fix: remove pull_request ruleset rule, restore push_allowances

[omer-vishlitzky]

Summary

• Remove pull_request rule from ruleset — it blocks PRs when CodeRabbit has outstanding CHANGES_REQUESTED, even with required_approving_review_count=0
• Restore push_allowances for osac and osac-test-infra — classic branch protection restrict_pushes blocks direct pushes without interfering with the merge queue bot (confirmed working)

Context

The pull_request ruleset rule enforces native GitHub review requirements. Since OSAC uses Prow labels (lgtm/approved) via the check-labels gate instead of native reviews, this rule is incompatible — CodeRabbit's reviews block merging.

Direct push protection via classic branch protection restrict_pushes works with the merge queue because GitHub auto-allows the merge queue bot when restrict_pushes is active.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Access and Permissions
  • Updated repository push permissions to allow designated infrastructure and administrator teams.
  • Adjusted merge-queue repository rules to remove the native pull request requirement.

[coderabbitai]

Warning

Review limit reached

@omer-vishlitzky, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b6a334a3-9318-4912-baf5-8a5b610cb33e

📥 Commits

Reviewing files that changed from the base of the PR and between b9df32d and 73dcb32.

📒 Files selected for processing (1)

• repositories.tf

Walkthrough

The changes remove merge-queue-specific pull request enforcement and add explicit push allowances for repo_osac and repo_osac_test_infra. The e2e-test environment configuration remains unchanged.

Changes

Repository access control

Layer / File(s)	Summary
Merge-queue ruleset adjustment modules/common_repository/main.tf	Removes the conditional pull_request ruleset block that required pull requests for merge-queue repositories.
Repository push allowances repositories.tf	Allows wg-infra and org-admins to push to repo_osac and repo_osac_test_infra. Retains the e2e-test environment configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/github-config#186: Modifies the same merge-queue pull request handling and related push allowances.
• osac-project/github-config#185: Updates related repository rulesets and repo_osac push permissions.
• osac-project/github-config#180: Modifies the same merge-queue ruleset and repo_osac push-permission configuration.

Suggested reviewers: eranco74, larsks

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes both main changes: removing the pull_request ruleset rule and restoring push_allowances.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR adds only GitHub team actor identifiers and an environment name; no API keys, tokens, passwords, private keys, embedded credentials, or secret-shaped blobs are introduced.
No-Weak-Crypto	✅ Passed	The PR diff adds only push_allowances and an environment alignment; it adds no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison code.
No-Injection-Vectors	✅ Passed	The diff only adds static Terraform push_allowances and removes a ruleset block; no SQL concatenation, shell/eval/exec, pickle/yaml load, os.system, or dangerouslySetInnerHTML vector is introduced.
Container-Privileges	✅ Passed	The PR changes only Terraform repository rules and push allowances. The added-line diff contains no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only changes Terraform rules and team push allowances; it adds no logging, output, or sensitive data such as tokens, credentials, PII, hostnames, or customer data.
Ai-Attribution	✅ Passed	PR and commit mention Claude Code; the sole PR commit includes an Assisted-by: Claude Code trailer and no Co-Authored-By trailer.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}