use rulesets in the rust repo by marcoieni · Pull Request #2327 · rust-lang/team

marcoieni · 2026-03-16T16:41:09Z

Is there a preferred moment when we want to merge this?

git SHA of each branch before the switch:

main: rust-lang/rust@d12e1e1
automation/bors/auto: rust-lang/rust@91367b0
automation/bors/auto-merge: rust-lang/rust@08ab4b2
automation/bors/try: rust-lang/rust@6bcaf55
automation/bors/try-merge: rust-lang/rust@806804d
beta: rust-lang/rust@8489f1a
cargo_update: rust-lang/rust@b8271c3
perf-tmp: rust-lang/rust@a02fdc1
stable: rust-lang/rust@5980761
try-perf: rust-lang/rust@a02fdc1

github-actions · 2026-03-16T16:49:34Z

Dry-run check results


[WARN  rust_team::sync] sync-team is running in dry mode, no changes will be applied.
[INFO  rust_team::sync] synchronizing crates-io
[INFO  rust_team::sync] synchronizing github
[INFO  rust_team::sync] 💻 Repo Diffs:
    📝 Editing repo 'rust-lang/rust':
      Permission Changes:
        Giving team 'rust-timer' write permission
      Rulesets:
          Creating 'main'
            Include Branches: ["refs/heads/main"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'main - force-push'
            Include Branches: ["refs/heads/main"]
            Require pull requests: false
          Creating 'stable'
            Include Branches: ["refs/heads/stable"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }, RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'stable - force-push'
            Include Branches: ["refs/heads/stable"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Require pull requests: false
          Creating 'stable - misc'
            Include Branches: ["refs/heads/stable"]
            Forbid force pushes: false
            Require pull requests: false
          Creating 'beta'
            Include Branches: ["refs/heads/beta"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }, RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'beta - force-push'
            Include Branches: ["refs/heads/beta"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Require pull requests: false
          Creating 'beta - misc'
            Include Branches: ["refs/heads/beta"]
            Forbid force pushes: false
            Require pull requests: false
          Creating '*'
            Include Branches: ["refs/heads/*"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating '*/**/*'
            Include Branches: ["refs/heads/*/**/*"]
            Require pull requests: false
            Restrict updates: true
          Creating 'cargo_update'
            Include Branches: ["refs/heads/cargo_update"]
            Forbid force pushes: false
            Require pull requests: false
            Restrict deletions: false
          Creating 'automation/bors/try'
            Include Branches: ["refs/heads/automation/bors/try"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'automation/bors/try-merge'
            Include Branches: ["refs/heads/automation/bors/try-merge"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'automation/bors/auto'
            Include Branches: ["refs/heads/automation/bors/auto"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'automation/bors/auto-merge'
            Include Branches: ["refs/heads/automation/bors/auto-merge"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'try-perf'
            Include Branches: ["refs/heads/try-perf"]
            Bypass Actors: [RulesetBypassActor { actor_id: 16787004, actor_type: Team, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'perf-tmp'
            Include Branches: ["refs/heads/perf-tmp"]
            Bypass Actors: [RulesetBypassActor { actor_id: 16787004, actor_type: Team, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true

marcoieni · 2026-03-19T21:21:59Z

Backup (taken automatically with https://github.com/marcoieni/multicheese in case you are curious!)

001-github-com-rust-lang-rust-settings-branch-protection-rules-2097960

002-github-com-rust-lang-rust-settings-branch-protection-rules-2626273

003-github-com-rust-lang-rust-settings-branch-protection-rules-29679214

004-github-com-rust-lang-rust-settings-branch-protection-rules-31895354

005-github-com-rust-lang-rust-settings-branch-protection-rules-38663771

006-github-com-rust-lang-rust-settings-branch-protection-rules-42228944

007-github-com-rust-lang-rust-settings-branch-protection-rules-42230325

008-github-com-rust-lang-rust-settings-branch-protection-rules-63047047

009-github-com-rust-lang-rust-settings-branch-protection-rules-63047048

010-github-com-rust-lang-rust-settings-branch-protection-rules-69583533

011-github-com-rust-lang-rust-settings-branch-protection-rules-71071517

marcoieni · 2026-03-19T22:32:39Z

-                    protection.pattern,
-                );
-            }
-


From https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets#about-rulesets-and-protected-branches:

Unlike protection rules, multiple rulesets can apply at the same time, so you can be confident that every rule targeting a branch in your repository will be evaluated when someone interacts with that branch

I removed this because we need multiple rules to interact with the same branch (different bypass list for normal push and force push).

