NO-ISSUE: Let ci-duty force-merge on osac and enhancement-proposals

README.md

@@ -47,9 +47,12 @@ Add them to the `ci-duty` team (`team-members/ci-duty.csv`). That team:
 - Holds GitHub's predefined **CI/CD admin** organization role, granting management of
   org self-hosted runners and runner groups (plus Actions policies, secrets, variables,
   and usage metrics). See `organization.tf`.
-- Is a ruleset bypass actor on `osac` and `osac-test-infra`, so its members can bypass
-  the merge queue and required status checks on those repos. See `ruleset_bypass_team_ids`
-  in `repositories.tf`.
+- Can force-merge ("Merge without waiting for requirements to be met") on `osac`,
+  `osac-test-infra` and `enhancement-proposals`: it is a ruleset bypass actor there
+  (`ruleset_bypass_team_ids`), so its members can bypass the merge queue and required status
+  checks, and on `osac` it may also bypass the required reviews (`pull_request_bypassers`).
+  GitHub shows that checkbox only to someone who can bypass every rule on the branch. See
+  `repositories.tf`.
 
 The `managers` team holds the narrower `runner-manager` role, admin on the main
 repositories, and ruleset bypass on every repository with required status checks.

modules/common_repository/main.tf

@@ -103,6 +103,7 @@ resource "github_branch_protection" "repo_protection" {
       required_approving_review_count = var.required_approvals
       require_code_owner_reviews      = var.require_code_owner_reviews
       dismiss_stale_reviews           = var.dismiss_stale_reviews
+      pull_request_bypassers          = var.pull_request_bypassers
     }
   }
 

modules/common_repository/variables.tf

@@ -26,6 +26,12 @@ variable "require_code_owner_reviews" {
   default     = false
 }
 
+variable "pull_request_bypassers" {
+  description = "Actors allowed to merge without the required pull request reviews (including code owner reviews). Only has an effect when required_approvals is not null. Actor names must begin with '/' for users or 'org-name/' for teams."
+  type        = list(string)
+  default     = []
+}
+
 variable "dismiss_stale_reviews" {
   description = "Dismiss approving reviews when new commits are pushed. Only has an effect when required_approvals is not null."
   type        = bool

repositories.tf

@@ -154,6 +154,9 @@ module "repo_osac" {
   # A path listed in CODEOWNERS needs approval from its owner team (today the CI definition under .github/; a team adds
   # its own folders by a pull request to CODEOWNERS), and a path with no owner needs nobody in particular.
   require_code_owner_reviews = true
+  # ci-duty can force-merge ("Merge without waiting for requirements to be met"): that needs a bypass of these review
+  # requirements as well as of the ci-status-checks ruleset below. Admins (managers) bypass them already.
+  pull_request_bypassers = ["osac-project/${github_team.all["ci-duty"].name}"]
   # Three required checks. `CI` is the one job that adds up every cheap check that applies to the change (ci.yml; a part
   # that does not apply is skipped inside it) and `jira-reference` says the title names a Jira issue or NO-ISSUE (the
   # Prow-set label jira/valid-reference); both are posted by GitHub Actions. `E2E` is the full-install suites on a real
@@ -301,7 +304,10 @@ module "repo_enhancement_proposals" {
     # Job id in enhancement-proposals/.github/workflows/pre-commit.yaml.
     { context = "pre-commit", integration_id = 15368 },
   ]
-  ruleset_bypass_team_ids = [github_team.all["managers"].id]
+  ruleset_bypass_team_ids = [
+    github_team.all["managers"].id,
+    github_team.all["ci-duty"].id,
+  ]
 }
 
 module "repo_osac_test_infra" {

team-members/ci-duty.csv

@@ -3,7 +3,6 @@ rccrdpccl,member
 akshaynadkarni,member
 rgolangh,member
 CrystalChun,member
-ItzikEzra-rh,member
 sk-ilya,member
 omer-vishlitzky,member
 minmzzhang,member

teams.csv

@@ -9,7 +9,7 @@ wg-storage,OSAC Storage working group,closed,true
 managers,OSAC working group managers,closed,true
 architects,Architects across all OSAC working groups,closed,true
 wg-leads,Leads of the OSAC working groups,closed,true
-ci-duty,CI duty and merge assistance - bypass on osac and osac-test-infra and CI/CD admin,closed,false
+ci-duty,CI duty and merge assistance - force-merge on osac osac-test-infra and enhancement-proposals and CI/CD admin,closed,false
 contributors,OSAC contributors outside the working groups,closed,true
 wg-architecture,OSAC Architecture working group,closed,true
 wg-bmaas,OSAC BMaaS working group,closed,true