From 1c4ac7f136c7296a354807f271a95b61d5925449 Mon Sep 17 00:00:00 2001
From: Jason Ross <jason.ross841@outlook.com>
Date: Wed, 29 Apr 2026 18:35:26 -0500
Subject: [PATCH] Add bypass_actors variable; allow Admin role to bypass
 ruleset

Mirrors the addition in JMR-dev/gh-repo-bootstrap. Solo-maintainer
configuration so PRs can be merged without a second approver.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 infra/github/main.tf      |  9 +++++++++
 infra/github/variables.tf | 17 +++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/infra/github/main.tf b/infra/github/main.tf
index d6810bc..1d7054e 100644
--- a/infra/github/main.tf
+++ b/infra/github/main.tf
@@ -15,6 +15,15 @@ resource "github_repository_ruleset" "default_branch" {
     }
   }
 
+  dynamic "bypass_actors" {
+    for_each = var.bypass_actors
+    content {
+      actor_id    = bypass_actors.value.actor_id
+      actor_type  = bypass_actors.value.actor_type
+      bypass_mode = bypass_actors.value.bypass_mode
+    }
+  }
+
   rules {
     deletion            = true
     non_fast_forward    = true
diff --git a/infra/github/variables.tf b/infra/github/variables.tf
index 217dff4..97271ed 100644
--- a/infra/github/variables.tf
+++ b/infra/github/variables.tf
@@ -37,3 +37,20 @@ variable "ruleset_name" {
   type        = string
   default     = "default-branch-protection"
 }
+
+variable "bypass_actors" {
+  description = <<-EOT
+    Actors permitted to bypass the ruleset. Each entry needs:
+      - actor_id: numeric ID (for built-in repo roles: 1=read, 2=triage,
+        3=write, 4=maintain, 5=admin)
+      - actor_type: one of RepositoryRole, Team, Integration,
+        OrganizationAdmin, DeployKey
+      - bypass_mode: "always" or "pull_request"
+  EOT
+  type = list(object({
+    actor_id    = number
+    actor_type  = string
+    bypass_mode = string
+  }))
+  default = []
+}