rulesets: implement bypass-app-ids

Author: marcoieni

config.toml

@@ -83,5 +83,6 @@ members-without-zulip-id = [
 ]
 
 enable-rulesets-repos = [
-   "rust-lang/bors"
+   "rust-lang/bors",
+   "rust-lang/crates.io",
 ]

docs/toml-schema.md

@@ -429,6 +429,19 @@ allowed-merge-teams = ["awesome-team"]
 # When "homu" is used, "bors" has to be in the `bots` array.
 # (optional)
 merge-bots = ["homu"]
+# Whether to enable a merge queue for this branch.
+# (optional - default `false`)
+merge-queue = false
+# GitHub App IDs that are allowed to bypass the branch protection rules.
+# The app ID can be found via the GitHub API (GET /orgs/{org}/installations).
+# (optional)
+bypass-app-ids = [2201425] # workflows-crates-io
+# Whether to prevent branch deletion.
+# (optional - default `false`)
+prevent-deletion = false
+# Whether to prevent force pushes to the branch.
+# (optional - default `false`)
+prevent-force-push = false
 ```
 
 ### Repository environments

repos/rust-lang/bors.toml

@@ -14,6 +14,7 @@ infra-bors-admins = "write"
 pattern = "main"
 ci-checks = ["Test", "Test Docker"]
 required-approvals = 0
+merge-queue = true
 
 [environments.production]
 branches = ["main"]

repos/rust-lang/crates.io.toml

@@ -7,6 +7,21 @@ bots = ["renovate", "rustbot", "heroku-deploy-access"]
 [access.teams]
 crates-io = "write"
 
+[[branch-protections]]
+pattern = "main"
+ci-checks = [
+    "Backend / Lint",
+    "Backend / Test",
+    "Backend / dependencies",
+    "Frontend / Lint",
+    "Frontend / Test",
+]
+required-approvals = 0
+merge-queue = false
+prevent-deletion = true
+prevent-force-push = true
+bypass-app-ids = [2201425] # workflows-crates-io
+
 [environments.crates-io]
 
 [environments.staging-crates-io]

rust_team_data/src/v1.rs

@@ -260,6 +260,13 @@ pub struct BranchProtection {
     pub mode: BranchProtectionMode,
     pub allowed_merge_teams: Vec<String>,
     pub merge_bots: Vec<MergeBot>,
+    #[serde(default)]
+    pub bypass_app_ids: Vec<i64>,
+    pub merge_queue: bool,
+    #[serde(default)]
+    pub prevent_deletion: bool,
+    #[serde(default)]
+    pub prevent_force_push: bool,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]

src/schema.rs

@@ -879,6 +879,14 @@ pub(crate) struct BranchProtection {
     pub allowed_merge_teams: Vec<String>,
     #[serde(default)]
     pub merge_bots: Vec<MergeBot>,
+    #[serde(default)]
+    pub bypass_app_ids: Vec<i64>,
+    #[serde(default)]
+    pub merge_queue: bool,
+    #[serde(default)]
+    pub prevent_deletion: bool,
+    #[serde(default)]
+    pub prevent_force_push: bool,
 }
 
 #[derive(serde_derive::Deserialize, Debug)]

src/static_api.rs

@@ -71,6 +71,10 @@ impl<'a> Generator<'a> {
                             MergeBot::Bors => v1::MergeBot::Bors,
                         })
                         .collect(),
+                    bypass_app_ids: b.bypass_app_ids.clone(),
+                    merge_queue: b.merge_queue,
+                    prevent_deletion: b.prevent_deletion,
+                    prevent_force_push: b.prevent_force_push,
                 })
                 .collect();
             let managed_by_bors = r.bots.contains(&Bot::Bors);

sync-team/src/github/api/mod.rs

@@ -562,12 +562,12 @@ pub(crate) struct RulesetBypassActor {
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-#[serde(rename_all = "snake_case")]
 pub(crate) enum RulesetActorType {
     Integration,
     OrganizationAdmin,
     RepositoryRole,
     Team,
+    DeployKey,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]

sync-team/src/github/mod.rs

@@ -966,6 +966,16 @@ pub fn construct_ruleset(branch_protection: &rust_team_data::v1::BranchProtectio
 
     let mut rules: Vec<RulesetRule> = Vec::new();
 
+    // Add deletion protection if requested
+    if branch_protection.prevent_deletion {
+        rules.push(RulesetRule::Deletion);
