Merge pull request #577 from stackhpc/zuul_only_branch_protection

Add ZuulOnly branch protection

Author: priteau

terraform/github/branches.tf

@@ -555,7 +555,7 @@ resource "github_branch_protection" "openstack_branch_protection_caracal" {
 }
 
 resource "github_branch_protection" "openstack_branch_protection_epoxy" {
-  for_each      = toset(var.repositories["OpenStack"])
+  for_each      = toset([for r in var.repositories["OpenStack"] : r if !contains(var.repositories["ZuulOnly"], r)])
   repository_id = data.github_repository.repositories[each.key].node_id
 
   pattern                         = "stackhpc/2025.1"
@@ -594,7 +594,7 @@ resource "github_branch_protection" "openstack_branch_protection_epoxy" {
 }
 
 resource "github_branch_protection" "openstack_branch_protection_gazpacho" {
-  for_each      = toset(var.repositories["OpenStack"])
+  for_each      = toset([for r in var.repositories["OpenStack"] : r if !contains(var.repositories["ZuulOnly"], r)])
   repository_id = data.github_repository.repositories[each.key].node_id
 
   pattern                         = "stackhpc/2026.1"
@@ -669,6 +669,74 @@ resource "github_branch_protection" "openstack_branch_protection_master" {
   }
 }
 
+# ZuulOnly: push_allowances contains only the Zuul GitHub App, so PRs can only be
+# merged by Zuul (typically after the "gate" label enqueues the change into its gate
+# pipeline). Neither the Developers team nor the owning team can merge directly.
+# Only the stackhpc/2025.1 and stackhpc/2026.1 branches are gated this way for now
+resource "github_branch_protection" "zuulonly_branch_protection_epoxy" {
+  for_each      = toset(var.repositories["ZuulOnly"])
+  repository_id = data.github_repository.repositories[each.key].node_id
+
+  pattern                         = "stackhpc/2025.1"
+  require_conversation_resolution = true
+  allows_deletions                = false
+  allows_force_pushes             = false
+
+  restrict_pushes {
+    blocks_creations = false
+    push_allowances = [
+      local.zuul_app_node_id
+    ]
+  }
+
+  required_pull_request_reviews {
+    dismiss_stale_reviews           = true
+    require_code_owner_reviews      = true
+    required_approving_review_count = 1
+  }
+
+  required_status_checks {
+    contexts = ["stackhpc/check"]
+    strict   = false
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "github_branch_protection" "zuulonly_branch_protection_gazpacho" {
+  for_each      = toset(var.repositories["ZuulOnly"])
+  repository_id = data.github_repository.repositories[each.key].node_id
+
+  pattern                         = "stackhpc/2026.1"
+  require_conversation_resolution = true
+  allows_deletions                = false
+  allows_force_pushes             = false
+
+  restrict_pushes {
+    blocks_creations = false
+    push_allowances = [
+      local.zuul_app_node_id
+    ]
+  }
+
+  required_pull_request_reviews {
+    dismiss_stale_reviews           = true
+    require_code_owner_reviews      = true
+    required_approving_review_count = 1
+  }
+
+  required_status_checks {
+    contexts = ["stackhpc/check"]
+    strict   = false
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
 resource "github_branch_protection" "platform_branch_protection" {
   for_each      = toset(var.repositories["Platform"])
   repository_id = data.github_repository.repositories[each.key].node_id

terraform/github/terraform.tfvars.json

@@ -104,6 +104,9 @@
     "SRE": [
       "terraform-cloudflare-dns",
       "terraform-cloudflare-iam"
+    ],
+    "ZuulOnly": [
+      "neutron"
     ]
   },
   "teams": {

terraform/github/variables.tf

@@ -29,6 +29,7 @@ variable "repositories" {
     "ReleaseTrain" = [],
     "SMSLab"       = [],
     "SRE"          = [],
+    "ZuulOnly"     = [],
   }
 }