In that case we should make the name required when there are multiple identical patterns, because we used the pattern as an identifier.

marcoieni · 2026-03-23T22:38:50Z

Here's how I tested the "stable" and "stable - force-pushes" rules.

I created a repository in my test organization: https://github.com/marco-test-org/ruleset-test
I created two rules

github com_marco-test-org_ruleset-test_settings_rules_14250638

github com_marco-test-org_ruleset-test_settings_rules_14250638 (1)

The user in the test-team was able to push to the repository but not to force-push. See marco-test-org/ruleset-test#1

marcoieni · 2026-03-23T23:01:38Z

There's one issue:
In the try-perf branch, the user rust-timer is allowed to push.
In rulesets, only teams and github apps can be allowed to push.
Should we create a team for rust-timer?
Another approach would be converting rust-timer to a github app but I'm not sure how difficult it is.

Kobzol · 2026-03-24T06:23:58Z

We are relatively close to making the unrolled PRs by bors, instead of rustc-perf. If this can wait a few weeks, rust-timer will no longer need that access.

marcoieni · 2026-03-24T06:40:12Z

We are relatively close to making the unrolled PRs by bors, instead of rustc-perf. If this can wait a few weeks, rust-timer will no longer need that access.

#2343 is a small change that can be reverted easily. Since this is the only blocker to have rulesets in the rust I'm in favor of creating the team. What do you think? 🤔

Kobzol · 2026-03-24T10:03:29Z

Sure, go ahead, it's a small change 👍

marcoieni · 2026-03-24T17:43:51Z

+        let bypass_actors = self.bypass_actors(expected_repo, branch_protection).await?;
+
+        Ok(construct_ruleset(branch_protection, bypass_actors))
+    }


this function is only two lines but I left it like this to minimize the git diff of the PR.
We could inline the construct_ruleset free function later

marcoieni · 2026-03-24T17:44:55Z

-                bypass_mode: RulesetBypassMode::Always,
-            })
-        })
-        .collect();


this piece of code was moved up

marcoieni · 2026-04-07T17:16:23Z

+) -> api::Ruleset {
    use api::*;

-    let branch_protection_mode = get_branch_protection_mode(branch_protection);


As noted by Kobzol:

we shouldn't turn off requiring PRs when bors is enabled, because that will turn off required PRs for everyone

Kobzol · 2026-04-07T17:25:37Z

 pattern = "try-perf"
-allowed-merge-apps = ["rust-timer"]
+allowed-merge-teams = ["rust-timer"]
 pr-required = false


Suggested change

pr-required = false

Shouldn't be needed, as rust-timer bypasses this ruleset anyway (same below).

Kobzol · 2026-04-07T17:27:24Z

+prevent-force-push = false

 [[branch-protections]]
 pattern = "*"


We have to check whether this still protects tags (like 1.94.1).

it doesn't. Let's do a followup PR

marcoieni · 2026-04-09T09:57:40Z

 [[branch-protections]]
 pattern = "*"
+allowed-merge-apps = ["promote-release"]
+prevent-update = true


the classic branch protection allows deletion, while this doesn't.
Jakub here says he prefers to prevent deletion for this and "*/**/*"

Hmm, I didn't realize deletion was allowed before. I don't think it's super important, but I guess we can try to be more strict and see if preventing deletion breaks anything.

rustbot · 2026-04-20T08:40:55Z

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

ubiratansoares

From my end, I think we are good to go.

marcoieni · 2026-04-20T14:30:03Z

New rules created

marcoieni · 2026-04-20T14:32:57Z

Here are the rules that were created:

