diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-13 08:28:26 -0700 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-13 08:28:26 -0700 |
| commit | f67835733d510c7090637fb81b08aa8ae1249e86 (patch) | |
| tree | 98711834881b4d58cd88bc5e337ff75324ecfe4e | |
| parent | 4dd2af017c9ae219e0ddc9f28836baeec72dd9ed (diff) | |
| download | mergify-f67835733d510c7090637fb81b08aa8ae1249e86.tar.gz mergify-f67835733d510c7090637fb81b08aa8ae1249e86.zip | |
Allow @VyOS-Networks/maintainers to run Mergify commands
Add `sender=@VyOS-Networks/maintainers` to the shared
`commands_restrictions` block so VyOS-Networks Maintainers can issue
@Mergifyio slash commands when this central config (or any per-repo
config copying its conditions) is encountered on the VyOS-Networks
side of the cross-org mirror.
Mergify evaluates each `or:` branch independently. A team reference
from a different org evaluates to a non-match with a surfaced warning
("Team @<org>/<team> is not part of the organization <repo-org>")
but does not fail the rule. So on vyos org PRs, `@vyos/maintainers`
still matches normally and the cross-org entry is benign.
Incident: VyOS-Networks/vyatta-cfg#33. The T8531-era inline config
in `.github/mergify.yml` only listed `@vyos/maintainers`, and after
the cross-org mirror pipeline replicated it to VyOS-Networks,
`@Mergifyio backport` from a VyOS-Networks Maintainer was rejected.
Pairs with vyos/vyatta-cfg#134 (migration to `extends: mergify`) and
the matching change to VyOS-Networks/mergify.
🤖 Generated by [robots](https://vyos.io)
| -rw-r--r-- | .mergify.yml | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/.mergify.yml b/.mergify.yml index 0fe7ac1..c8750f6 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -91,10 +91,33 @@ pull_request_rules: - invalid-title commands_restrictions: + # Both Maintainers teams are listed for defense-in-depth. + # + # This file is consumed by vyos/* repos via the org-local + # `extends: mergify` (which resolves to vyos/mergify within the vyos + # org). On a vyos repo PR, `@vyos/maintainers` is the local team and + # matches normally; `@VyOS-Networks/maintainers` is cross-org and + # evaluates to a non-match (Mergify surfaces it as + # "Team @VyOS-Networks/maintainers is not part of the organization + # vyos") — but does not fail the `or:` rule, so any of the remaining + # branches can still match. + # + # The defense-in-depth case is the cross-org mirror pipeline: if this + # file (or any per-repo file copying these conditions) is ever + # replicated byte-for-byte to a VyOS-Networks repo without being + # migrated to `extends:`, the `@VyOS-Networks/maintainers` entry + # ensures VyOS-Networks Maintainers can still issue Mergify commands + # on the mirrored PR. + # + # See VyOS-Networks/vyatta-cfg#33 for the incident that motivated + # listing both teams: the T8531 predecessor inline config (single + # team, `@vyos/maintainers`) was mirrored to VyOS-Networks/vyatta-cfg + # and rejected `@Mergifyio backport` from a VyOS-Networks Maintainer. backport: &allowed conditions: - or: - sender=@vyos/maintainers + - sender=@VyOS-Networks/maintainers - sender=vyosbot copy: *allowed dequeue: *allowed |