prepare for moving cargo from branch protections to rulesets by marcoieni · Pull Request #2333 · rust-lang/team

marcoieni · 2026-03-18T00:05:57Z

I ran a script to detect existing rulesets in our orgs. rust-lang/cargo is the only repository that has a ruleset not tracked in this repo.

This PR:

Adds this ruleset ("Only allow the release process to publish tags") to the team repository. You can verify that the dry run doesn't mention this repo, so we are just writing down without editing the ruleset in github
Migrate cargo from classic branch protections to rulesets
Improve the logging of rulesets, so that only relevant fields are showed in the dry run (default values are omitted)

In the following, I post the screenshots of the resources this PR touches:

as a backup in case something goes wrong
to better review the dry run
For triagebot retrocompatibility we should first merge the code changes, update triagebot and then edit cargo.toml. After this PR is approved, I will comment the changes to cargo.toml before merging this.

Existing branch protections

`Master`

github com_rust-lang_cargo_settings_branch_protection_rules_593520

`rust-1.*`

(download to see the full picture)

github com_rust-lang_cargo_settings_branch_protection_rules_593520 (2)

Existing ruleset

github com_rust-lang_cargo_settings_rules_1162109

github-actions · 2026-03-18T00:14:43Z

Dry-run check results


[WARN  rust_team::sync] sync-team is running in dry mode, no changes will be applied.
[INFO  rust_team::sync] synchronizing crates-io
[INFO  rust_team::sync] synchronizing github

marcoieni · 2026-03-18T11:18:46Z

repos/rust-lang/cargo.toml

 [[branch-protections]]
 pattern = "master"
 ci-checks = ["conclusion"]
+merge-queue = true


merge queues in branch protections were enabled from the UI because the API only support merge queues in rulesets.

marcoieni · 2026-03-18T11:19:27Z

repos/rust-lang/cargo.toml

+pr-required = false
+allowed-merge-apps = ["promote-release"]
+prevent-update = true
+


this is the ruleset that already existed. I just imported the settings here.

marcoieni · 2026-03-18T11:21:11Z

rust_team_data/src/v1.rs

    pub allowed_merge_apps: Vec<MergeBot>,
    pub merge_queue: bool,
-    #[serde(default = "default_true")]
+    #[serde(default = "branch_protection_default_prevent_creation")]


the fact that prevent_creation "was true by default" was encoded in too many places in the codebase. So I created functions to be reused across the codebase.
Similar with the other fields.

Wait, this is the v1 API, not GitHub API models, why do we need a default at all? Once triagebot has been updated, the field should always be present, right?

marcoieni · 2026-03-18T11:21:56Z

rust_team_data/src/v1.rs

+        default = "branch_protection_default_prevent_update",
+        skip_serializing_if = "is_false"
+    )]
+    pub prevent_update: bool,


I had to add this field because cargo needs it.

marcoieni · 2026-03-18T11:25:16Z

src/sync/github/api/mod.rs

I edited this file to encode the default of various fields, so that we know when to skip logging a rule

marcoieni · 2026-03-18T11:25:57Z

rust_team_data/src/v1.rs

 pub struct BranchProtection {
    pub pattern: String,
+    #[serde(default, skip_serializing_if = "is_branch_target")]
+    pub target: ProtectionTarget,


I had to add this field because the existing cargo ruleset targets a tag

marcoieni · 2026-03-18T11:40:11Z

src/validate.rs

-                    r#"repo '{}' uses multiple branch protections with the pattern `{}`"#,
+                    r#"repo '{}' uses multiple {:?} protections with the pattern `{}`"#,
                    repo.name,
+                    protection.target,


A repo can have the same pattern for branch and tag

Maybe we could create some BranchProtectionId to encode what is the unique identifier of the protection (target + pattern, maybe plus name?). But if it's only used here, it's fine.

Kobzol · 2026-03-18T14:29:53Z

src/schema.rs

    #[serde(default)]
    pub merge_queue: bool,
-    #[serde(default = "default_true")]
+    #[serde(default = "rust_team_data::v1::branch_protection_default_prevent_creation")]


The defaults should be chosen here, not in the v1 API.

the issue is that the rust_team_data crate doesn't import this crate. So it can't use the default.

oh, I saw your other comment.

Kobzol · 2026-03-18T14:30:34Z

src/validate.rs

-                    r#"repo '{}' uses multiple branch protections with the pattern `{}`"#,
+                    r#"repo '{}' uses multiple {:?} protections with the pattern `{}`"#,
                    repo.name,
+                    protection.target,


Maybe we could create some BranchProtectionId to encode what is the unique identifier of the protection (target + pattern, maybe plus name?). But if it's only used here, it's fine.

src/sync/github/api/mod.rs

Kobzol · 2026-03-18T17:43:37Z

rust_team_data/src/v1.rs

    RustTimer,
    Bors,
    WorkflowsCratesIo,
+    PromoteRelease,


We don't have deny unknown fields on the branch protection, so adding the new fields there should be fine for downstream. But this enum variant will brick triagebot, because it won't know it. So we will again have to first land just the infra change, then update triagebot, and then land the cargo repo config change itself.

yes, this is what I wrote in the PR body, right?

rustbot · 2026-03-19T08:53:13Z

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

marcoieni force-pushed the add-cargo-to-rulesets branch 2 times, most recently from 2758c92 to 3473afa Compare March 18, 2026 10:43

marcoieni commented Mar 18, 2026

View reviewed changes

marcoieni force-pushed the add-cargo-to-rulesets branch from f1ca0f1 to 7b72488 Compare March 18, 2026 11:39

marcoieni commented Mar 18, 2026

View reviewed changes

marcoieni force-pushed the add-cargo-to-rulesets branch 5 times, most recently from e82a97d to d8e7dba Compare March 18, 2026 12:37

marcoieni marked this pull request as ready for review March 18, 2026 12:56

marcoieni requested review from Mark-Simulacrum, emilyalbini, jdno and ubiratansoares as code owners March 18, 2026 12:56

Kobzol reviewed Mar 18, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

marcoieni force-pushed the add-cargo-to-rulesets branch 2 times, most recently from 4e2357c to 83c18a9 Compare March 18, 2026 16:41

marcoieni requested a review from Kobzol March 18, 2026 16:56

ubiratansoares reviewed Mar 18, 2026

View reviewed changes

src/sync/github/api/mod.rs Show resolved Hide resolved

Kobzol reviewed Mar 18, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

marcoieni force-pushed the add-cargo-to-rulesets branch from b009059 to a6ed73b Compare March 19, 2026 08:53

marcoieni changed the title ~~add cargo to rulesets~~ prepare for moving cargo from branch protections to rulesets Mar 19, 2026

prepare for moving cargo from branch protections to rulesets

4a5dc0b

marcoieni force-pushed the add-cargo-to-rulesets branch from a6ed73b to 4a5dc0b Compare March 19, 2026 08:58

Conversation

marcoieni commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Existing branch protections

Master

rust-1.*

Existing ruleset

Uh oh!

github-actions bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

rustbot commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

marcoieni commented Mar 18, 2026 •

edited

Loading

`Master`

`rust-1.*`

github-actions bot commented Mar 18, 2026 •

edited

Loading