Ruleset - rules with bypass group still applied to them in case of PR creation

[marcaurele]

Select Topic Area

Product Feedback

Body

Hi,

I'm playing with the repository rulesets as it's looking more flexible that standard PR branch protection. I have a feedback on the bypass system.

I configured 2 rules targeting the default branch:

• rule A:
  • enforce CI check,
  • deny force push,
  • deny deletion
• rule B:
  • require PR before merging
    • require review from CODEOWNERS
  • bypass list:
    • ci-bot: Always

I was expecting that a our bot user in the ci-bot group would be able to still create a PR, but the rule B will not apply as it's part of the bypass list, so the rules would not enforce the PR review count and CODEOWNERS.

I also confirm that I do not have a "Branch protection rule" in place in the older settings of the repository which could collide with the rulesets.

While I see, after testing, it is more about the bypass group which does not need to create a PR, but if they do, the rules will apply to them... Why was it design so? I expected that the bypass group is really a group of users for which the content of the rule is not applied.

[marcaurele]

I believe having the implementation changed, to really not apply the rule to the group in the bypass groups would as well solve the case described here: https://github.com/orgs/community/discussions/68271 with repository's CODEOWNERS not needing to get approval.

[appatalks]

👋 Hello there!

expecting that a our bot user in the ci-bot group would be able to still create a PR, but the rule B will not apply as it's part of the bypass list, so the rules would not enforce the PR review count and CODEOWNERS.

I had recently ran into a similar report, and we had discovered that in the one case, legacy branch protections were alongside being deployed, where legacy branch protection does not support bypass lists for every rule. So, if the bot was added to the bypass list underneath the PR rule, this would not apply to status checks.

We recommend customers move their branch protections to rulesets if they want the full bypass experience.

Warm regards,
AppaTalks