Revert "lock-release.yml: Use legacy branch protection instead of rulesets"#7719
Conversation
siddharthkp
commented
Mar 30, 2026
siddharthkp
commented
- Reverts lock-release.yml: Use legacy branch protection instead of rulesets #7705
- This was a flop because exceptions for release conductor does not work
…esets (#…" This reverts commit f441841.
|
siddharthkp
added
skip changeset
There was a problem hiding this comment.
Pull request overview
This PR reverts a previous change to the release lock automation workflow, switching it back to toggling GitHub rulesets (rather than legacy branch protection) and adding additional unlock-time maintenance for eligible auto-merge PRs.
Changes:
- Update the lock/unlock workflow to modify repository rulesets via
gh api(including bypass actors and enforcement toggling). - Add an unlock step that updates branches for open, approved PRs with auto-merge enabled targeting
main.
Comments suppressed due to low confidence (1)
.github/workflows/lock-release.yml:83
gh pr list -L 100will only update the first 100 matching PRs; if there are more approved auto-merge PRs targetingmain, the rest will be skipped. Consider increasing the limit or paging so the unlock step updates all eligible PRs reliably.
PR_NUMBERS=$(gh pr list -L 100 -R primer/react --state open --json number,baseRefName,autoMergeRequest,reviewDecision -q '.[] | select(.autoMergeRequest != null) | select(.baseRefName == "main") | select(.reviewDecision == "APPROVED") | .number')
| - name: Toggle rulesets | ||
| run: | | ||
| # Lock main but allow react-release-conductor team to push | ||
| # Allow react-release-conductor to bypass merge queue | ||
| gh api \ | ||
| --method PUT \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| -H "X-GitHub-Api-Version: 2022-11-28" \ | ||
| /repos/primer/react/branches/main/protection \ | ||
| --input - <<EOF | ||
| { | ||
| "lock_branch": true, | ||
| "restrictions": { | ||
| "teams": ["react-release-conductor"], | ||
| "users": [] | ||
| }, | ||
| "required_status_checks": null, | ||
| "enforce_admins": true, | ||
| "required_pull_request_reviews": null | ||
| } | ||
| EOF | ||
| /repos/primer/react/rulesets/4089335 \ | ||
| -F "bypass_actors[][actor_id]=12276524" \ | ||
| -f "bypass_actors[][actor_type]=Team" \ | ||
| -f "bypass_actors[][bypass_mode]=always" |
There was a problem hiding this comment.
The PR description says the previous ruleset-based approach was reverted because bypass exceptions for release conductor do not work, but this change reintroduces ruleset bypass configuration. Can you clarify the intended behavior (rulesets vs legacy branch protection) and update either the workflow or PR description so they match?
| -H "Accept: application/vnd.github+json" \ | ||
| -H "X-GitHub-Api-Version: 2022-11-28" \ | ||
| /repos/primer/react/rulesets/4089335 \ | ||
| -F "bypass_actors[]" |
There was a problem hiding this comment.
-F "bypass_actors[]" is unlikely to clear the ruleset bypass list (it may serialize as an empty element rather than an empty array, or be rejected by the API schema). Use an explicit empty array payload for bypass_actors so the unlock step reliably removes the bypass actors.
| -F "bypass_actors[]" | |
| -f "bypass_actors=[]" |
| gh api \ | ||
| --method PUT \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| -H "X-GitHub-Api-Version: 2022-11-28" \ | ||
| /repos/primer/react/branches/main/protection \ | ||
| --input - <<EOF | ||
| { | ||
| "lock_branch": true, | ||
| "restrictions": { | ||
| "teams": ["react-release-conductor"], | ||
| "users": [] | ||
| }, | ||
| "required_status_checks": null, | ||
| "enforce_admins": true, | ||
| "required_pull_request_reviews": null | ||
| } | ||
| EOF | ||
| /repos/primer/react/rulesets/4089335 \ | ||
| -F "bypass_actors[][actor_id]=12276524" \ | ||
| -f "bypass_actors[][actor_type]=Team" \ | ||
| -f "bypass_actors[][bypass_mode]=always" | ||
| gh api \ | ||
| --method PUT \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| -H "X-GitHub-Api-Version: 2022-11-28" \ | ||
| /repos/primer/react/rulesets/3801256 \ | ||
| -f "enforcement=active" |
There was a problem hiding this comment.
This workflow hard-codes ruleset IDs (4089335/3801256) and a team actor_id (12276524). If a ruleset is recreated or the team ID changes, the lock/unlock automation will silently break. Consider moving these to repository variables/secrets and/or looking up the ruleset/team by name at runtime before calling gh api.
This issue also appears on line 83 of the same file.
