From 69c0b30eb4e696b86e09b8ef17068eb681960bc8 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Thu, 22 Oct 2026 19:06:53 -0400 Subject: [PATCH] NO-ISSUE: Let ci-duty bypass branch protections with its role The force-merge checkbox of a pull request ("Merge without waiting for requirements to be met") is offered only to someone who can bypass every rule on the branch. ci-duty is already a bypass actor of the rulesets and of the review requirements, but its repository role, ci-maintainer, had no permission to bypass branch protections, so a pull request ejected from the merge queue showed the team only "Merge when ready". Add bypass_branch_protection to the ci-maintainer role (osac and osac-test-infra) and say so in its description and in the README. Signed-off-by: Elior Erez --- README.md | 4 +++- organization.tf | 9 +++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c79cd2f..ee4c339 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,9 @@ Add them to the `ci-duty` team (`team-members/ci-duty.csv`). That team: `repositories.tf`. - Has the `ci-maintainer` custom repository role on `osac` and `osac-test-infra`: write, plus management of the repository's Actions secrets, variables, environments, settings and - runners, and merge queue priority (jump the queue, solo merge). See `organization.tf`. + runners, merge queue priority (jump the queue, solo merge), and bypass of branch + protections (which GitHub needs in order to offer the force-merge checkbox). See + `organization.tf`. The `managers` team holds the narrower `runner-manager` role, admin on the main repositories, and ruleset bypass on every repository with required status checks. diff --git a/organization.tf b/organization.tf index e33538a..46996bd 100644 --- a/organization.tf +++ b/organization.tf @@ -58,11 +58,15 @@ resource "github_organization_role_team" "cicd_admin_ci_duty" { # osac-test-infra). The CI/CD admin role above covers only org-level Actions # settings, so without this, repository secrets and variables (BUF_TOKEN, # KONFLUX_SA_TOKEN, ...), environments, Actions settings and repository runners -# need repository admin. Permission names come from +# need repository admin. It also lets the team merge past the branch protection +# of a pull request (bypass_branch_protection), next to the ruleset and review +# bypass it already has (ruleset_bypass_team_ids, pull_request_bypassers), so the +# "Merge without waiting for requirements to be met" checkbox is offered to its +# members as it is to admins. Permission names come from # gh api /orgs/osac-project/repository-fine-grained-permissions resource "github_organization_repository_role" "ci_maintainer" { name = "ci-maintainer" - description = "Write, plus management of the repository's Actions secrets, variables, environments, settings and runners, and merge queue priority" + description = "Write, plus management of the repository's Actions secrets, variables, environments, settings and runners, merge queue priority, and bypass of branch protections" base_role = "write" permissions = [ @@ -73,5 +77,6 @@ resource "github_organization_repository_role" "ci_maintainer" { "write_repository_actions_runners", "jump_merge_queue", "create_solo_merge_queue_entry", + "bypass_branch_protection", ] }