You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
NO-ISSUE: codify osac's release-branch ruleset and merge queue - #293
Both release-branch-protection (wildcard refs/heads/release-*, required checks + review requirements + deletion/force-push block) and release-0.4-merge-queue (exact-branch, merge queue only -- GitHub rejects a wildcard pattern with a merge_queue rule present) were created out-of-band via the GitHub API on 2026-11-04 when release-0.4 was actually cut, ahead of this repo's own cycle.
Codifies both here via import blocks, mirroring repo_osac's own ci-status-checks/merge_queue patterns as closely as the wildcard/non-existent-branch constraints allow.
release-0.4-merge-queue will need a new sibling resource per future release branch (0.5, 0.6, ...) -- the wildcard ruleset only needed creating once.
Important: this repo auto-applies on merge
apply.yaml runs tofu apply -auto-approve on every push to main, with no PR-time plan preview. I validated this change with tofu validate against a scratch copy (did not touch the real S3 backend state from here). Recommend running tofu plan locally against the real backend before merging, to confirm the import blocks produce a clean (zero-diff) adoption of the already-live resources.
Test plan
tofu fmt clean.
tofu validate against a scratch copy with the real provider plugin -- valid (only pre-existing, unrelated deprecation warnings).
tofu plan against the real backend (needs AWS credentials I don't have here) -- please run before merging.
Summary
Adds a wildcard release-* branch ruleset for the osac repository. It requires the CI, jira-reference, and E2E checks, one code-owner approval, and dismissal of stale approvals. It blocks deletion and non-fast-forward updates.
Adds a merge-queue ruleset for release-0.4. Both rulesets use the specified bypass actors and are imported into Terraform state.
Affected areas: GitHub repository configuration and release-branch governance. No API, controller, database, deployment workflow, CI workflow, test, or documentation changes are established by the supplied evidence.
Compatibility: The rules add requirements to release branches. The supplied description notes that GitHub does not allow a wildcard ruleset with a merge-queue rule, so each future release branch that needs a merge queue will require its own ruleset.
Validation: The author reports that formatting and validation passed in a scratch copy. A plan against the real backend was not run, so import results and planned changes remain unconfirmed.
Risk classification
The applied risk label and its criteria cannot be established. The supplied material does not include the labeling instructions, and the repository search returned no matching risk-label guidance. Therefore, I cannot state whether this is risk:ship, risk:show, or risk:ask, or compare it with a nearby classification.
Both were created out-of-band via the GitHub API on 2026-11-04 when
release-0.4 was actually cut (ahead of this repo's own plan/apply
cycle). Codifying them here so they're reviewable/reproducible like
everything else in this file, via the import block each carries.
release_branch_protection mirrors repo_osac's own ci-status-checks
ruleset: same three required checks, same review requirements -- with
the real approving-review-count embedded directly in the ruleset's own
pull_request rule rather than left to classic branch protection, since
github_branch_protection can't target a branch that doesn't exist yet
(release-* branches are cut on demand). Scoped to refs/heads/release-*
so it covers every future release branch (0.5, 0.6, ...) without
needing to be recreated per cut.
release_0_4_merge_queue has to be a separate, exact-branch-scoped
resource: GitHub rejects a wildcard ref_name pattern when a
merge_queue rule is present ("Wildcard ref names are not supported
when merge queue is enabled", confirmed live), so -- unlike the
wildcard ruleset above -- this one needs a new sibling resource per
release branch going forward.
Neither is generated by modules/common_repository: release-* is an
osac-specific pattern, not something every repo this module manages
needs, so these are standalone resources rather than new module
variables (unlike tag_rulesets, which genuinely is generic).
Validated with `tofu validate` against a scratch copy (this repo's
real backend is a shared S3 state bucket -- deliberately did not run
plan/apply against it from here; recommend a human run `tofu plan`
locally before merging, since this repo's own apply.yaml auto-applies
on push to main with no PR-time plan preview).
Signed-off-by: Elior Erez <eerez@redhat.com>
No actionable comments were generated in the recent review.
Walkthrough
The pull request adds two active GitHub rulesets for the osac repository: branch protection for release-* and merge-queue settings for release-0.4.
Changes
OSAC Release Rulesets
Layer / File(s)
Summary
Release branch protection repositories.tf
Adds required CI, Jira-reference, and E2E checks; one code-owner approval; stale approval dismissal; and restrictions on deletion and non-fast-forward updates for release-*. Organization admins, the merge-queue integration, managers, and ci-duty can bypass the ruleset.
Release merge queue repositories.tf
Adds the configured squash merge queue and 180-minute check timeout for release-0.4. It uses the same bypass actors as the branch protection ruleset.
No actionable issue is established that blocks merging. Running a plan against the real backend remains a prudent check before the automatic apply.
