OSAC-3734: enable merge queue for osac monorepo

modules/common_repository/main.tf

@@ -151,7 +151,9 @@ resource "github_repository_ruleset" "status_checks" {
 
   rules {
     required_status_checks {
-      strict_required_status_checks_policy = true
+      # When merge queue is enabled, strict is unnecessary — the queue tests
+      # each PR against latest main before merging.
+      strict_required_status_checks_policy = var.merge_queue != null ? false : true
 
       dynamic "required_check" {
         for_each = var.required_status_checks
@@ -161,6 +163,19 @@ resource "github_repository_ruleset" "status_checks" {
         }
       }
     }
+
+    dynamic "merge_queue" {
+      for_each = var.merge_queue[*]
+      content {
+        check_response_timeout_minutes    = merge_queue.value.check_response_timeout_minutes
+        grouping_strategy                 = merge_queue.value.grouping_strategy
+        max_entries_to_build              = merge_queue.value.max_entries_to_build
+        max_entries_to_merge              = merge_queue.value.max_entries_to_merge
+        merge_method                      = merge_queue.value.merge_method
+        min_entries_to_merge              = merge_queue.value.min_entries_to_merge
+        min_entries_to_merge_wait_minutes = merge_queue.value.min_entries_to_merge_wait_minutes
+      }
+    }
   }
 
   depends_on = [github_repository.repo]

modules/common_repository/variables.tf

@@ -190,6 +190,20 @@ variable "ruleset_bypass_team_ids" {
   default     = []
 }
 
+variable "merge_queue" {
+  description = "Merge queue configuration. When set, enables merge queue on the default branch and disables strict status checks (the queue handles freshness)."
+  type = object({
+    merge_method                      = optional(string, "MERGE")
+    max_entries_to_build              = optional(number, 5)
+    max_entries_to_merge              = optional(number, 5)
+    min_entries_to_merge              = optional(number, 1)
+    min_entries_to_merge_wait_minutes = optional(number, 5)
+    check_response_timeout_minutes    = optional(number, 60)
+    grouping_strategy                 = optional(string, "ALLGREEN")
+  })
+  default = null
+}
+
 variable "all_members_permission" {
   description = "Permission for all organization members"
   type        = string

repositories.tf

@@ -139,22 +139,35 @@ module "repo_osac" {
       permission = "admin"
     }
   ]
+  # Prow plugins handle approval via OWNERS (lgtm/approved labels), not native
+  # GitHub reviews. The label-gate workflow enforces label presence as a status
+  # check for the merge queue.
   required_approvals = null
-  # osac's own CI (all 3 e2e install flavors) is live and has been passing on
-  # real PRs for a while now -- require all 3, not just vmaas like the
-  # pre-merge component repos below, since this is now the repo everything
-  # actually merges into.
   required_status_checks = [
     { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 },
     { context = "e2e-bmaas-full-install / e2e", integration_id = 15368 },
     { context = "e2e-caas-full-install / e2e", integration_id = 15368 },
+    # Reads Prow-set labels (lgtm, approved, jira/valid-reference) and converts
+    # them to a status check the merge queue can gate on.
+    { context = "label-gate / check-labels", integration_id = 15368 },
   ]
   # Preserve subtree-merge history/blame going forward -- squash-merging on the
   # mono-repo would collapse that history for every commit after cutover, so
   # it's disabled at the GitHub level, not just by convention.
   allow_squash_merge      = false
   ruleset_bypass_team_ids = [github_team.all["wg-infra"].id]
-  push_allowances         = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"]
+  # openshift-merge-robot removed: Tide no longer merges; merge queue handles it.
+  push_allowances = ["osac-project/wg-infra", "osac-project/org-admins"]
+
+  merge_queue = {
+    merge_method                      = "REBASE"
+    max_entries_to_build              = 3
+    max_entries_to_merge              = 5
+    min_entries_to_merge              = 1
+    min_entries_to_merge_wait_minutes = 5
+    check_response_timeout_minutes    = 120
+    grouping_strategy                 = "ALLGREEN"
+  }
 }
 
 module "repo_cloudkit_operator" {