Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

If no rule matches can policy-bot not set a failed status on the PR? #709

Open
RoryDoherty opened this issue Feb 8, 2024 · 1 comment
Open

Comments

@RoryDoherty
Copy link
Contributor

I'm trying to use policy-bot along with bulldozer to automate the merging of certain PRs which could be opened by bots or scripts
In bulldozer I have set the "policy-bot: master" as a required status check

I only want policy-bot to add a commit status to PRs where it has verified that it does match one of the rules and passes
If it fails the check or doesn't match the rule then I want policy-bot to ignore it and not add a commit status
image

Is this possible?
I assumed if I had no disapproval set in the .policy.yml that it would not create failed status checks

@bluekeyes
Copy link
Member

The way we usually solve this problem (automatically merging PRs from bots or scripts) is a bit different:

  1. Policy Bot is always a required status check in GitHub
    1. PRs from bots that modify the right files are automatically approved
    2. PRs from humans require review (you could also auto-approve these if you wanted)
  2. Bulldozer will always wait for required status checks (as configured in GitHub) to pass
  3. When bots open PRs, they add the merge when ready label to the PR. This label is the trigger that enables Bulldozer to merge the PR when all the checks are passing. You could also have another app or a GitHub Action add labels like this.

In other words, while Policy Bot is a precondition to merge, it is not the trigger that activates Bulldozer. This has worked pretty well for us and I think it's useful to be able to say that a check is always required and should always be present on a PR.


That said, you are not the first person to ask for Policy Bot to skip PRs where the policy does not match any rules. We added the explicit failure as a safety measure to help prevent policies that accidentally approved or ignore changes that they shouldn't have. We developed Policy Bot primarily as a compliance tool, so these safety measures are important.

I think we could add a server-level flag to control this behavior so people who are using Policy Bot for convenience rather than compliance could disable this and skip posting a status when no rules match. Unlike the initial implementation in #711, I think we want to only skip posting a status when there are no matching rules. The pending status is useful to indicate that you probably have a condition wrong in the policy (something should have been approved, but it was not) and the failure/error status is useful if something goes wrong during evaluation.

Making this a server-level flag is important to us because for our workflows, we don't want individual projects to be able to opt-in to this feature. We'd leave it disabled (which should also be the default), but you and other users could enable it when you deploy Policy Bot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants