Add wg-infra as ruleset bypass actor

[omer-vishlitzky]

Summary

• PR NO-ISSUE: migrate required status checks to GitHub rulesets #131 migrated required status checks from github_branch_protection to github_repository_ruleset, but only granted bypass to OrganizationAdmin
• With branch protection, enforce_admins = false allowed repo admins (including wg-infra) to merge when checks were pending/failing
• Rulesets don't have an equivalent implicit admin bypass — it must be explicitly granted via bypass_actors
• This adds wg-infra (team ID 17948400) as a bypass actor on repos where the team already has admin permission: fulfillment-service, osac-operator, osac-aap, osac-installer

Changes

• modules/common_repository/variables.tf: add ruleset_bypass_team_ids variable (list of team database IDs, default [])
• modules/common_repository/main.tf: add dynamic bypass_actors block for each team ID
• repositories.tf: pass github_team.all["wg-infra"].id to the 4 affected repos

Test plan

• tofu plan shows 4 rulesets updated with new bypass actor, no other changes

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added support for designated teams to bypass repository CI status-check rulesets.
  • Enabled this bypass for selected repositories so approved team members can proceed when required.

• Configuration

  • Introduced an optional setting to specify a list of team IDs allowed to bypass CI status checks.
  • Existing repository permissions and environment settings remain unchanged.

[coderabbitai]

Walkthrough

The common repository module now accepts team IDs for status-check bypasses and creates corresponding GitHub ruleset actors. Four repositories pass the wg-infra team ID to enable this configuration.

Changes

Ruleset bypass configuration

Layer / File(s)	Summary
Bypass input and ruleset generation modules/common_repository/variables.tf, modules/common_repository/main.tf	Adds the ruleset_bypass_team_ids list input and dynamically creates Team bypass actors with bypass_mode = "always".
Repository team wiring repositories.tf	Configures repo_fulfillment_service, repo_cloudkit_operator, repo_cloudkit_aap, and repo_osac_installer with the wg-infra team ID. Existing allowance and environment values remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/github-config#131: Modifies the same status-check ruleset resource with related bypass-actor configuration.

Suggested reviewers: larsks, eliorerz, larsks

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ai-Attribution	⚠️ Warning	The PR’s ruleset commit uses Co-Authored-By: Claude Opus 4.6, and I found no Assisted-by/Generated-by trailer on that AI-assisted commit.	Replace the AI Co-Authored-By trailer with a Red Hat Assisted-by or Generated-by trailer, and keep AI tools out of co-author lines.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding wg-infra as a ruleset bypass actor.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	Touched Terraform adds only a team-ID reference and a new list variable; no API keys, tokens, passwords, private keys, or embedded credentials found.
No-Weak-Crypto	✅ Passed	Touched Terraform only adds ruleset bypass wiring; scans found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
No-Injection-Vectors	✅ Passed	Touched Terraform only; the new bypass-actors wiring uses typed values and no listed injection sinks appeared.
Container-Privileges	✅ Passed	PR only adjusts Terraform GitHub ruleset inputs; no changed container/K8s manifests or privileged settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	No logging statements or secret-bearing outputs were added; the PR only adds Terraform ruleset bypass config and team IDs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ruleset-admin-bypass

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

repositories.tf (1)

374-393: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Missing ruleset bypass configuration for wg-infra.

The PR objective indicates this change restores admin bypass capabilities for the wg-infra team across repositories where they hold admin rights. Since wg-infra is granted admin permission in repo_osac_csi_driver as well, they will likely lose their bypass capabilities here unless ruleset_bypass_team_ids is explicitly provided.

Please verify if this module should include the bypass configuration (e.g., ruleset_bypass_team_ids = ...) to remain consistent with the other updated repositories.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@repositories.tf` around lines 374 - 393, Add the appropriate
ruleset_bypass_team_ids configuration to the repo_osac_csi_driver module for the
wg-infra team, matching the established value used by other repositories where
wg-infra has admin permission. Preserve the existing teams, permissions, and
push_allowances settings.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@repositories.tf`:
- Around line 374-393: Add the appropriate ruleset_bypass_team_ids configuration
to the repo_osac_csi_driver module for the wg-infra team, matching the
established value used by other repositories where wg-infra has admin
permission. Preserve the existing teams, permissions, and push_allowances
settings.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 3951bcd6-1d66-4301-a77d-2cfb4a760b36

📥 Commits

Reviewing files that changed from the base of the PR and between b51ffc9 and 9add537.

📒 Files selected for processing (1)

• repositories.tf