diff --git a/src/tf/modules/repository/main.tf b/src/tf/modules/repository/main.tf index ede2668..4e1fb8f 100644 --- a/src/tf/modules/repository/main.tf +++ b/src/tf/modules/repository/main.tf @@ -64,7 +64,7 @@ resource "github_repository_ruleset" "main" { pull_request { allowed_merge_methods = ["rebase", "squash"] dismiss_stale_reviews_on_push = true - required_approving_review_count = length(var.review_bypass_actors) == 0 ? var.required_approving_review_count : 0 + required_approving_review_count = length(var.review_exempt_integrations) == 0 ? var.required_approving_review_count : 0 required_review_thread_resolution = true } @@ -88,7 +88,7 @@ resource "github_repository_ruleset" "main" { } resource "github_repository_ruleset" "required_reviews" { - count = length(var.review_bypass_actors) == 0 ? 0 : 1 + count = length(var.review_exempt_integrations) == 0 ? 0 : 1 name = "Require pull request reviews" repository = github_repository.this.name @@ -113,12 +113,12 @@ resource "github_repository_ruleset" "required_reviews" { } dynamic "bypass_actors" { - for_each = var.review_bypass_actors + for_each = var.review_exempt_integrations content { - actor_id = bypass_actors.value.actor_id - actor_type = bypass_actors.value.actor_type - bypass_mode = "pull_request" + actor_id = bypass_actors.value + actor_type = "Integration" + bypass_mode = "exempt" } } diff --git a/src/tf/modules/repository/variables.tf b/src/tf/modules/repository/variables.tf index 7e35450..79a2703 100644 --- a/src/tf/modules/repository/variables.tf +++ b/src/tf/modules/repository/variables.tf @@ -52,13 +52,10 @@ variable "required_approving_review_count" { } } -variable "review_bypass_actors" { - description = "Actors allowed to bypass required approving reviews through pull requests" - type = set(object({ - actor_id = number - actor_type = string - })) - default = [] +variable "review_exempt_integrations" { + description = "GitHub Apps exempt from required approving reviews" + type = set(number) + default = [] } variable "ruleset_enforcement" { diff --git a/src/tf/repositories.tf b/src/tf/repositories.tf index 30f6a79..15699d5 100644 --- a/src/tf/repositories.tf +++ b/src/tf/repositories.tf @@ -22,11 +22,8 @@ locals { required_check = "Terraform checks" } infra-k8s-apps = { - required_check = "checks / Kubernetes checks" - review_bypass_actors = [{ - actor_id = local.deployment_automation_app_id - actor_type = "Integration" - }] + required_check = "checks / Kubernetes checks" + review_exempt_integrations = [local.deployment_automation_app_id] } infra-vm-workloads = { required_check = "CI checks" @@ -45,7 +42,7 @@ module "infrastructure_repository" { context = each.value.required_check integration_id = local.github_actions_integration_id }] - review_bypass_actors = try(each.value.review_bypass_actors, []) + review_exempt_integrations = try(each.value.review_exempt_integrations, []) teams = concat( [ {