From 3ca26528cbe473f3ebfb28cfac8862ce0f577265 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Wed, 5 Aug 2026 19:41:58 -0400 Subject: [PATCH 1/2] Mirror required status checks into classic branch protection for tide Prow's tide derives its merge-gating required contexts exclusively from the classic branch-protection API (pkg/config/tide.go's FromBranchProtection reads bp.RequiredStatusChecks, which maps to that API specifically) -- it has no knowledge of repository rulesets at all. osac-project's Prow config relies on the org-wide tide.context_options.from-branch-protection default (no per-repo override in openshift/release), but classic branch protection here has never set required_status_checks -- only the ruleset did. Confirmed via GitHub's API directly: $ gh api repos/osac-project/osac/branches/main/protection \ --jq '.required_status_checks' null So tide's computed required-context set for every repo managed here has always been empty, and it merges purely on labels (approved+jira/valid-reference+lgtm), completely blind to e2e status. Confirmed on a real merge: PR #85 was merged by openshift-merge-bot at 21:11:20Z while its three required e2e checks (which all eventually passed) didn't finish until 22:03:04Z, 22:26:11Z, and 22:33:41Z -- 52 to 82 minutes later. Mirror the same contexts already enforced by the ruleset into classic branch protection's own required_status_checks block, generated from the same var.required_status_checks input so there's still only one list to maintain per repo, not two independently-drifting ones. Signed-off-by: Elior Erez --- modules/common_repository/main.tf | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index 2047aea..c95ba2f 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -101,6 +101,28 @@ resource "github_branch_protection" "repo_protection" { } } + # Prow's tide only derives its own merge-gating required contexts from + # this (classic) branch-protection API -- it has no knowledge of + # repository rulesets at all (confirmed against tide's actual source, + # pkg/config/tide.go: FromBranchProtection reads bp.RequiredStatusChecks, + # which maps to this exact API, not rulesets). Since every repo here + # already relies on org-wide tide.context_options.from-branch-protection + # (the global default in openshift/release, no per-repo override), tide + # was merging PRs on labels alone the moment none of these contexts were + # ever mirrored here -- confirmed on a real PR (#85) that merged with all + # 3 required e2e checks still 50+ minutes from completing. Mirror the + # same contexts already enforced by the ruleset below so tide actually + # waits, without introducing a second, independently-maintained list -- + # both come from the same var.required_status_checks. + dynamic "required_status_checks" { + for_each = length(var.required_status_checks) > 0 ? [1] : [] + + content { + strict = true + contexts = [for check in var.required_status_checks : check.context] + } + } + depends_on = [github_repository.repo, github_repository_collaborators.repo_collaborators] } From da0a130e28936beb7029ea7c02d9068f254085f8 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Wed, 5 Aug 2026 19:49:39 -0400 Subject: [PATCH 2/2] Shorten comment, drop PR reference Signed-off-by: Elior Erez --- modules/common_repository/main.tf | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index c95ba2f..1221fcc 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -101,19 +101,12 @@ resource "github_branch_protection" "repo_protection" { } } - # Prow's tide only derives its own merge-gating required contexts from - # this (classic) branch-protection API -- it has no knowledge of - # repository rulesets at all (confirmed against tide's actual source, - # pkg/config/tide.go: FromBranchProtection reads bp.RequiredStatusChecks, - # which maps to this exact API, not rulesets). Since every repo here - # already relies on org-wide tide.context_options.from-branch-protection - # (the global default in openshift/release, no per-repo override), tide - # was merging PRs on labels alone the moment none of these contexts were - # ever mirrored here -- confirmed on a real PR (#85) that merged with all - # 3 required e2e checks still 50+ minutes from completing. Mirror the - # same contexts already enforced by the ruleset below so tide actually - # waits, without introducing a second, independently-maintained list -- - # both come from the same var.required_status_checks. + # Prow's tide derives its merge-gating required contexts only from this + # (classic) branch-protection API, not from rulesets (pkg/config/tide.go: + # FromBranchProtection reads bp.RequiredStatusChecks). This field was + # never set here, so tide merged on labels alone, blind to e2e status. + # Mirror the same contexts already enforced by the ruleset below, from + # the same var.required_status_checks, so there's one list to maintain. dynamic "required_status_checks" { for_each = length(var.required_status_checks) > 0 ? [1] : []