { + actor_id = 262318 + actor_type = "Integration" + bypass_mode = "always" + } + } + dynamic "bypass_actors" { for_each = var.ruleset_bypass_team_ids content { @@ -136,6 +147,11 @@ resource "github_repository_ruleset" "status_checks" { } rules { + # When merge queue is enabled, block direct pushes via the ruleset + # instead of classic branch protection's restrict_pushes — the merge + # queue bot cannot be added to branch protection but can bypass rulesets. + update = var.merge_queue != null ? true : false + required_status_checks { # When merge queue is enabled, strict is unnecessary — the queue tests # each PR against latest main before merging. diff --git a/repositories.tf b/repositories.tf index b392be6..9f2415d 100644 --- a/repositories.tf +++ b/repositories.tf @@ -156,12 +156,15 @@ module "repo_osac" { # it's disabled at the GitHub level, not just by convention. allow_squash_merge = false ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - # openshift-merge-robot removed: Tide no longer merges; merge queue handles it. - push_allowances = ["osac-project/wg-infra", "osac-project/org-admins"] + # push_allowances removed: classic branch protection's "Restrict who can push" + # overrides the merge queue bot's implicit push access and cannot include it + # (the bot is an internal GitHub app with no discoverable slug). The ruleset's + # merge_queue rule prevents unauthorized merges; force_push_bypassers (above) + # controls force pushes. merge_queue = { merge_method = "REBASE" - max_entries_to_build = 3 + max_entries_to_build = 4 max_entries_to_merge = 5 min_entries_to_merge = 1 min_entries_to_merge_wait_minutes = 5