add cargo to rulesets

Author: marcoieni

config.toml

@@ -84,6 +84,7 @@ members-without-zulip-id = [
 
 enable-rulesets-repos = [
    "rust-lang/bors",
+   "rust-lang/cargo",
    "rust-lang/crates.io",
    "rust-lang/rustfmt",
 ]

repos/rust-lang/cargo.toml

@@ -10,13 +10,21 @@ cargo = "write"
 [[branch-protections]]
 pattern = "master"
 ci-checks = ["conclusion"]
+merge-queue = true
 
 [[branch-protections]]
 pattern = "rust-1.*"
 ci-checks = ["conclusion"]
 
+[[branch-protections]]
+name = "Only allow the release process to publish tags"
+pattern = "0.*"
+target = "tag"
+pr-required = false
+allowed-merge-apps = ["promote-release"]
+prevent-update = true
+
 [environments.github-pages]
 
 [environments.release]
 tags = ["*"]
-

rust_team_data/src/v1.rs

@@ -252,22 +252,34 @@ pub enum MergeBot {
     RustTimer,
     Bors,
     WorkflowsCratesIo,
+    PromoteRelease,
 }
 
 impl MergeBot {
     pub fn app_id(&self) -> Option<i64> {
         match self {
             MergeBot::WorkflowsCratesIo => Some(2201425),
             MergeBot::Bors => Some(278306),
+            MergeBot::PromoteRelease => Some(217112),
             // These are user-based bots, not GitHub Apps
             MergeBot::RustTimer | MergeBot::Homu => None,
         }
     }
 }
 
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Hash, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum ProtectionTarget {
+    #[default]
+    Branch,
+    Tag,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub struct BranchProtection {
     pub pattern: String,
+    #[serde(default, skip_serializing_if = "is_branch_target")]
+    pub target: ProtectionTarget,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub name: Option<String>,
     pub dismiss_stale_review: bool,
@@ -276,11 +288,16 @@ pub struct BranchProtection {
     pub merge_bots: Vec<MergeBot>,
     pub allowed_merge_apps: Vec<MergeBot>,
     pub merge_queue: bool,
-    #[serde(default = "default_true")]
+    #[serde(default = "branch_protection_default_prevent_creation")]
     pub prevent_creation: bool,
-    #[serde(default = "default_true")]
+    #[serde(
+        default = "branch_protection_default_prevent_update",
+        skip_serializing_if = "is_false"
+    )]
+    pub prevent_update: bool,
+    #[serde(default = "branch_protection_default_prevent_deletion")]
     pub prevent_deletion: bool,
-    #[serde(default = "default_true")]
+    #[serde(default = "branch_protection_default_prevent_force_push")]
     pub prevent_force_push: bool,
 }
 
@@ -312,6 +329,26 @@ pub struct People {
     pub people: IndexMap<String, Person>,
 }
 
-fn default_true() -> bool {
+pub const fn branch_protection_default_prevent_creation() -> bool {
+    true
+}
+
+pub const fn branch_protection_default_prevent_update() -> bool {
+    false
+}
+
+pub const fn branch_protection_default_prevent_deletion() -> bool {
     true
 }
+
+pub const fn branch_protection_default_prevent_force_push() -> bool {
+    true
+}
+
+fn is_branch_target(target: &ProtectionTarget) -> bool {
+    matches!(target, ProtectionTarget::Branch)
+}
+
+fn is_false(value: &bool) -> bool {
+    !*value
+}

src/schema.rs

@@ -861,13 +861,24 @@ pub(crate) enum AllowedMergeApp {
     RustTimer,
     Bors,
     WorkflowsCratesIo,
+    PromoteRelease,
+}
+
+#[derive(serde::Deserialize, Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
+#[serde(rename_all = "kebab-case")]
+pub(crate) enum ProtectionTarget {
+    #[default]
+    Branch,
+    Tag,
 }
 
 #[derive(serde::Deserialize, Debug)]
 #[serde(deny_unknown_fields, rename_all = "kebab-case")]
 pub(crate) struct BranchProtection {
     pub pattern: String,
     #[serde(default)]
+    pub target: ProtectionTarget,
+    #[serde(default)]
     pub name: Option<String>,
     #[serde(default)]
     pub ci_checks: Vec<String>,
@@ -883,11 +894,13 @@ pub(crate) struct BranchProtection {
     pub allowed_merge_apps: Vec<AllowedMergeApp>,
     #[serde(default)]
     pub merge_queue: bool,
-    #[serde(default = "default_true")]
+    #[serde(default = "rust_team_data::v1::branch_protection_default_prevent_creation")]
     pub prevent_creation: bool,
-    #[serde(default = "default_true")]
+    #[serde(default = "rust_team_data::v1::branch_protection_default_prevent_update")]
+    pub prevent_update: bool,
+    #[serde(default = "rust_team_data::v1::branch_protection_default_prevent_deletion")]
     pub prevent_deletion: bool,
-    #[serde(default = "default_true")]
+    #[serde(default = "rust_team_data::v1::branch_protection_default_prevent_force_push")]
     pub prevent_force_push: bool,
 }
 

