NO-ISSUE: Add ownership to github-config: team files and the owner

.github/workflows/auto-merge.yaml

@@ -0,0 +1,50 @@
+name: Auto-merge
+
+# A pull request merges by itself once everything it needs is there: the approval of the owner (github-config-owners), of the
+# team whose member file it changes (CODEOWNERS), the other approvals and the checks. This turns on GitHub's auto-merge for
+# every pull request to the default branch that is not a draft, each time pre-commit has run for it; GitHub then merges it
+# the moment the rules are met, and not before. The rules are the branch protection and the rulesets (repositories.tf), which
+# a new commit resets (stale approvals are dismissed).
+#
+# It runs when pre-commit ends, from the default branch, and runs nothing of the pull request (pull_request_target, which
+# GitHub blocks by default in public repositories from 2 December 2026, is not used). It is a run of the default branch, so
+# it adds no row to a pull request. The merge is made with the token of this workflow, which starts no other workflow
+# (apply.yaml runs on its schedule, every 4 hours, or by hand).
+on:  # zizmor: ignore[dangerous-triggers] -- nothing of the pull request is checked out or run
+  workflow_run:
+    workflows: [pre-commit]
+    types: [completed]
+
+permissions: {}
+
+jobs:
+  auto-merge:
+    name: Enable auto-merge
+    if: ${{ github.event.workflow_run.event == 'pull_request' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Turn on auto-merge for the pull request of this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.event.workflow_run.head_sha }}
+          BASE: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+          [[ "${SHA}" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::The commit must be 40 lower-case hexadecimal digits." >&2; exit 1; }
+          # The open pull requests to the default branch whose head is this commit (found by the commit: the run itself does not list a fork pull request).
+          numbers=$(gh api "repos/${REPO}/commits/${SHA}/pulls" \
+            | jq -r --arg base "${BASE}" '.[] | select(.state == "open" and .base.ref == $base) | .number')
+          for number in ${numbers}; do
+            [[ "${number}" =~ ^[0-9]+$ ]] || continue
+            view=$(gh pr view "${number}" --repo "${REPO}" --json isDraft,autoMergeRequest,headRefOid)
+            if jq -e --arg sha "${SHA}" '.isDraft or (.autoMergeRequest != null) or (.headRefOid != $sha)' <<<"${view}" >/dev/null; then
+              echo "#${number}: a draft, or auto-merge is already on, or it moved on to another commit"
+              continue
+            fi
+            gh pr merge "${number}" --repo "${REPO}" --auto --squash
+          done

.github/workflows/pre-commit.yaml

@@ -3,6 +3,9 @@ name: pre-commit
 on:
   workflow_dispatch:
   pull_request:
+    # The default types plus ready_for_review: auto-merge.yaml acts when pre-commit ends, and skips a draft, so a pull request
+    # that is marked ready needs a run of its own.
+    types: [opened, synchronize, reopened, ready_for_review]
   push:
     branches-ignore:
       - main

CODEOWNERS

@@ -0,0 +1,29 @@
+# CODEOWNERS of github-config.
+#
+# A change to the member file of a team needs an approval from that team (any member except the author), so a team decides
+# who joins it. The team must be visible (closed) and have write access to this repository, which the teams below have
+# (the contributor teams of teams.csv). A team that cannot be an owner (secret, or without access) has no rule here, and its
+# file needs only the owners' approval: ci-duty, documentation-wg, fulfillment-wg, observability-wg, org-admins, personas-wg.
+#
+# Every pull request to the default branch also needs an approval of github-config-owners (the ruleset "owner-review" in
+# repositories.tf), which CODEOWNERS cannot say: it takes one owner per path, not two.
+
+/team-members/architects.csv @osac-project/architects
+/team-members/contributors.csv @osac-project/contributors
+/team-members/managers.csv @osac-project/managers
+/team-members/wg-architecture.csv @osac-project/wg-architecture
+/team-members/wg-bmaas.csv @osac-project/wg-bmaas
+/team-members/wg-caas.csv @osac-project/wg-caas
+/team-members/wg-connectivity.csv @osac-project/wg-connectivity
+/team-members/wg-core.csv @osac-project/wg-core
+/team-members/wg-e2e.csv @osac-project/wg-e2e
+/team-members/wg-enclave.csv @osac-project/wg-enclave
+/team-members/wg-infra.csv @osac-project/wg-infra
+/team-members/wg-leads.csv @osac-project/wg-leads
+/team-members/wg-maas.csv @osac-project/wg-maas
+/team-members/wg-metering.csv @osac-project/wg-metering
+/team-members/wg-qe.csv @osac-project/wg-qe
+/team-members/wg-soln-eng.csv @osac-project/wg-soln-eng
+/team-members/wg-storage.csv @osac-project/wg-storage
+/team-members/wg-ui.csv @osac-project/wg-ui
+/team-members/wg-vmaas.csv @osac-project/wg-vmaas

README.md

@@ -24,6 +24,13 @@ When a commit is pushed to the `main` branch (e.g., when a pull request merges),
    Set `<contributor>` to `true` to give the team push access on every repository that uses `local.contributor_teams` in `repositories.tf` (the working group teams), or `false` otherwise.
    Set `<maintainer>` to `true` or `false` (see the next section); a team that is not explicitly authorized to approve changes is `false`.
 
