feat(rulesets): let org and repo admins bypass requirements

[diazdesandi]

Summary

• Default ruleset allows OrganizationAdmin and RepositoryRole admin (actorId: 5) to bypass with bypassMode: always
• Classic branchProtection.enforceAdmins default flips to false (explicit true still supported)
• Schema + Pulumi wiring for optional bypassActors on every ruleset

Test plan

• bun test
• pulumi preview — rulesets gain bypassActors; no unexpected destroys
• Confirm a repo admin can merge with failing checks via “Bypass requirements” / admin merge

[coderabbitai]

Warning

Review limit reached

@diazdesandi, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 30 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: df136887-d0b3-460e-a7bb-e9ac2e7cb062

📥 Commits

Reviewing files that changed from the base of the PR and between 09d58df and 4f5c549.

📒 Files selected for processing (7)

• config/rulesets.yaml
• config/schema/rulesets.schema.json
• src/resources/rulesets.ts
• src/setup/resolve.ts
• src/types/config.ts
• test/resolve.test.ts
• test/resources.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/ruleset-admin-bypass

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🍹 preview on thaw-config/diazdesandi/dev

Pulumi report

View in Pulumi Cloud

   Previewing update (dev)

View Live: https://app.pulumi.com/diazdesandi/thaw-config/dev/previews/50b52ff3-78fc-4a30-a2e8-e291cf4dcc0e

Downloading plugin github-6.14.0: starting
Downloading plugin github-6.14.0: done
Installing plugin github-6.14.0: starting
Installing plugin github-6.14.0: done

@ Previewing update....
   pulumi:pulumi:Stack thaw-config-dev running 
@ Previewing update.......
~  github:index:RepositoryRuleset website-rs-repo-main-default update [diff: +bypassActors]
~  github:index:RepositoryRuleset homebrew-tap-rs-repo-main-default update [diff: +bypassActors]
@ Previewing update....
~  github:index:RepositoryRuleset dot-github-rs-repo-main-default update [diff: +bypassActors]
~  github:index:RepositoryRuleset org-ci-rs-repo-main-default update [diff: +bypassActors]
~  github:index:RepositoryRuleset menubarspawner-rs-repo-main-default update [diff: +bypassActors]
@ Previewing update....
~  github:index:RepositoryRuleset raycast-extension-rs-repo-main-default update [diff: +bypassActors]
@ Previewing update....
   pulumi:pulumi:Stack thaw-config-dev  
Resources:
   ~ 6 to update
   265 unchanged

   

[pulumi]

🍹 The Update (preview) for diazdesandi/thaw-config/dev (at 4f5c549) was successful.

Resource Changes

    Name                                    Type                                              Operation
~   org-ci-rs-repo-main-default             github:index/repositoryRuleset:RepositoryRuleset  update
~   menubarspawner-rs-repo-main-default     github:index/repositoryRuleset:RepositoryRuleset  update
~   dot-github-rs-repo-main-default         github:index/repositoryRuleset:RepositoryRuleset  update
~   homebrew-tap-rs-repo-main-default       github:index/repositoryRuleset:RepositoryRuleset  update
~   website-rs-repo-main-default            github:index/repositoryRuleset:RepositoryRuleset  update
~   raycast-extension-rs-repo-main-default  github:index/repositoryRuleset:RepositoryRuleset  update

