OSAC-3734: enable merge queue for osac monorepo

[omer-vishlitzky]

Summary

Enable GitHub merge queue on osac-project/osac, replacing Tide as the merge automation layer.

Why

Since moving to the monorepo, CI breaks frequently because Tide cannot retest PRs when main advances. Tide's staleness detection only works with native Prow jobs — OSAC uses GitHub Actions exclusively. With zero Prow presubmits configured, Tide's per-context staleness bookkeeping iterates an empty list and never executes. Its merge gate only checks whether a required GitHub Actions check is currently reporting success — it has no concept of "was this success computed against an old base SHA." Once a PR's checks pass, nothing re-verifies them against a moving main. This is confirmed upstream behavior, not a bug (prow#356, test-infra#20713).

How it works

Prow plugins (UNCHANGED)         GitHub merge queue (NEW)
├── /lgtm → label                ├── Gates on status checks
├── /approve → label             ├── Tests PR against latest main
├── jira → label                 ├── Re-tests if main moves
└── /hold → label                └── Merges on success

label-gate GH Action (NEW, in osac repo)
├── Reads Prow-set labels (lgtm, approved, jira/valid-reference)
├── Converts label presence to a status check
└── Merge queue gates on this check

Prow plugins continue setting labels via OWNERS files — nothing changes for developers. The label-gate workflow bridges labels → status checks (merge queue can only gate on status checks, not labels). Tide merge queries are removed entirely (separate openshift/release PR).

Changes in this PR

File	Change
modules/common_repository/variables.tf	Add merge_queue variable (reusable for other repos)
modules/common_repository/main.tf	Add merge_queue rule to ruleset; set strict=false when merge queue enabled
repositories.tf	Enable merge queue on osac; add label-gate / check-labels to required checks; set required_approvals=null (Prow handles approval); remove openshift-merge-robot from push allowances

Merge queue config

Parameter	Value	Rationale
merge_method	REBASE	required_linear_history is on; squash is disabled
max_entries_to_build	3	Concurrent queue runs (match runner capacity)
max_entries_to_merge	5	Max batch size
min_entries_to_merge	1	Don't wait for batch to fill
min_entries_to_merge_wait_minutes	5	Wait 5 min for more entries before starting
check_response_timeout_minutes	120	E2E takes ~90 min
grouping_strategy	ALLGREEN	All checks must pass in batch

Developer UX (what changes)

Before	After
/lgtm + /approve + Jira ref → Tide merges	/lgtm + /approve + Jira ref → dev clicks "Add to merge queue" → queue tests against latest main → merges
Main breaks when stale PRs merge	Every PR tested against latest main before merge
Manual /retest after main moves	Automatic re-test

Companion PRs — merge in this order

1. OSAC-3734: add label-gate workflow for merge queue osac#204 — add label-gate.yml workflow (must exist before this PR adds it as required check)
2. This PR — enable merge queue, add label-gate / check-labels to required checks
3. OSAC-3734: osac-project: remove Tide merge queries, keep Prow plugins openshift/release#83121 — remove Tide merge queries (keep all Prow plugins)

Test plan

• tofu plan shows expected changes (merge_queue rule added, strict=false, label-gate required)
• After apply: "Merge" button on osac PRs becomes "Add to merge queue"
• PRs without lgtm + approved + jira/valid-reference labels can't enter queue
• PRs in queue are tested against latest main via merge_group trigger
• If main changes while PR is queued, PR is re-tested
• Prow plugins (/lgtm, /approve, /hold, jira) continue working

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@omer-vishlitzky, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ef80edc0-1ca1-4fdb-82d7-5da62f61d087

📥 Commits

Reviewing files that changed from the base of the PR and between 949cead and 8672873.

📒 Files selected for processing (2)

• modules/common_repository/main.tf
• repositories.tf

Walkthrough

The Terraform module now supports optional GitHub merge queues. The repo_osac configuration enables a rebase merge queue, updates required checks, and removes the OpenShift merge robot from push allowances.

Changes

Merge queue support

Layer / File(s)	Summary
Module merge queue contract and ruleset wiring modules/common_repository/variables.tf, modules/common_repository/main.tf	Adds optional merge queue settings with defaults. When configured, the ruleset disables strict status checks and applies the merge queue settings.
repo_osac merge queue configuration repositories.tf	Adds the label-gate / check-labels status check, retains the three end-to-end checks, leaves native GitHub approvals unset, disables squash merging, removes the OpenShift merge robot from push allowances, and enables a rebase-based merge queue.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• osac-project/github-config#134: Extends the same common repository merge queue support.
• osac-project/github-config#148: Updates related repo_osac merge and status-check configuration.
• osac-project/github-config#153: Adds related repo_osac required status-check configuration.

Suggested reviewers: eliorerz, larsks

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	Added lines contain only merge-queue settings and repository identifiers; scans found no hardcoded secrets, credential URLs, private keys, vendor tokens, or long base64 strings.
No-Weak-Crypto	✅ Passed	The commit only adds Terraform merge-queue configuration and status-check settings; exact scans of added lines and changed files found no weak crypto or custom crypto implementation.
No-Injection-Vectors	✅ Passed	The PR changes only Terraform configuration; added lines define typed merge-queue values and GitHub ruleset fields, with no SQL, shell execution, eval/exec, unsafe YAML/pickle, or HTML injection.
Container-Privileges	✅ Passed	The pull request changes only Terraform repository settings and module variables; it adds no container or Kubernetes manifests with the listed privilege settings.
No-Sensitive-Data-In-Logs	✅ Passed	The changed Terraform adds merge-queue settings and status-check comments only; scans found no logging constructs or sensitive data such as tokens, passwords, PII, or hostnames.
Ai-Attribution	✅ Passed	The PR states it used Claude Code, and the tip commit includes an Assisted-by trailer; no AI Co-Authored-By trailer is present.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: enabling the merge queue for the OSAC monorepo.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@repositories.tf`:
- Around line 144-147: Update the repository rule’s required_approvals setting
from null to 1 to enforce one native GitHub approval, and revise the adjacent
comment to accurately describe this requirement alongside the Prow label checks.
- Around line 168-169: Update min_entries_to_merge in the repository merge
configuration to a non-singleton batch floor, such as 2, so
min_entries_to_merge_wait_minutes can enforce the intended wait for additional
queued PRs.
- Around line 148-155: Verify that the workflow producing “label-gate /
check-labels” is triggered by merge_group and reports
github_context/integration_id 15368, updating the merge-queue workflow
configuration as needed. Also validate the required_status_checks entries for
the e2e-vmaas, e2e-bmaas, and e2e-caas contexts against the statuses their CI
workflows actually publish, correcting mismatches.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d7af562b-03df-476d-a7e6-fc3db03bedd3

📥 Commits

Reviewing files that changed from the base of the PR and between 8e2a6e4 and 949cead.

📒 Files selected for processing (1)

• repositories.tf