NO-ISSUE: Let ci-duty bypass branch protections with its role

README.md

@@ -55,7 +55,9 @@ Add them to the `ci-duty` team (`team-members/ci-duty.csv`). That team:
   `repositories.tf`.
 - Has the `ci-maintainer` custom repository role on `osac` and `osac-test-infra`: write, plus
   management of the repository's Actions secrets, variables, environments, settings and
-  runners, and merge queue priority (jump the queue, solo merge). See `organization.tf`.
+  runners, merge queue priority (jump the queue, solo merge), and bypass of branch
+  protections (which GitHub needs in order to offer the force-merge checkbox). See
+  `organization.tf`.
 
 The `managers` team holds the narrower `runner-manager` role, admin on the main
 repositories, and ruleset bypass on every repository with required status checks.

organization.tf

@@ -58,11 +58,15 @@ resource "github_organization_role_team" "cicd_admin_ci_duty" {
 # osac-test-infra). The CI/CD admin role above covers only org-level Actions
 # settings, so without this, repository secrets and variables (BUF_TOKEN,
 # KONFLUX_SA_TOKEN, ...), environments, Actions settings and repository runners
-# need repository admin. Permission names come from
+# need repository admin. It also lets the team merge past the branch protection
+# of a pull request (bypass_branch_protection), next to the ruleset and review
+# bypass it already has (ruleset_bypass_team_ids, pull_request_bypassers), so the
+# "Merge without waiting for requirements to be met" checkbox is offered to its
+# members as it is to admins. Permission names come from
 #   gh api /orgs/osac-project/repository-fine-grained-permissions
 resource "github_organization_repository_role" "ci_maintainer" {
   name        = "ci-maintainer"
-  description = "Write, plus management of the repository's Actions secrets, variables, environments, settings and runners, and merge queue priority"
+  description = "Write, plus management of the repository's Actions secrets, variables, environments, settings and runners, merge queue priority, and bypass of branch protections"
   base_role   = "write"
 
   permissions = [
@@ -73,5 +77,6 @@ resource "github_organization_repository_role" "ci_maintainer" {
     "write_repository_actions_runners",
     "jump_merge_queue",
     "create_solo_merge_queue_entry",
+    "bypass_branch_protection",
   ]
 }