Detailed Diff

View diff

pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::thaw-config::pulumi:pulumi:Stack::thaw-config-dev]
    ~ github:index/repositoryRuleset:RepositoryRuleset: (update)
        [urn=urn:pulumi:dev::thaw-config::custom:github:OrgRepository$custom:github:OrgRepositoryRulesets$github:index/repositoryRuleset:RepositoryRuleset::website-rs-repo-main-default]
        [provider=urn:pulumi:dev::thaw-config::pulumi:providers:github::default_6_14_0::225ee7f4-aef2-42ea-8c38-890178d35051]
      + bypassActors: [
      +     [0]: {
              + actorId   : 1
              + actorType : "OrganizationAdmin"
              + bypassMode: "always"
            }
      +     [1]: {
              + actorId   : 5
              + actorType : "RepositoryRole"
              + bypassMode: "always"
            }
        ]
    ~ github:index/repositoryRuleset:RepositoryRuleset: (update)
        [urn=urn:pulumi:dev::thaw-config::custom:github:OrgRepository$custom:github:OrgRepositoryRulesets$github:index/repositoryRuleset:RepositoryRuleset::homebrew-tap-rs-repo-main-default]
        [provider=urn:pulumi:dev::thaw-config::pulumi:providers:github::default_6_14_0::225ee7f4-aef2-42ea-8c38-890178d35051]
      + bypassActors: [
      +     [0]: {
              + actorId   : 1
              + actorType : "OrganizationAdmin"
              + bypassMode: "always"
            }
      +     [1]: {
              + actorId   : 5
              + actorType : "RepositoryRole"
              + bypassMode: "always"
            }
        ]
    ~ github:index/repositoryRuleset:RepositoryRuleset: (update)
        [urn=urn:pulumi:dev::thaw-config::custom:github:OrgRepository$custom:github:OrgRepositoryRulesets$github:index/repositoryRuleset:RepositoryRuleset::dot-github-rs-repo-main-default]
        [provider=urn:pulumi:dev::thaw-config::pulumi:providers:github::default_6_14_0::225ee7f4-aef2-42ea-8c38-890178d35051]
      + bypassActors: [
      +     [0]: {
              + actorId   : 1
              + actorType : "OrganizationAdmin"
              + bypassMode: "always"
            }
      +     [1]: {
              + actorId   : 5
              + actorType : "RepositoryRole"
              + bypassMode: "always"
            }
        ]
    ~ github:index/repositoryRuleset:RepositoryRuleset: (update)
        [urn=urn:pulumi:dev::thaw-config::custom:github:OrgRepository$custom:github:OrgRepositoryRulesets$github:index/repositoryRuleset:RepositoryRuleset::org-ci-rs-repo-main-default]
        [provider=urn:pulumi:dev::thaw-config::pulumi:providers:github::default_6_14_0::225ee7f4-aef2-42ea-8c38-890178d35051]
      + bypassActors: [
      +     [0]: {
              + actorId   : 1
              + actorType : "OrganizationAdmin"
              + bypassMode: "always"
            }
      +     [1]: {
              + actorId   : 5
              + actorType : "RepositoryRole"
              + bypassMode: "always"
            }
        ]
    ~ github:index/repositoryRuleset:RepositoryRuleset: (update)
        [urn=urn:pulumi:dev::thaw-config::custom:github:OrgRepository$custom:github:OrgRepositoryRulesets$github:index/repositoryRuleset:RepositoryRuleset::menubarspawner-rs-repo-main-default]
        [provider=urn:pulumi:dev::thaw-config::pulumi:providers:github::default_6_14_0::225ee7f4-aef2-42ea-8c38-890178d35051]
      + bypassActors: [
      +     [0]: {
              + actorId   : 1
              + actorType : "OrganizationAdmin"
              + bypassMode: "always"
            }
      +     [1]: {
              + actorId   : 5
              + actorType : "RepositoryRole"
              + bypassMode: "always"
            }
        ]
    ~ github:index/repositoryRuleset:RepositoryRuleset: (update)
        [urn=urn:pulumi:dev::thaw-config::custom:github:OrgRepository$custom:github:OrgRepositoryRulesets$github:index/repositoryRuleset:RepositoryRuleset::raycast-extension-rs-repo-main-default]
        [provider=urn:pulumi:dev::thaw-config::pulumi:providers:github::default_6_14_0::225ee7f4-aef2-42ea-8c38-890178d35051]
      + bypassActors: [
      +     [0]: {
              + actorId   : 1
              + actorType : "OrganizationAdmin"
              + bypassMode: "always"
            }
      +     [1]: {
              + actorId   : 5
              + actorType : "RepositoryRole"
              + bypassMode: "always"
            }
        ]