use rulesets in the rust repo by marcoieni · Pull Request #2327 · rust-lang/team

marcoieni · 2026-03-16T16:41:09Z

Is there a preferred moment when we want to merge this?

record the git SHA of each branch before the switch

github-actions · 2026-03-16T16:49:34Z

Dry-run check results


[WARN  rust_team::sync] sync-team is running in dry mode, no changes will be applied.
[INFO  rust_team::sync] synchronizing crates-io
[INFO  rust_team::sync] synchronizing github
[INFO  rust_team::sync] 💻 Repo Diffs:
    📝 Editing repo 'rust-lang/rust':
      Permission Changes:
        Giving team 'rust-timer' write permission
      Rulesets:
          Creating 'main'
            Include Branches: ["refs/heads/main"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'main - force-push'
            Include Branches: ["refs/heads/main"]
            Require pull requests: false
          Creating 'stable'
            Include Branches: ["refs/heads/stable"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }, RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'stable - force-push'
            Include Branches: ["refs/heads/stable"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Require pull requests: false
          Creating 'stable - misc'
            Include Branches: ["refs/heads/stable"]
            Forbid force pushes: false
            Require pull requests: false
          Creating 'beta'
            Include Branches: ["refs/heads/beta"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }, RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'beta - force-push'
            Include Branches: ["refs/heads/beta"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Require pull requests: false
          Creating 'beta - misc'
            Include Branches: ["refs/heads/beta"]
            Forbid force pushes: false
            Require pull requests: false
          Creating '*'
            Include Branches: ["refs/heads/*"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating '*/**/*'
            Include Branches: ["refs/heads/*/**/*"]
            Require pull requests: false
            Restrict updates: true
          Creating 'cargo_update'
            Include Branches: ["refs/heads/cargo_update"]
            Forbid force pushes: false
            Require pull requests: false
            Restrict deletions: false
          Creating 'automation/bors/try'
            Include Branches: ["refs/heads/automation/bors/try"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'automation/bors/try-merge'
            Include Branches: ["refs/heads/automation/bors/try-merge"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'automation/bors/auto'
            Include Branches: ["refs/heads/automation/bors/auto"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'automation/bors/auto-merge'
            Include Branches: ["refs/heads/automation/bors/auto-merge"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'try-perf'
            Include Branches: ["refs/heads/try-perf"]
            Bypass Actors: [RulesetBypassActor { actor_id: 16787004, actor_type: Team, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating 'perf-tmp'
            Include Branches: ["refs/heads/perf-tmp"]
            Bypass Actors: [RulesetBypassActor { actor_id: 16787004, actor_type: Team, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true

marcoieni · 2026-03-19T21:21:59Z

Backup (taken automatically with https://github.com/marcoieni/multicheese in case you are curious!)

001-github-com-rust-lang-rust-settings-branch-protection-rules-2097960

002-github-com-rust-lang-rust-settings-branch-protection-rules-2626273

003-github-com-rust-lang-rust-settings-branch-protection-rules-29679214

004-github-com-rust-lang-rust-settings-branch-protection-rules-31895354

005-github-com-rust-lang-rust-settings-branch-protection-rules-38663771

006-github-com-rust-lang-rust-settings-branch-protection-rules-42228944

007-github-com-rust-lang-rust-settings-branch-protection-rules-42230325

008-github-com-rust-lang-rust-settings-branch-protection-rules-63047047

009-github-com-rust-lang-rust-settings-branch-protection-rules-63047048

010-github-com-rust-lang-rust-settings-branch-protection-rules-69583533

011-github-com-rust-lang-rust-settings-branch-protection-rules-71071517

marcoieni · 2026-03-19T22:32:39Z

src/validate.rs

-                    protection.pattern,
-                );
-            }
-


From https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets#about-rulesets-and-protected-branches:

Unlike protection rules, multiple rulesets can apply at the same time, so you can be confident that every rule targeting a branch in your repository will be evaluated when someone interacts with that branch

I removed this because we need multiple rules to interact with the same branch (different bypass list for normal push and force push).

In that case we should make the name required when there are multiple identical patterns, because we used the pattern as an identifier.

marcoieni · 2026-03-23T22:38:50Z

Here's how I tested the "stable" and "stable - force-pushes" rules.

I created a repository in my test organization: https://github.com/marco-test-org/ruleset-test
I created two rules

github com_marco-test-org_ruleset-test_settings_rules_14250638

github com_marco-test-org_ruleset-test_settings_rules_14250638 (1)

The user in the test-team was able to push to the repository but not to force-push. See marco-test-org/ruleset-test#1

marcoieni · 2026-03-23T23:01:38Z

There's one issue:
In the try-perf branch, the user rust-timer is allowed to push.
In rulesets, only teams and github apps can be allowed to push.
Should we create a team for rust-timer?
Another approach would be converting rust-timer to a github app but I'm not sure how difficult it is.