+### Who approves a change to this repository?
+
+- Every pull request to the default branch needs an approval of `github-config-owners` (a team of one person, `team-members/github-config-owners.csv`): the ruleset `owner-review` in `repositories.tf`. The author of a pull request cannot approve it, and the team has one member, so a pull request written by that owner can only be merged by an organization admin, who bypasses the ruleset (the owner is one). Add a second person to `team-members/github-config-owners.csv` to change that.
+- A pull request **merges by itself** once it has what it needs: the owner's approval, the team's approval for a team file, the other approvals and a green `pre-commit`. `.github/workflows/auto-merge.yaml` turns on GitHub's auto-merge for every pull request to the default branch that is not a draft, each time `pre-commit` has run for it (it runs when `pre-commit` ends, as a run of the default branch, so it adds no row to a pull request); GitHub merges it the moment the rules are met. A new commit drops the approvals (`dismiss_stale_reviews`), so nothing changes after it was reviewed. To keep a pull request from merging, make it a draft or request changes. The merge is made with the workflow's token, which starts no workflow, so `apply.yaml` follows on its schedule (every 4 hours) or by hand.
+- A change to `team-members/<team>.csv` also needs an approval from that team (`CODEOWNERS`), so that a team decides who joins it. A team that is secret or has no access to this repository cannot be a code owner (`fulfillment-wg`, `observability-wg`, `personas-wg`, `documentation-wg`, `org-admins`, `ci-duty`): its file has no rule and needs only the owners' approval.
+- When you add a team to `teams.csv` with `contributor` set to `true` and a `closed` privacy, add a line for its file to `CODEOWNERS` (`/team-members/<team>.csv @osac-project/<team>`).
+
 ### Let a team approve changes (be a maintainer)?
 
 1. Open `teams.csv`

repositories.tf

@@ -49,21 +49,75 @@ module "repo_github_config" {
   name                = "github-config"
   description         = "Repository for managing osac-project github organization"
   use_public_template = false
-  required_approvals  = 2
+  required_approvals  = 1
   required_status_checks = [
     { context = "pre-commit", integration_id = 15368 },
   ]
   ruleset_bypass_team_ids = [github_team.all["managers"].id]
 
+  # An approval of a code owner is needed where CODEOWNERS names one (a team file needs its team, see CODEOWNERS), and every
+  # pull request needs the owner (the ruleset below). Pull requests merge by themselves once approved (see
+  # .github/workflows/auto-merge.yaml), so a new commit must drop the approvals: nothing reviewed may change afterwards.
+  require_code_owner_reviews = true
+  dismiss_stale_reviews      = true
+
   contributor_teams = local.contributor_teams
   teams = [
     {
       team_id    = github_team.all["managers"].name
       permission = "admin"
+    },
+    {
+      team_id    = github_team.all["github-config-owners"].name
+      permission = "push"
     }
   ]
 }
 
+# Every pull request to github-config needs an approval of github-config-owners, whatever files it changes. CODEOWNERS cannot
+# say "this team AND that team" (one owner per path is enough), so the team files get their own team from CODEOWNERS and this
+# ruleset adds the owners on top. The author of a pull request cannot approve it, so a pull request of an owner is approved by
+# someone else, or merged by an organization admin, who may bypass the ruleset like the status checks one. Required
+# reviewers is a beta feature of GitHub rulesets.
+resource "github_repository_ruleset" "github_config_owner_review" {
+  name        = "owner-review"
+  repository  = "github-config"
+  target      = "branch"
+  enforcement = "active"
+
+  bypass_actors {
+    actor_id    = 1
+    actor_type  = "OrganizationAdmin"
+    bypass_mode = "always"
+  }
+
+  conditions {
+    ref_name {
+      include = ["~DEFAULT_BRANCH"]
+      exclude = []
+    }
+  }
+
+  rules {
+    pull_request {
+      required_approving_review_count = 0
+      dismiss_stale_reviews_on_push   = true
+
+      required_reviewers {
+        minimum_approvals = 1
+        file_patterns     = ["**"]
+
+        reviewer {
+          id   = tonumber(github_team.all["github-config-owners"].id)
+          type = "Team"
+        }
+      }
+    }
+  }
+
+  depends_on = [module.repo_github_config]
+}
+
 module "repo_dotgithub_private" {
   source      = "./modules/common_repository"
   visibility  = "private"

team-members/github-config-owners.csv

@@ -0,0 +1,2 @@
+username,role
+eliorerz,maintainer

teams.csv

@@ -24,3 +24,4 @@ wg-ui,OSAC UI working group,closed,true,true
 wg-e2e,OSAC E2E working group,closed,true,true
 wg-soln-eng,OSAC Solution Engineering working group,closed,true,true
 wg-qe,OSAC QE working group,closed,true,true
+github-config-owners,Approves every pull request to github-config,closed,false,false

versions.tf

@@ -3,7 +3,7 @@ terraform {
   required_providers {
     github = {
       source  = "integrations/github"
-      version = "~> 6.0"
+      version = "~> 6.13" # 6.13 reads the team reviewer id of a ruleset (required reviewers, repositories.tf: owner-review)
     }
   }
 }