Skip to content

lock-release.yml: Use legacy branch protection instead of rulesets #7705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
liuliu-dev merged 3 commits into from
Mar 26, 2026
+21 −35
Merged

lock-release.yml: Use legacy branch protection instead of rulesets #7705

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1d3b226
Fix lock-release workflow: use lock_branch and proper JSON format
siddharthkp Mar 26, 2026
e30bc86
Unlock: delete branch protection instead of updating
siddharthkp Mar 26, 2026
a8e5834
Add comment clarifying branch protection vs rulesets
siddharthkp Mar 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 21 additions & 35 deletions .github/workflows/lock-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,23 +29,26 @@ jobs:
owner: primer
repositories: react
private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
- name: Toggle rulesets
- name: Lock main branch
run: |
# Allow react-release-conductor to bypass merge queue
# Lock main but allow react-release-conductor team to push
gh api \
--method PUT \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
/repos/primer/react/rulesets/4089335 \
-F "bypass_actors[][actor_id]=12276524" \
-f "bypass_actors[][actor_type]=Team" \
-f "bypass_actors[][bypass_mode]=always"
gh api \
--method PUT \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
/repos/primer/react/rulesets/3801256 \
-f "enforcement=active"
/repos/primer/react/branches/main/protection \
--input - <<EOF
{
"lock_branch": true,
"restrictions": {
"teams": ["react-release-conductor"],
"users": []
},
"required_status_checks": null,
"enforce_admins": true,
"required_pull_request_reviews": null
}
Comment on lines +39 to +50
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PUT /branches/main/protection payload explicitly sets required_status_checks and required_pull_request_reviews to null, which disables those protections (and because this is a full update, it can overwrite the branch’s existing protection configuration). If main currently relies on required checks/reviews, running the lock will unintentionally turn them off. Consider fetching the current protection config first and re-sending it with only lock_branch/restrictions adjusted (or otherwise preserving the existing required checks/review settings).

This issue also appears on line 75 of the same file.

Copilot uses AI. Check for mistakes.
EOF
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

Expand All @@ -62,32 +65,15 @@ jobs:
owner: primer
repositories: react
private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
- name: Toggle rulesets
- name: Unlock main branch
run: |
# Delete the branch protection rule entirely.
# Note: This workflow is the only thing using legacy branch protection.
# All other branch rules use rulesets, which are unaffected by this delete.
gh api \
--method PUT \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
/repos/primer/react/rulesets/4089335 \
-F "bypass_actors[]"
gh api \
--method PUT \
--method DELETE \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
/repos/primer/react/rulesets/3801256 \
-f "enforcement=disabled"
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
- name: Update all PRs that are toggled merge when ready
run: |
PR_NUMBERS=$(gh pr list -L 100 -R primer/react --state open --json number,baseRefName,autoMergeRequest,reviewDecision -q '.[] | select(.autoMergeRequest != null) | select(.baseRefName == "main") | select(.reviewDecision == "APPROVED") | .number')
if [ -n "$PR_NUMBERS" ]; then
echo "Updating $PR_NUMBERS"
for pr in $PR_NUMBERS; do
gh pr update-branch -R primer/react "$pr" || echo "Warning: failed to update PR #$pr (likely has conflicts)"
done
else
echo "No PRs to update."
fi
/repos/primer/react/branches/main/protection
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
Loading