use rulesets in the rust repo by marcoieni · Pull Request #2327 · rust-lang/team

marcoieni · 2026-03-16T16:41:09Z

Is there a preferred moment when we want to merge this?

github-actions · 2026-03-16T16:49:34Z

Dry-run check results


[WARN  rust_team::sync] sync-team is running in dry mode, no changes will be applied.
[INFO  rust_team::sync] synchronizing crates-io
[INFO  rust_team::sync] synchronizing github
[INFO  rust_team::sync] 💻 Repo Diffs:
    📝 Editing repo 'rust-lang/rust':
      Permission Changes:
        Giving team 'rust-timer' write permission
      Rulesets:
          Creating 'main'
            Include Branches: ["refs/heads/main"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Restrict updates: true
          Creating 'main - force-push'
            Include Branches: ["refs/heads/main"]
          Creating 'stable'
            Include Branches: ["refs/heads/stable"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }, RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Restrict updates: true
          Creating 'stable - force-push'
            Include Branches: ["refs/heads/stable"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
          Creating 'beta'
            Include Branches: ["refs/heads/beta"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }, RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Restrict updates: true
          Creating 'beta - force-push'
            Include Branches: ["refs/heads/beta"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
          Creating '*'
            Include Branches: ["refs/heads/*"]
            Bypass Actors: [RulesetBypassActor { actor_id: 217112, actor_type: Integration, bypass_mode: Always }]
            Required approvals: 1
            Restrict updates: true
          Creating '*/**/*'
            Include Branches: ["refs/heads/*/**/*"]
            Restrict updates: true
          Creating 'cargo_update'
            Include Branches: ["refs/heads/cargo_update"]
          Creating 'automation/bors/try'
            Include Branches: ["refs/heads/automation/bors/try"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Restrict updates: true
          Creating 'automation/bors/try-merge'
            Include Branches: ["refs/heads/automation/bors/try-merge"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Restrict updates: true
          Creating 'automation/bors/auto'
            Include Branches: ["refs/heads/automation/bors/auto"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Restrict updates: true
          Creating 'automation/bors/auto-merge'
            Include Branches: ["refs/heads/automation/bors/auto-merge"]
            Bypass Actors: [RulesetBypassActor { actor_id: 278306, actor_type: Integration, bypass_mode: Always }]
            Restrict updates: true
          Creating 'try-perf'
            Include Branches: ["refs/heads/try-perf"]
            Bypass Actors: [RulesetBypassActor { actor_id: 16787004, actor_type: Team, bypass_mode: Always }]
            Restrict updates: true
          Creating 'perf-tmp'
            Include Branches: ["refs/heads/perf-tmp"]
            Bypass Actors: [RulesetBypassActor { actor_id: 16787004, actor_type: Team, bypass_mode: Always }]
            Restrict updates: true

marcoieni · 2026-03-19T21:21:59Z

Backup (taken automatically with https://github.com/marcoieni/multicheese in case you are curious!)

001-github-com-rust-lang-rust-settings-branch-protection-rules-2097960

002-github-com-rust-lang-rust-settings-branch-protection-rules-2626273

003-github-com-rust-lang-rust-settings-branch-protection-rules-29679214

004-github-com-rust-lang-rust-settings-branch-protection-rules-31895354

005-github-com-rust-lang-rust-settings-branch-protection-rules-38663771

006-github-com-rust-lang-rust-settings-branch-protection-rules-42228944

007-github-com-rust-lang-rust-settings-branch-protection-rules-42230325

008-github-com-rust-lang-rust-settings-branch-protection-rules-63047047

009-github-com-rust-lang-rust-settings-branch-protection-rules-63047048

010-github-com-rust-lang-rust-settings-branch-protection-rules-69583533

011-github-com-rust-lang-rust-settings-branch-protection-rules-71071517

marcoieni · 2026-03-19T22:32:39Z

src/validate.rs

-                    protection.pattern,
-                );
-            }
-


From https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets#about-rulesets-and-protected-branches:

Unlike protection rules, multiple rulesets can apply at the same time, so you can be confident that every rule targeting a branch in your repository will be evaluated when someone interacts with that branch

I removed this because we need multiple rules to interact with the same branch (different bypass list for normal push and force push).

In that case we should make the name required when there are multiple identical patterns, because we used the pattern as an identifier.

marcoieni · 2026-03-23T22:38:50Z

Here's how I tested the "stable" and "stable - force-pushes" rules.

