From 0e80fb40727cb982e30b12a22674da74eef5ecc0 Mon Sep 17 00:00:00 2001 From: Levi Zitting Date: Thu, 20 Aug 2026 22:06:15 -0500 Subject: [PATCH 1/3] fix: exempt deployment automation from reviews --- src/tf/modules/repository/main.tf | 2 +- src/tf/modules/repository/variables.tf | 7 ++++--- src/tf/repositories.tf | 5 +++-- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/src/tf/modules/repository/main.tf b/src/tf/modules/repository/main.tf index ede2668..c77d48f 100644 --- a/src/tf/modules/repository/main.tf +++ b/src/tf/modules/repository/main.tf @@ -118,7 +118,7 @@ resource "github_repository_ruleset" "required_reviews" { content { actor_id = bypass_actors.value.actor_id actor_type = bypass_actors.value.actor_type - bypass_mode = "pull_request" + bypass_mode = bypass_actors.value.bypass_mode } } diff --git a/src/tf/modules/repository/variables.tf b/src/tf/modules/repository/variables.tf index 7e35450..75fc214 100644 --- a/src/tf/modules/repository/variables.tf +++ b/src/tf/modules/repository/variables.tf @@ -53,10 +53,11 @@ variable "required_approving_review_count" { } variable "review_bypass_actors" { - description = "Actors allowed to bypass required approving reviews through pull requests" + description = "Actors allowed to bypass required approving reviews" type = set(object({ - actor_id = number - actor_type = string + actor_id = number + actor_type = string + bypass_mode = optional(string, "pull_request") })) default = [] } diff --git a/src/tf/repositories.tf b/src/tf/repositories.tf index 30f6a79..44bb047 100644 --- a/src/tf/repositories.tf +++ b/src/tf/repositories.tf @@ -24,8 +24,9 @@ locals { infra-k8s-apps = { required_check = "checks / Kubernetes checks" review_bypass_actors = [{ - actor_id = local.deployment_automation_app_id - actor_type = "Integration" + actor_id = local.deployment_automation_app_id + actor_type = "Integration" + bypass_mode = "exempt" }] } infra-vm-workloads = { From 32b376f641a3cde16456dc4ea77001cd245b759e Mon Sep 17 00:00:00 2001 From: Levi Zitting Date: Thu, 20 Aug 2026 22:07:01 -0500 Subject: [PATCH 2/3] refactor: clarify review integration input --- src/tf/modules/repository/main.tf | 10 +++++----- src/tf/modules/repository/variables.tf | 7 +++---- src/tf/repositories.tf | 7 +++---- 3 files changed, 11 insertions(+), 13 deletions(-) diff --git a/src/tf/modules/repository/main.tf b/src/tf/modules/repository/main.tf index c77d48f..3e1922b 100644 --- a/src/tf/modules/repository/main.tf +++ b/src/tf/modules/repository/main.tf @@ -64,7 +64,7 @@ resource "github_repository_ruleset" "main" { pull_request { allowed_merge_methods = ["rebase", "squash"] dismiss_stale_reviews_on_push = true - required_approving_review_count = length(var.review_bypass_actors) == 0 ? var.required_approving_review_count : 0 + required_approving_review_count = length(var.review_bypass_integrations) == 0 ? var.required_approving_review_count : 0 required_review_thread_resolution = true } @@ -88,7 +88,7 @@ resource "github_repository_ruleset" "main" { } resource "github_repository_ruleset" "required_reviews" { - count = length(var.review_bypass_actors) == 0 ? 0 : 1 + count = length(var.review_bypass_integrations) == 0 ? 0 : 1 name = "Require pull request reviews" repository = github_repository.this.name @@ -113,11 +113,11 @@ resource "github_repository_ruleset" "required_reviews" { } dynamic "bypass_actors" { - for_each = var.review_bypass_actors + for_each = var.review_bypass_integrations content { - actor_id = bypass_actors.value.actor_id - actor_type = bypass_actors.value.actor_type + actor_id = bypass_actors.value.id + actor_type = "Integration" bypass_mode = bypass_actors.value.bypass_mode } } diff --git a/src/tf/modules/repository/variables.tf b/src/tf/modules/repository/variables.tf index 75fc214..74792cf 100644 --- a/src/tf/modules/repository/variables.tf +++ b/src/tf/modules/repository/variables.tf @@ -52,11 +52,10 @@ variable "required_approving_review_count" { } } -variable "review_bypass_actors" { - description = "Actors allowed to bypass required approving reviews" +variable "review_bypass_integrations" { + description = "GitHub Apps allowed to bypass required approving reviews" type = set(object({ - actor_id = number - actor_type = string + id = number bypass_mode = optional(string, "pull_request") })) default = [] diff --git a/src/tf/repositories.tf b/src/tf/repositories.tf index 44bb047..50c9804 100644 --- a/src/tf/repositories.tf +++ b/src/tf/repositories.tf @@ -23,9 +23,8 @@ locals { } infra-k8s-apps = { required_check = "checks / Kubernetes checks" - review_bypass_actors = [{ - actor_id = local.deployment_automation_app_id - actor_type = "Integration" + review_bypass_integrations = [{ + id = local.deployment_automation_app_id bypass_mode = "exempt" }] } @@ -46,7 +45,7 @@ module "infrastructure_repository" { context = each.value.required_check integration_id = local.github_actions_integration_id }] - review_bypass_actors = try(each.value.review_bypass_actors, []) + review_bypass_integrations = try(each.value.review_bypass_integrations, []) teams = concat( [ { From 0cda3f1b6601dc42956c5dd553c0a1ad69011df0 Mon Sep 17 00:00:00 2001 From: Levi Zitting Date: Thu, 20 Aug 2026 22:10:32 -0500 Subject: [PATCH 3/3] refactor: narrow review exemption input --- src/tf/modules/repository/main.tf | 10 +++++----- src/tf/modules/repository/variables.tf | 11 ++++------- src/tf/repositories.tf | 9 +++------ 3 files changed, 12 insertions(+), 18 deletions(-) diff --git a/src/tf/modules/repository/main.tf b/src/tf/modules/repository/main.tf index 3e1922b..4e1fb8f 100644 --- a/src/tf/modules/repository/main.tf +++ b/src/tf/modules/repository/main.tf @@ -64,7 +64,7 @@ resource "github_repository_ruleset" "main" { pull_request { allowed_merge_methods = ["rebase", "squash"] dismiss_stale_reviews_on_push = true - required_approving_review_count = length(var.review_bypass_integrations) == 0 ? var.required_approving_review_count : 0 + required_approving_review_count = length(var.review_exempt_integrations) == 0 ? var.required_approving_review_count : 0 required_review_thread_resolution = true } @@ -88,7 +88,7 @@ resource "github_repository_ruleset" "main" { } resource "github_repository_ruleset" "required_reviews" { - count = length(var.review_bypass_integrations) == 0 ? 0 : 1 + count = length(var.review_exempt_integrations) == 0 ? 0 : 1 name = "Require pull request reviews" repository = github_repository.this.name @@ -113,12 +113,12 @@ resource "github_repository_ruleset" "required_reviews" { } dynamic "bypass_actors" { - for_each = var.review_bypass_integrations + for_each = var.review_exempt_integrations content { - actor_id = bypass_actors.value.id + actor_id = bypass_actors.value actor_type = "Integration" - bypass_mode = bypass_actors.value.bypass_mode + bypass_mode = "exempt" } } diff --git a/src/tf/modules/repository/variables.tf b/src/tf/modules/repository/variables.tf index 74792cf..79a2703 100644 --- a/src/tf/modules/repository/variables.tf +++ b/src/tf/modules/repository/variables.tf @@ -52,13 +52,10 @@ variable "required_approving_review_count" { } } -variable "review_bypass_integrations" { - description = "GitHub Apps allowed to bypass required approving reviews" - type = set(object({ - id = number - bypass_mode = optional(string, "pull_request") - })) - default = [] +variable "review_exempt_integrations" { + description = "GitHub Apps exempt from required approving reviews" + type = set(number) + default = [] } variable "ruleset_enforcement" { diff --git a/src/tf/repositories.tf b/src/tf/repositories.tf index 50c9804..15699d5 100644 --- a/src/tf/repositories.tf +++ b/src/tf/repositories.tf @@ -22,11 +22,8 @@ locals { required_check = "Terraform checks" } infra-k8s-apps = { - required_check = "checks / Kubernetes checks" - review_bypass_integrations = [{ - id = local.deployment_automation_app_id - bypass_mode = "exempt" - }] + required_check = "checks / Kubernetes checks" + review_exempt_integrations = [local.deployment_automation_app_id] } infra-vm-workloads = { required_check = "CI checks" @@ -45,7 +42,7 @@ module "infrastructure_repository" { context = each.value.required_check integration_id = local.github_actions_integration_id }] - review_bypass_integrations = try(each.value.review_bypass_integrations, []) + review_exempt_integrations = try(each.value.review_exempt_integrations, []) teams = concat( [ {