Kobzol · 2026-03-24T06:23:58Z

We are relatively close to making the unrolled PRs by bors, instead of rustc-perf. If this can wait a few weeks, rust-timer will no longer need that access.

marcoieni · 2026-03-24T06:40:12Z

We are relatively close to making the unrolled PRs by bors, instead of rustc-perf. If this can wait a few weeks, rust-timer will no longer need that access.

#2343 is a small change that can be reverted easily. Since this is the only blocker to have rulesets in the rust I'm in favor of creating the team. What do you think? 🤔

Kobzol · 2026-03-24T10:03:29Z

Sure, go ahead, it's a small change 👍

marcoieni · 2026-03-24T17:43:51Z

src/sync/github/mod.rs

+        let bypass_actors = self.bypass_actors(expected_repo, branch_protection).await?;
+
+        Ok(construct_ruleset(branch_protection, bypass_actors))
+    }


this function is only two lines but I left it like this to minimize the git diff of the PR.
We could inline the construct_ruleset free function later

marcoieni · 2026-03-24T17:44:55Z

src/sync/github/mod.rs

-                bypass_mode: RulesetBypassMode::Always,
-            })
-        })
-        .collect();


this piece of code was moved up

ubiratansoares

I've checked all screenshots and compared side-by-side with the new config. Looks Ok to me. Perhaps @Kobzol wants to confirm whether we are good to go from his side as well.

I think it'd be nice spreading the word about this PR on T-infra/annoucements.

Kobzol · 2026-03-30T13:25:49Z

repos/rust-lang/rust.toml

+name = "main"
 pattern = "main"
 allowed-merge-apps = ["bors"]
+prevent-update = true


I realized that to mirror the previous behavior of branch protections, having a non-empty list of allowed-merge-apps should probably imply prevent-update = true. But that's non-blocking, we can do that later.

Kobzol · 2026-03-30T13:28:29Z

repos/rust-lang/rust.toml

+pattern = "stable"
+allowed-merge-apps = ["promote-release"]
+# `stable` already requires users to open PRs.
+# This allows bors to push without opening a PR.


Suggested change

# This allows bors to push without opening a PR.

# This allows promote-release to push without opening a PR.

no, I meant bors!
The stable - force-push branch protection is there to restrict the behavior of bors.
promote-release doesn't have any restrictions because it is in all the allowed lists, so it could even delete the branch.

repos/rust-lang/rust.toml

marcoieni · 2026-04-07T17:16:23Z

src/sync/github/mod.rs

+) -> api::Ruleset {
    use api::*;

-    let branch_protection_mode = get_branch_protection_mode(branch_protection);


As noted by Kobzol:

we shouldn't turn off requiring PRs when bors is enabled, because that will turn off required PRs for everyone

Kobzol · 2026-04-07T17:25:37Z

repos/rust-lang/rust.toml

 pattern = "try-perf"
-allowed-merge-apps = ["rust-timer"]
+allowed-merge-teams = ["rust-timer"]
 pr-required = false


Suggested change

pr-required = false

Shouldn't be needed, as rust-timer bypasses this ruleset anyway (same below).

Kobzol · 2026-04-07T17:27:24Z

repos/rust-lang/rust.toml

+prevent-force-push = false

 [[branch-protections]]
 pattern = "*"


We have to check whether this still protects tags (like 1.94.1).

it doesn't. Let's do a followup PR

marcoieni · 2026-04-09T09:57:40Z

repos/rust-lang/rust.toml

 [[branch-protections]]
 pattern = "*"
+allowed-merge-apps = ["promote-release"]
+prevent-update = true


the classic branch protection allows deletion, while this doesn't.
Jakub here says he prefers to prevent deletion for this and "*/**/*"

Hmm, I didn't realize deletion was allowed before. I don't think it's super important, but I guess we can try to be more strict and see if preventing deletion breaks anything.

rustbot · 2026-04-09T13:15:53Z

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 11472fe to ccd8f31 Compare March 19, 2026 12:09

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from a4540e6 to 83f09a2 Compare March 19, 2026 22:31

marcoieni commented Mar 19, 2026

View reviewed changes

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 4 times, most recently from 6f35480 to c3d0cbd Compare March 20, 2026 09:32

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 6e4c63c to c67ec1b Compare March 23, 2026 22:54

marcoieni mentioned this pull request Mar 24, 2026

create the rust-timer team #2343

Merged

1 task

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 4 times, most recently from 0dee3f1 to f614447 Compare March 24, 2026 06:23

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from f614447 to dbe30bf Compare March 24, 2026 06:25

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 3 times, most recently from 1b14c6d to c62adff Compare March 24, 2026 17:25

marcoieni commented Mar 24, 2026

View reviewed changes

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from c62adff to 8c81777 Compare March 24, 2026 17:48