[eliorerz]

Summary

Since #268, ci-duty members don't see GitHub's "Merge without waiting for requirements to be met (bypass rules)" checkbox on osac. GitHub shows it only to someone who can bypass every rule on the branch:

Repo	What blocked ci-duty	Fix
osac	Classic branch protection requires 1 approval plus a code owner review (required_approvals = 1, require_code_owner_reviews = true). Only admins could skip it; before #268 the force-merge group were admins through wg-infra.	New module input pull_request_bypassers, set to osac-project/ci-duty on osac.
osac-test-infra	Nothing. Its only rule is the ci-status-checks ruleset, which ci-duty already bypasses.	None
enhancement-proposals	ci-duty wasn't a bypass actor on its ci-status-checks ruleset.	Add ci-duty to ruleset_bypass_team_ids.

Also removes ItzikEzra-rh from ci-duty.

Changes

• modules/common_repository: new pull_request_bypassers variable (default []), passed to required_pull_request_reviews.pull_request_bypassers. No effect on repos that don't set it.
• repositories.tf: on osac, pull_request_bypassers = ["osac-project/ci-duty"]; on enhancement-proposals, ci-duty is added to the ruleset bypass list.
• team-members/ci-duty.csv: ItzikEzra-rh is removed. They keep push on all repos through wg-qe.
• teams.csv (ci-duty description) and README.md: describe the force-merge scope.

Validation

• tofu fmt -check -recursive, tofu validate, pre-commit run --all-files: pass.
• Expected plan: in-place updates to module.repo_osac.github_branch_protection.repo_protection[0] and module.repo_enhancement_proposals.github_repository_ruleset.status_checks[0], the ci-duty description, and the 2 recurring repo updates; 1 destroy (ItzikEzra-rh's ci-duty membership). I'll post the local plan output once it's run.
• After apply: a ci-duty member who isn't an org owner sees the bypass checkbox on an osac PR and on an enhancement-proposals PR.

🤖 Generated with Claude Code

Summary

• Repository access: Adds ci-duty as a ruleset bypass team on enhancement-proposals. On osac, adds the team as a pull-request review bypasser as well as a ruleset bypass actor. The README documents that the bypass can skip merge-queue, status-check, and—on osac—required-review rules.
• Module interface: Adds the pull_request_bypassers input to modules/common_repository. It defaults to an empty list, so callers that do not set it retain the existing behavior.
• Team membership: Removes ItzikEzra-rh from the ci-duty member list. The supplied objective states that they retain push access through wg-qe.
• Other areas: Updates the ci-duty team description. No database, controller, or deployment changes are shown. No test changes are included. The author reports that tofu fmt -check -recursive, tofu validate, and pre-commit run --all-files pass; these results were not independently verified.

Compatibility

The new module input is backward-compatible for existing callers because it defaults to []. The repository rules change expands ci-duty members’ ability to bypass merge requirements. Removing a member changes that person’s ci-duty access.

Risk classification

Unavailable. The supplied evidence does not include the labeling instructions, an applied risk label, or the criteria for risk:ship, risk:show, and risk:ask. The evidence also does not support determining whether the change was close to another classification.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: a756dc20-f4df-469a-b583-b0eca706236f

📥 Commits

Reviewing files that changed from the base of the PR and between 8ed2e3e and cb1c486.

⛔ Files ignored due to path filters: 2

• team-members/ci-duty.csv is excluded by !**/*.csv
• teams.csv is excluded by !**/*.csv

📒 Files selected for processing: 4

• README.md
• modules/common_repository/main.tf
• modules/common_repository/variables.tf
• repositories.tf

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 6 remain after this review.

Walkthrough

The common repository module now supports pull-request bypassers. The osac and enhancement-proposals settings add ci-duty to their bypass configuration, and the README describes the updated scope.

Changes

Repository bypass configuration

Layer / File(s)	Summary
Pull-request bypasser support modules/common_repository/variables.tf, modules/common_repository/main.tf	The module adds a pull_request_bypassers variable and passes it to branch protection.
Repository bypass settings and documentation repositories.tf, README.md	The osac settings add ci-duty as a pull-request bypasser. The enhancement-proposals ruleset bypass list adds ci-duty. The README documents the updated bypass scope and osac review bypass.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested labels: risk:ask

Suggested reviewers: larsks

Merge Risk: ⚪ Minimal · up to cb1c4

ci-duty is configured for the intended review and ruleset bypasses. Confirm osac’s queue behavior during normal apply and merge validation before relying on that bypass.

Pre-merge checks: 11

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: allowing ci-duty to force-merge on osac and enhancement-proposals.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets		The pull request adds Terraform configuration, team names, documentation, and a membership removal. The added values contain no API keys, tokens, passwords, private-key material, embedded URL credenti…
No-Weak-Crypto		The authoritative PR diff changes Terraform GitHub bypass configuration, CSV membership, and documentation. A targeted scan of added lines found no weak-crypto terms or secret/token comparisons; repos…
No-Injection-Vectors		PASS: The pull request changes only Terraform configuration, CSV membership data, and documentation. The added Terraform passes a list of repository review bypasser names and team IDs; it does not add…
Container-Privileges		PASS: The PR changes Terraform, CSV, and README files only. It adds no container or Kubernetes manifest and no privileged, host namespace, SYS_ADMIN, or allowPrivilegeEscalation setting.
No-Sensitive-Data-In-Logs		No changed code adds logging or emits passwords, tokens, API keys, PII, session IDs, or customer data. The pull request only changes Terraform configuration, team membership, and documentation. Existi…
Ai-Attribution		AI use is disclosed in the PR and commit. The single commit includes the Red Hat Assisted-by: Claude Code (Claude Opus 5.5) <[email protected]> trailer. No Co-Authored-By trailer appears.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Full details: No-Hardcoded-Secrets

Explanation

The pull request adds Terraform configuration, team names, documentation, and a membership removal. The added values contain no API keys, tokens, passwords, private-key material, embedded URL credentials, or base64/hex blobs over 32 characters. The README mentions credential environment variables and GitHub tokens only as documentation, not as assigned string literals.

Full details: No-Weak-Crypto

Explanation

The authoritative PR diff changes Terraform GitHub bypass configuration, CSV membership, and documentation. A targeted scan of added lines found no weak-crypto terms or secret/token comparisons; repository matches are ordinary descriptions and configuration labels, not cryptographic code. No MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or non-constant-time secret comparison was introduced.

Full details: No-Injection-Vectors

Explanation

PASS: The pull request changes only Terraform configuration, CSV membership data, and documentation. The added Terraform passes a list of repository review bypasser names and team IDs; it does not add SQL, shell execution, eval/exec, deserialization, unsafe YAML loading, or HTML injection.

Full details: No-Sensitive-Data-In-Logs

Explanation

No changed code adds logging or emits passwords, tokens, API keys, PII, session IDs, or customer data. The pull request only changes Terraform configuration, team membership, and documentation. Existing credential references in README and workflow files are unchanged and are not logging behavior.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}