From f67835733d510c7090637fb81b08aa8ae1249e86 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Wed, 13 May 2026 08:28:26 -0700
Subject: Allow @VyOS-Networks/maintainers to run Mergify commands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add `sender=@VyOS-Networks/maintainers` to the shared
`commands_restrictions` block so VyOS-Networks Maintainers can issue
@Mergifyio slash commands when this central config (or any per-repo
config copying its conditions) is encountered on the VyOS-Networks
side of the cross-org mirror.

Mergify evaluates each `or:` branch independently. A team reference
from a different org evaluates to a non-match with a surfaced warning
("Team @<org>/<team> is not part of the organization <repo-org>")
but does not fail the rule. So on vyos org PRs, `@vyos/maintainers`
still matches normally and the cross-org entry is benign.

Incident: VyOS-Networks/vyatta-cfg#33. The T8531-era inline config
in `.github/mergify.yml` only listed `@vyos/maintainers`, and after
the cross-org mirror pipeline replicated it to VyOS-Networks,
`@Mergifyio backport` from a VyOS-Networks Maintainer was rejected.

Pairs with vyos/vyatta-cfg#134 (migration to `extends: mergify`) and
the matching change to VyOS-Networks/mergify.

🤖 Generated by [robots](https://vyos.io)
---
 .mergify.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.mergify.yml b/.mergify.yml
index 0fe7ac1..c8750f6 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -91,10 +91,33 @@ pull_request_rules:
           - invalid-title
 
 commands_restrictions:
+  # Both Maintainers teams are listed for defense-in-depth.
+  #
+  # This file is consumed by vyos/* repos via the org-local
+  # `extends: mergify` (which resolves to vyos/mergify within the vyos
+  # org). On a vyos repo PR, `@vyos/maintainers` is the local team and
+  # matches normally; `@VyOS-Networks/maintainers` is cross-org and
+  # evaluates to a non-match (Mergify surfaces it as
+  # "Team @VyOS-Networks/maintainers is not part of the organization
+  # vyos") — but does not fail the `or:` rule, so any of the remaining
+  # branches can still match.
+  #
+  # The defense-in-depth case is the cross-org mirror pipeline: if this
+  # file (or any per-repo file copying these conditions) is ever
+  # replicated byte-for-byte to a VyOS-Networks repo without being
+  # migrated to `extends:`, the `@VyOS-Networks/maintainers` entry
+  # ensures VyOS-Networks Maintainers can still issue Mergify commands
+  # on the mirrored PR.
+  #
+  # See VyOS-Networks/vyatta-cfg#33 for the incident that motivated
+  # listing both teams: the T8531 predecessor inline config (single
+  # team, `@vyos/maintainers`) was mirrored to VyOS-Networks/vyatta-cfg
+  # and rejected `@Mergifyio backport` from a VyOS-Networks Maintainer.
   backport: &allowed
     conditions:
       - or:
         - sender=@vyos/maintainers
+        - sender=@VyOS-Networks/maintainers
         - sender=vyosbot
   copy: *allowed
   dequeue: *allowed
-- 
cgit v1.2.3