process: 4 ExApp sidecar PRs blocked on self-review (valtimo/openzaak/opentalk/openklant #5/#6)

[rubenvdlinde]

Context

Tried admin-merging four tiny CI fix PRs autonomously and all 4 rejected with:

At least 1 approving review is required by reviewers with write access.

The repos have a ruleset that admin-merge cannot bypass without a real second reviewer. PR author can't self-approve.

PRs awaiting a second reviewer

All identical: fix(ci): skip lint-check when repo has no package.json

• fix(ci): skip lint-check when repo has no package.json valtimo#5
• fix(ci): skip lint-check when repo has no package.json openzaak#5
• fix(ci): skip lint-check when repo has no package.json opentalk#6
• fix(ci): skip lint-check when repo has no package.json openklant#5

These are 3-line CI tweaks (the ExApp sidecar repos don't ship package.json so the lint check should skip — currently they fail CI on every PR).

Options

1. Get a Conduction teammate to approve all 4 (1-minute job).
2. Add the user as a bypass actor on the 4 rulesets so admin-merge works going forward.
3. Move to a CODEOWNERS-based auto-approve from a bot account.

Option 1 is the immediate unblock. Options 2/3 close the recurring problem for these 4 repos where 1-author teams hit the wall.

Origin

Autonomous backlog sweep 2026-05-21 02:00 — flagged by the earlier 18-PR triage.

[rubenvdlinde]

Resolved 2026-05-23.

Root cause was not the org-level rulesets — those already include OrganizationAdmin as a bypass actor with bypass_mode: always.

The four sidecars carried 3 repo-level rulesets each (Beta / Development / Main, created 2026-02-06, before the org-level rulesets on 2026-03-19) that duplicated the org rules but with empty bypass_actors. Those repo-level rulesets were the ones blocking --admin merge.

Fix applied: deleted all 12 repo-level rulesets via gh api -X DELETE repos/ConductionNL/{repo}/rulesets/{id}. After deletion, only the org-level rulesets remain — admin bypass works on all 4 sidecars, matching the rest of the fleet.

Side-effect on main: review count went 1 → 2 (org-level standard). Admin bypass still works.

Carry-over PRs cleared in the same pass:

• valtimo docs: Update CONTRIBUTING.md to reflect org-wide branch protection rulesets #5 / Management review: Quality Policy & Security Policy (ISO 9001 §5.2 / ISO 27001 §5.2) #6 / [OpenSpec] GIBIT ICT Quality Norms Compliance #7
• openzaak docs: Update CONTRIBUTING.md to reflect org-wide branch protection rulesets #5 / Management review: Quality Policy & Security Policy (ISO 9001 §5.2 / ISO 27001 §5.2) #6 / [OpenSpec] GIBIT ICT Quality Norms Compliance #7
• opentalk Management review: Quality Policy & Security Policy (ISO 9001 §5.2 / ISO 27001 §5.2) #6 / [OpenSpec] GIBIT ICT Quality Norms Compliance #7 / [OpenSpec] DPIA (Privacy Impact Assessment) Tooling #8
• openklant docs: Update CONTRIBUTING.md to reflect org-wide branch protection rulesets #5 / Management review: Quality Policy & Security Policy (ISO 9001 §5.2 / ISO 27001 §5.2) #6 / [OpenSpec] GIBIT ICT Quality Norms Compliance #7

All merged. The 4 fix/licence-agpl PRs (#2 across the sidecars) closed as stale — empty diffs except opentalk's, which would have prematurely flipped licence to EUPL-1.2 against the fleet policy (see #98).