fix: re-enable pull_request rule, remove push_allowances

[omer-vishlitzky]

Summary

• Re-add pull_request ruleset rule (blocks direct pushes, requires PRs)
• Remove push_allowances from osac and osac-test-infra (classic branch protection restrict_pushes conflicts with merge queue bot)
• Safe now because fix: dismiss changes-requested reviews and remove lgtm on push osac#279 auto-dismisses CHANGES_REQUESTED reviews

Dependencies

• fix: dismiss changes-requested reviews and remove lgtm on push osac#279 (merged) — auto-dismiss CHANGES_REQUESTED reviews

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added merge queue compatibility for repository status checks.
  • Pull requests processed through the merge queue now follow an explicit zero-approval review rule.

• Changes

  • Updated repository access settings by removing legacy push-allowance restrictions from selected repositories.
  • All other repository configuration remains unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7540974b-65b9-44a0-9290-a0c2c7e0aac3

📥 Commits

Reviewing files that changed from the base of the PR and between bf9e7a5 and e0b5d05.

📒 Files selected for processing (2)

• modules/common_repository/main.tf
• repositories.tf

💤 Files with no reviewable changes (1)

• repositories.tf

---

Walkthrough

The ruleset conditionally adds a zero-approval pull-request rule when merge queues are enabled. The repo_osac and repo_osac_test_infra modules no longer define push allowances.

Changes

Merge queue protection

Layer / File(s)	Summary
Conditional pull-request rule modules/common_repository/main.tf	When var.merge_queue is configured, the status-check ruleset adds a pull_request rule that requires zero approving reviews.
Repository push allowance cleanup repositories.tf	The repo_osac and repo_osac_test_infra modules no longer configure push allowances.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/github-config#186: Directly modifies the same ruleset and repository push-allowance settings.
• osac-project/github-config#187: Modifies the same merge-queue pull-request rule and OSAC push allowances.
• osac-project/github-config#180: Introduces related merge-queue ruleset logic in the same module.

Suggested reviewers: eliorerz, eranco74

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes both main changes in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR adds only ruleset logic and removes repository push allowances; scans found no API keys, tokens, passwords, private keys, credential URLs, or long encoded literals.
No-Weak-Crypto	✅ Passed	The PR adds only GitHub ruleset logic and removes push allowances; the committed diff contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparisons.
No-Injection-Vectors	✅ Passed	The verified diff adds only a Terraform pull_request ruleset block gated by var.merge_queue and removes push_allowances literals; it introduces no listed injection vector.
Container-Privileges	✅ Passed	The diff changes only GitHub repository rules and module inputs. It adds no container/Kubernetes manifests or privileged settings such as privileged, hostPID, SYS_ADMIN, or allowPrivilegeEscalation.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds only Terraform ruleset configuration and removes inputs; it introduces no logging, output, or sensitive-data emission.
Ai-Attribution	✅ Passed	AI use is stated in the PR and HEAD; the PR commit includes an Assisted-by: Claude Code trailer, with no Generated-by or Co-Authored-By trailer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}