feat(yo61): allow per-repo dismiss_stale_reviews_on_push, off for homebrew-tap

[robinbowes]

Why

homebrew-tap's release pipeline cannot merge a release under the review policy it was brought under in #62.

publish-bottles.yaml builds bottles, uploads them, then commits the bottle do block to the bump PR branch and squash-merges it. That push dismisses yo61-lastlight[bot]'s approval — the approval the merge depends on — so the merge fails:

Repository rule violations found
At least 1 approving review is required by reviewers with write access. (HTTP 405)

lastlight re-approved ~40s after the workflow's ~35s retry window closed. The automatic retry then failed earlier still, at brew pr-upload, with Validation Failed: ReleaseAsset already_exists — the upload step is not idempotent, so the pipeline cannot recover on its own.

Seen on homebrew-tap#104, the first release bump after eabc303 set required_approving_review_count: 1 on the repo. It is structural: every release bump pushes after review, so every release fails the same way.

What changed

dismiss_stale_reviews_on_push was hardcoded in modules/github-repo/data/rulesets.yaml, so it could not be varied per repo. It is now injected from a variable — the same treatment bypass_actors, required_approving_review_count and require_last_push_approval already get, and the reason the in-code comment gives for keeping such fields out of the YAML.

• modules/github-repo/variables.tf — new default_branch_ruleset_dismiss_stale_reviews_on_push, default true
• modules/github-repo/data.tf — injected into the default_branch ruleset's pull_request block
• modules/github-repo/data/rulesets.yaml — hardcoded value removed
• modules/org/{variables,main}.tf — org default + per-repo YAML lookup
• data/yo61/homebrew-tap.yaml — set false, with a comment pointing at #104

Because the default matches the removed literal, the other nine repos should plan as no-ops. Worth confirming in the plan before apply — I could not run task plan (no TF_HTTP_ADDRESS in a non-interactive shell).

On the earlier decision

decisions/2026-08-06-unifi-mcp-ci-only-gate.md explicitly rejected setting dismiss_stale_reviews_on_push: false in the module default, and recorded that true stays the fleet-wide default. That is preserved here — the default is unchanged and only homebrew-tap deviates. Rationale, and the two alternatives considered (dropping the tap's review count to 0 per the unifi-mcp shape; or fixing the workflow's retry instead), are in decisions/2026-08-12-homebrew-tap-dismiss-stale-override.md.

Verification

• terraform validate — success
• terraform fmt -recursive -check — clean
• prek run --files <changed> — all hooks pass, including terraform_docs and the repo-YAML name check
• Deviation check against quality/criteria.md ("every key states a deviation from the module default"): false vs module default true ✓
• Not verified: the plan output. Needs task plan with the Stategraph backend env.

🤖 Generated with Claude Code

[yo61-lastlight]

Plumbs dismiss_stale_reviews_on_push through as a per-repo variable following the exact existing pattern for bypass_actors/required_approving_review_count/require_last_push_approval, defaulting to true (unchanged fleet-wide behavior) and overriding to false only on homebrew-tap for a well-documented reason (release automation pushes a bottle commit after approval and merges it). The change is correctly scoped to the default_branch ruleset's pull_request block and does not touch the separate, unrelated branch_protection_rules_default.required_pull_request_reviews.dismiss_stale_reviews field. Comments, variable docs, and the decision record are thorough and consistent with the prior 2026-08-06 decision it explicitly preserves. No issues found.