Pre-merge checks: 11
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title clearly and concisely describes the main changes: codifying the osac release-branch ruleset and merge queue.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets
The pull request adds only GitHub ruleset configuration. The changed literals are repository/ruleset names, branch patterns, check contexts, numeric GitHub actor/integration IDs, and import IDs. No AP…
No-Weak-Crypto
PASS. The pull request changes only repositories.tf and adds GitHub ruleset/import configuration. The added lines contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secret/…
No-Injection-Vectors
The pull request changes only repositories.tf and adds static OpenTofu/GitHub ruleset declarations plus import blocks. The diff contains no SQL construction, shell execution, eval/exec, pickle o…
Container-Privileges
PASS: The pull request changes only repositories.tf and adds GitHub repository rulesets. It adds no container or Kubernetes manifest and introduces none of the checked settings: privileged: true, …
No-Sensitive-Data-In-Logs
The pull request adds GitHub ruleset resources, imports, and comments in repositories.tf. The changed lines contain no logging, printing, tracing, or output code, and no passwords, tokens, API keys,…
Ai-Attribution
No AI tool use is mentioned in the authored PR description or commit message. The commit contains only a Signed-off-by trailer and no Co-Authored-By, Assisted-by, or Generated-by trailer. Ther…
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: No-Hardcoded-Secrets
Explanation
The pull request adds only GitHub ruleset configuration. The changed literals are repository/ruleset names, branch patterns, check contexts, numeric GitHub actor/integration IDs, and import IDs. No API keys, tokens, passwords, private keys, embedded credentials, credential-named string assignments, or long base64/hex secrets are present.
Full details: No-Weak-Crypto
Explanation
PASS. The pull request changes only repositories.tf and adds GitHub ruleset/import configuration. The added lines contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secret/token comparisons.
Full details: No-Injection-Vectors
Explanation
The pull request changes only repositories.tf and adds static OpenTofu/GitHub ruleset declarations plus import blocks. The diff contains no SQL construction, shell execution, eval/exec, pickle or unsafe YAML loading, os.system, or dangerouslySetInnerHTML usage. No explicit injection-vector condition is introduced.
Full details: Container-Privileges
Explanation
PASS: The pull request changes only repositories.tf and adds GitHub repository rulesets. It adds no container or Kubernetes manifest and introduces none of the checked settings: privileged: true, host PID/network/IPC, SYS_ADMIN, unjustified root execution, or allowPrivilegeEscalation: true.
Full details: No-Sensitive-Data-In-Logs
Explanation
The pull request adds GitHub ruleset resources, imports, and comments in repositories.tf. The changed lines contain no logging, printing, tracing, or output code, and no passwords, tokens, API keys, PII, session IDs, hostnames, or customer data.
Full details: Ai-Attribution
Explanation
No AI tool use is mentioned in the authored PR description or commit message. The commit contains only a Signed-off-by trailer and no Co-Authored-By, Assisted-by, or Generated-by trailer. Therefore, the conditional attribution requirement does not apply.
Finishing Touches
Generate unit tests (beta)
Create a new PR
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Central YAML; Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b69dd557-501d-437c-8dc6-baa4baec1508
Commits
Reviewing files that changed from the base of the PR and between 38e63fe and 6ee1bcb.
Files selected for processing: 1
repositories.tf
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
release-branch-protection(wildcardrefs/heads/release-*, required checks + review requirements + deletion/force-push block) andrelease-0.4-merge-queue(exact-branch, merge queue only -- GitHub rejects a wildcard pattern with a merge_queue rule present) were created out-of-band via the GitHub API on 2026-11-04 whenrelease-0.4was actually cut, ahead of this repo's own cycle.importblocks, mirroringrepo_osac's ownci-status-checks/merge_queuepatterns as closely as the wildcard/non-existent-branch constraints allow.release-0.4-merge-queuewill need a new sibling resource per future release branch (0.5, 0.6, ...) -- the wildcard ruleset only needed creating once.Important: this repo auto-applies on merge
apply.yamlrunstofu apply -auto-approveon every push tomain, with no PR-time plan preview. I validated this change withtofu validateagainst a scratch copy (did not touch the real S3 backend state from here). Recommend runningtofu planlocally against the real backend before merging, to confirm the import blocks produce a clean (zero-diff) adoption of the already-live resources.Test plan
tofu fmtclean.tofu validateagainst a scratch copy with the real provider plugin -- valid (only pre-existing, unrelated deprecation warnings).tofu planagainst the real backend (needs AWS credentials I don't have here) -- please run before merging.Summary
release-*branch ruleset for theosacrepository. It requires theCI,jira-reference, andE2Echecks, one code-owner approval, and dismissal of stale approvals. It blocks deletion and non-fast-forward updates.release-0.4. Both rulesets use the specified bypass actors and are imported into Terraform state.Risk classification
The applied risk label and its criteria cannot be established. The supplied material does not include the labeling instructions, and the repository search returned no matching risk-label guidance. Therefore, I cannot state whether this is
risk:ship,risk:show, orrisk:ask, or compare it with a nearby classification.