001-github-com-rust-lang-rust-settings-rules-15300153

002-github-com-rust-lang-rust-settings-rules-15300154

003-github-com-rust-lang-rust-settings-rules-15300160

004-github-com-rust-lang-rust-settings-rules-15300161

005-github-com-rust-lang-rust-settings-rules-15300156

006-github-com-rust-lang-rust-settings-rules-15300158

007-github-com-rust-lang-rust-settings-rules-15300148

008-github-com-rust-lang-rust-settings-rules-15300150

009-github-com-rust-lang-rust-settings-rules-15300151

010-github-com-rust-lang-rust-settings-rules-15300155

011-github-com-rust-lang-rust-settings-rules-15300143

012-github-com-rust-lang-rust-settings-rules-15300144

013-github-com-rust-lang-rust-settings-rules-15300163

014-github-com-rust-lang-rust-settings-rules-15300145

015-github-com-rust-lang-rust-settings-rules-15300146

016-github-com-rust-lang-rust-settings-rules-15300147

017-github-com-rust-lang-rust-settings-rules-15300162

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 11472fe to ccd8f31 Compare March 19, 2026 12:09

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from a4540e6 to 83f09a2 Compare March 19, 2026 22:31

marcoieni commented Mar 19, 2026

View reviewed changes

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 4 times, most recently from 6f35480 to c3d0cbd Compare March 20, 2026 09:32

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 6e4c63c to c67ec1b Compare March 23, 2026 22:54

marcoieni mentioned this pull request Mar 24, 2026

create the rust-timer team #2343

Merged

1 task

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 4 times, most recently from 0dee3f1 to f614447 Compare March 24, 2026 06:23

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from f614447 to dbe30bf Compare March 24, 2026 06:25

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 3 times, most recently from 1b14c6d to c62adff Compare March 24, 2026 17:25

marcoieni commented Mar 24, 2026

View reviewed changes

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from c62adff to 8c81777 Compare March 24, 2026 17:48

This comment has been minimized.

Sign in to view

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 3 times, most recently from b563c85 to f1b0898 Compare April 7, 2026 16:54

This comment has been minimized.

Sign in to view

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 21063a4 to d9ec7fa Compare April 7, 2026 17:14

marcoieni commented Apr 7, 2026

View reviewed changes

Kobzol reviewed Apr 7, 2026

View reviewed changes

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 95f7537 to af4704b Compare April 9, 2026 09:56

This comment has been minimized.

Sign in to view

marcoieni commented Apr 9, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from a1caee4 to 37806ed Compare April 9, 2026 13:17

marcoieni mentioned this pull request Apr 9, 2026

Rename allowed-merge-apps to bypass-apps #2394

Open

1 task

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from 37806ed to ab71fb6 Compare April 9, 2026 13:23

jieyouxu added the needs-infra-admin-review This change requires one of the `infra-admins` to review. label Apr 9, 2026

use rulesets in the rust repo

1bdc203

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from ab71fb6 to 1bdc203 Compare April 20, 2026 08:40

ubiratansoares approved these changes Apr 20, 2026

View reviewed changes

marcoieni added this pull request to the merge queue Apr 20, 2026

Merged via the queue into main with commit c05cf49 Apr 20, 2026
4 checks passed

Conversation

marcoieni commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marcoieni commented Mar 19, 2026

Uh oh!

marcoieni Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marcoieni commented Mar 23, 2026

Uh oh!

marcoieni commented Mar 23, 2026

Uh oh!

Kobzol commented Mar 24, 2026

Uh oh!

marcoieni commented Mar 24, 2026

Uh oh!

Kobzol commented Mar 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

rustbot commented Apr 20, 2026

Uh oh!

ubiratansoares left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

marcoieni commented Apr 20, 2026

Uh oh!

marcoieni commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

marcoieni commented Mar 16, 2026 •

edited

Loading

github-actions bot commented Mar 16, 2026 •

edited

Loading

marcoieni Mar 19, 2026 •

edited

Loading

marcoieni commented Apr 20, 2026 •

edited

Loading