I created a repository in my test organization: https://github.com/marco-test-org/ruleset-test
I created two rules

github com_marco-test-org_ruleset-test_settings_rules_14250638

github com_marco-test-org_ruleset-test_settings_rules_14250638 (1)

The user in the test-team was able to push to the repository but not to force-push. See marco-test-org/ruleset-test#1

marcoieni · 2026-03-23T23:01:38Z

There's one issue:
In the try-perf branch, the user rust-timer is allowed to push.
In rulesets, only teams and github apps can be allowed to push.
Should we create a team for rust-timer?
Another approach would be converting rust-timer to a github app but I'm not sure how difficult it is.

Kobzol · 2026-03-24T06:23:58Z

We are relatively close to making the unrolled PRs by bors, instead of rustc-perf. If this can wait a few weeks, rust-timer will no longer need that access.

marcoieni · 2026-03-24T06:40:12Z

We are relatively close to making the unrolled PRs by bors, instead of rustc-perf. If this can wait a few weeks, rust-timer will no longer need that access.

#2343 is a small change that can be reverted easily. Since this is the only blocker to have rulesets in the rust I'm in favor of creating the team. What do you think? 🤔

Kobzol · 2026-03-24T10:03:29Z

Sure, go ahead, it's a small change 👍

marcoieni · 2026-03-24T17:43:51Z

src/sync/github/mod.rs

+        let bypass_actors = self.bypass_actors(expected_repo, branch_protection).await?;
+
+        Ok(construct_ruleset(branch_protection, bypass_actors))
+    }


this function is only two lines but I left it like this to minimize the git diff of the PR.
We could inline the construct_ruleset free function later

marcoieni · 2026-03-24T17:44:55Z

src/sync/github/mod.rs

-                bypass_mode: RulesetBypassMode::Always,
-            })
-        })
-        .collect();


this piece of code was moved up

Kobzol · 2026-03-25T08:58:02Z

repos/rust-lang/rust.toml

+rust-timer = "write"

+# Only `bors` can push to `main`
 [[branch-protections]]


I don't understand why we need two separate branch protections to prevent force pushes. Force pushes should be disabled for everyone, even for bors.

Force pushes should be disabled for everyone, even for bors.

That's what the main - force-push rule does. It prevents everyone (including bors) to force push.
Bors is in the main rule, so that rule doesn't apply to bors. To restrict bors, we need another rule where bors isn't in the bypass list.

Ah, I see, I forgot about the other branch protection. That's quite stupid that rulesets work like this, tbh 😆 It would be better if we could bypass only specific properties.. but I understand that would make the options more complicated.

It's quite non-obvious though, and it seems hard to ensure that the other branch protection don't enable something that we don't want, hmm.

It's quite non-obvious though, and it seems hard to ensure that the other branch protection don't enable something that we don't want, hmm.

Yeah, it requires a different mindset than before a bit.

Wait, but if the force push ruleset requires a PR by default, doesn't that mean that it will require a PR also for bors?

yes, you are right, in my test I didn't have "requires a PR" in the settings.
Probably we should add a third rule related to main 😅

Not a third rule, just disable requiring PRs here.

With "here" you mean in the "main - force push"?
I think you are right!
Because "main" already prevent everyone from opening PRs.
I'll do it.

I did the same for stable and beta as well.

Kobzol · 2026-03-25T08:58:25Z

repos/rust-lang/rust.toml

 pattern = "perf-tmp"
-allowed-merge-apps = ["rust-timer"]
+allowed-merge-teams = ["rust-timer"]
+prevent-update = true


What does prevent-update actually do? Any why isn't it the default?

From https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#restrict-updates:

If selected, only users with bypass permissions can push to branches or tags whose name matches the pattern you specify.

At the moment it's not enabled by default. I will raise a PR to make it the default.

Hmm, it seems that the mental model of branch protections and rulesets quite diverges here. I guess that prevent-update = true should be automatically set by pr-required = true?

Yeah the fact that you both have "restrict updates" and "require a pull request before merging" as possible rules is weird. I think it makes sense for tags, but still..
I will raise a PR

I think we can resolve this after #2346 and #2348

marcoieni · 2026-03-29T10:02:42Z

We added "allow force push" to the cargo_update branch. See #t-infra > cargo_update branch protection broken

ubiratansoares

I've checked all screenshots and compared side-by-side with the new config. Looks Ok to me. Perhaps @Kobzol wants to confirm whether we are good to go from his side as well.

I think it'd be nice spreading the word about this PR on T-infra/annoucements.