src/static_api.rs

@@ -54,6 +54,10 @@ impl<'a> Generator<'a> {
                 .iter()
                 .map(|b| v1::BranchProtection {
                     pattern: b.pattern.clone(),
+                    target: match b.target {
+                        schema::ProtectionTarget::Branch => v1::ProtectionTarget::Branch,
+                        schema::ProtectionTarget::Tag => v1::ProtectionTarget::Tag,
+                    },
                     name: b.name.clone(),
                     dismiss_stale_review: b.dismiss_stale_review,
                     mode: if b.pr_required {
@@ -72,10 +76,12 @@ impl<'a> Generator<'a> {
                             AllowedMergeApp::RustTimer => v1::MergeBot::RustTimer,
                             AllowedMergeApp::Bors => v1::MergeBot::Bors,
                             AllowedMergeApp::WorkflowsCratesIo => v1::MergeBot::WorkflowsCratesIo,
+                            AllowedMergeApp::PromoteRelease => v1::MergeBot::PromoteRelease,
                         })
                         .collect(),
                     merge_queue: b.merge_queue,
                     prevent_creation: b.prevent_creation,
+                    prevent_update: b.prevent_update,
                     prevent_deletion: b.prevent_deletion,
                     prevent_force_push: b.prevent_force_push,
                     // This field is empty for retrocompatibility with triagebot

src/sync/github/api/mod.rs

@@ -538,23 +538,32 @@ pub(crate) struct Ruleset {
     pub(crate) rules: BTreeSet<RulesetRule>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
+#[derive(
+    Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
 #[serde(rename_all = "lowercase")]
 pub(crate) enum RulesetTarget {
+    #[default]
     Branch,
     Tag,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
+#[derive(
+    Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
 #[serde(rename_all = "PascalCase")]
 pub(crate) enum RulesetSourceType {
+    #[default]
     Repository,
     Organization,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
+#[derive(
+    Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
 #[serde(rename_all = "lowercase")]
 pub(crate) enum RulesetEnforcement {
+    #[default]
     Active,
     Disabled,
     Evaluate,
@@ -628,21 +637,48 @@ pub(crate) struct MergeQueueParameters {
     pub(crate) min_entries_to_merge_wait_minutes: i32,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
+pub(crate) const DEFAULT_MERGE_QUEUE_TIMEOUT_MINUTES: i32 = 360;
+pub(crate) const DEFAULT_MERGE_QUEUE_MAX_ENTRIES_TO_BUILD: i32 = 5;
+pub(crate) const DEFAULT_MERGE_QUEUE_MAX_ENTRIES_TO_MERGE: i32 = 5;
+pub(crate) const DEFAULT_MERGE_QUEUE_MIN_ENTRIES_TO_MERGE: i32 = 0;
+pub(crate) const DEFAULT_MERGE_QUEUE_MIN_ENTRIES_TO_MERGE_WAIT_MINUTES: i32 = 0;
+
+#[derive(
+    Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
 #[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 pub(crate) enum MergeQueueGroupingStrategy {
+    #[default]
     Allgreen,
     Headgreen,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
+#[derive(
+    Clone, Debug, Default, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
+)]
 #[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 pub(crate) enum MergeQueueMergeMethod {
+    #[default]
     Merge,
     Squash,
     Rebase,
 }
 
+impl Default for MergeQueueParameters {
+    fn default() -> Self {
+        Self {
+            check_response_timeout_minutes: DEFAULT_MERGE_QUEUE_TIMEOUT_MINUTES,
+            grouping_strategy: MergeQueueGroupingStrategy::default(),
+            max_entries_to_build: DEFAULT_MERGE_QUEUE_MAX_ENTRIES_TO_BUILD,
+            max_entries_to_merge: DEFAULT_MERGE_QUEUE_MAX_ENTRIES_TO_MERGE,
+            merge_method: MergeQueueMergeMethod::default(),
+            min_entries_to_merge: DEFAULT_MERGE_QUEUE_MIN_ENTRIES_TO_MERGE,
+            min_entries_to_merge_wait_minutes:
+                DEFAULT_MERGE_QUEUE_MIN_ENTRIES_TO_MERGE_WAIT_MINUTES,
+        }
+    }
+}
+
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize)]
 pub(crate) struct RequiredDeploymentsParameters {
     pub(crate) required_deployment_environments: Vec<String>,
@@ -662,6 +698,7 @@ pub(crate) struct RequiredStatusChecksParameters {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub(crate) do_not_enforce_on_create: Option<bool>,
     pub(crate) required_status_checks: Vec<RequiredStatusCheck>,
+    /// Whether pull requests targeting a matching branch must be tested with the latest code.
     pub(crate) strict_required_status_checks_policy: bool,
 }