+    }
+
+    // Add non-fast-forward protection if requested
+    if branch_protection.prevent_force_push {
+        rules.push(RulesetRule::NonFastForward);
+    }
+
     // Add pull request rule if PRs are required
     if let BranchProtectionMode::PrRequired {
         required_approvals, ..
@@ -1003,29 +1013,39 @@ pub fn construct_ruleset(branch_protection: &rust_team_data::v1::BranchProtectio
         });
     }
 
-    // Enable merge queue with default settings
-    rules.push(RulesetRule::MergeQueue {
-        parameters: MergeQueueParameters {
-            check_response_timeout_minutes: 360,
-            grouping_strategy: MergeQueueGroupingStrategy::Allgreen,
-            max_entries_to_build: 5,
-            max_entries_to_merge: 5,
-            merge_method: MergeQueueMergeMethod::Merge,
-            min_entries_to_merge: 0,
-            min_entries_to_merge_wait_minutes: 0,
-        },
-    });
+    if branch_protection.merge_queue {
+        // Enable merge queue with default settings
+        rules.push(RulesetRule::MergeQueue {
+            parameters: MergeQueueParameters {
+                check_response_timeout_minutes: 360,
+                grouping_strategy: MergeQueueGroupingStrategy::Allgreen,
+                max_entries_to_build: 5,
+                max_entries_to_merge: 5,
+                merge_method: MergeQueueMergeMethod::Merge,
+                min_entries_to_merge: 0,
+                min_entries_to_merge_wait_minutes: 0,
+            },
+        });
+    }
 
-    // TODO: Add bypass actors based on allowed_merge_teams and merge_bots
-    // This would require fetching team IDs, which needs more integration
+    // Build bypass actors from app IDs
+    let bypass_actors: Vec<RulesetBypassActor> = branch_protection
+        .bypass_app_ids
+        .iter()
+        .map(|&app_id| RulesetBypassActor {
+            actor_id: app_id,
+            actor_type: RulesetActorType::Integration,
+            bypass_mode: RulesetBypassMode::Always,
+        })
+        .collect();
 
     api::Ruleset {
         id: None,
         name: format!("Ruleset for {}", branch_protection.pattern),
         target: RulesetTarget::Branch,
         source_type: RulesetSourceType::Repository,
         enforcement: RulesetEnforcement::Active,
-        bypass_actors: Some(vec![]),
+        bypass_actors: Some(bypass_actors),
         conditions: RulesetConditions {
             ref_name: RulesetRefNameCondition {
                 include: vec![convert_branch_pattern_to_ref_pattern(

sync-team/src/github/tests/test_utils.rs

@@ -427,6 +427,10 @@ pub struct BranchProtectionBuilder {
     pub mode: BranchProtectionMode,
     pub allowed_merge_teams: Vec<String>,
     pub merge_bots: Vec<MergeBot>,
+    pub bypass_app_ids: Vec<i64>,
+    pub merge_queue: bool,
+    pub prevent_deletion: bool,
+    pub prevent_force_push: bool,
 }
 
 impl BranchProtectionBuilder {
@@ -451,13 +455,21 @@ impl BranchProtectionBuilder {
             mode,
             allowed_merge_teams,
             merge_bots,
+            bypass_app_ids,
+            merge_queue,
+            prevent_deletion,
+            prevent_force_push,
         } = self;
         v1::BranchProtection {
             pattern,
             dismiss_stale_review,
             mode,
             allowed_merge_teams,
             merge_bots,
+            bypass_app_ids,
+            merge_queue,
+            prevent_deletion,
+            prevent_force_push,
         }
     }
 
@@ -468,6 +480,10 @@ impl BranchProtectionBuilder {
             dismiss_stale_review: false,
             allowed_merge_teams: vec![],
             merge_bots: vec![],
+            bypass_app_ids: vec![],
+            merge_queue: false,
+            prevent_deletion: false,
+            prevent_force_push: false,
         }
     }
 }