Kobzol · 2026-03-30T13:25:49Z

repos/rust-lang/rust.toml

+name = "main"
 pattern = "main"
 allowed-merge-apps = ["bors"]
+prevent-update = true


I realized that to mirror the previous behavior of branch protections, having a non-empty list of allowed-merge-apps should probably imply prevent-update = true. But that's non-blocking, we can do that later.

Kobzol · 2026-03-30T13:28:29Z

repos/rust-lang/rust.toml

+pattern = "stable"
+allowed-merge-apps = ["promote-release"]
+# `stable` already requires users to open PRs.
+# This allows bors to push without opening a PR.


Suggested change

# This allows bors to push without opening a PR.

# This allows promote-release to push without opening a PR.

no, I meant bors!
The stable - force-push branch protection is there to restrict the behavior of bors.
promote-release doesn't have any restrictions because it is in all the allowed lists, so it could even delete the branch.

repos/rust-lang/rust.toml

rustbot · 2026-03-30T21:33:12Z

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

rustbot · 2026-03-31T08:13:53Z

☔ The latest upstream changes (possibly #2355) made this pull request unmergeable. Please resolve the merge conflicts.

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 11472fe to ccd8f31 Compare March 19, 2026 12:09

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from a4540e6 to 83f09a2 Compare March 19, 2026 22:31

marcoieni commented Mar 19, 2026

View reviewed changes

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 4 times, most recently from 6f35480 to c3d0cbd Compare March 20, 2026 09:32

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 6e4c63c to c67ec1b Compare March 23, 2026 22:54

marcoieni mentioned this pull request Mar 24, 2026

create the rust-timer team #2343

Merged

1 task

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 4 times, most recently from 0dee3f1 to f614447 Compare March 24, 2026 06:23

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from f614447 to dbe30bf Compare March 24, 2026 06:25

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 3 times, most recently from 1b14c6d to c62adff Compare March 24, 2026 17:25

marcoieni commented Mar 24, 2026

View reviewed changes

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from c62adff to 8c81777 Compare March 24, 2026 17:48

marcoieni marked this pull request as ready for review March 24, 2026 17:56

marcoieni requested review from Mark-Simulacrum, emilyalbini, jdno and ubiratansoares as code owners March 24, 2026 17:56

marcoieni requested a review from Kobzol March 24, 2026 17:57

Kobzol reviewed Mar 25, 2026

View reviewed changes

marcoieni mentioned this pull request Mar 25, 2026

change prevent-update default #2346

Closed

This comment has been minimized.

Sign in to view

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from 761602e to a6907b3 Compare March 27, 2026 17:37

This comment has been minimized.

Sign in to view

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch 2 times, most recently from 04c04e1 to 846355b Compare March 29, 2026 10:01

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from 846355b to 6e05527 Compare March 29, 2026 17:32

This comment has been minimized.

Sign in to view

marcoieni requested a review from Kobzol March 29, 2026 17:34

marcoieni mentioned this pull request Mar 30, 2026

Convert GitHub branch protections to rulesets #2356

Open

This comment has been minimized.

Sign in to view

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from eafb1f6 to 2146114 Compare March 30, 2026 10:48

ubiratansoares previously approved these changes Mar 30, 2026

View reviewed changes

Kobzol reviewed Mar 30, 2026

View reviewed changes

use rulesets in the rust repo

90ef019

marcoieni dismissed ubiratansoares’s stale review via 90ef019 March 30, 2026 21:33

marcoieni force-pushed the use-rulesets-in-the-rust-repo branch from 2146114 to 90ef019 Compare March 30, 2026 21:33

	# This allows bors to push without opening a PR.
	# This allows promote-release to push without opening a PR.

Conversation

marcoieni commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marcoieni commented Mar 19, 2026

Uh oh!

marcoieni Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marcoieni commented Mar 23, 2026

Uh oh!

marcoieni commented Mar 23, 2026

Uh oh!

Kobzol commented Mar 24, 2026

Uh oh!

marcoieni commented Mar 24, 2026

Uh oh!

Kobzol commented Mar 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marcoieni Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

marcoieni commented Mar 29, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

ubiratansoares left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rustbot commented Mar 30, 2026

marcoieni commented Mar 16, 2026 •

edited

Loading

github-actions bot commented Mar 16, 2026 •

edited

Loading

marcoieni Mar 19, 2026 •

edited

Loading

marcoieni Mar 25, 2026 •

edited

Loading