Toggling who can bypass the merge queue with the deployment lock (#5837)

Author: jonrohan

.devcontainer/devcontainer.json

@@ -8,6 +8,9 @@
   "features": {
     "ghcr.io/devcontainers/features/sshd:1": {
       "version": "latest"
+    },
+    "ghcr.io/devcontainers/features/github-cli": {
+      "version": "latest"
     }
   },
   "hostRequirements": {

.github/workflows/lock-release.yml

@@ -1,6 +1,8 @@
-name: Lock Release Pull Request
+name: Toggle Release Lock
 
 on:
+  release:
+    types: [released]
   workflow_dispatch:
     inputs:
       action:
@@ -13,7 +15,8 @@ on:
 
 jobs:
   lock:
-    name: Toggle Release Lock
+    if: ${{ github.event.inputs.action == 'lock' }}
+    name: Lock the release
     runs-on: ubuntu-latest
     steps:
       - name: Get App Token
@@ -24,36 +27,52 @@ jobs:
           owner: primer
           repositories: react
           private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
-      - name: Toggle Rule > Release Conductor
+      - name: Toggle rulesets
         run: |
-          enforcement=$([ "${{ github.event.inputs.action }}" == "lock" ] && echo "active" || echo "disabled")
+          # Allow react-release-conductor to bypass merge queue
+          gh api \
+            --method PUT \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/primer/react/rulesets/4089335 \
+            -F "bypass_actors[][actor_id]=12276524" \
+            -f "bypass_actors[][actor_type]=Team" \
+            -f "bypass_actors[][bypass_mode]=always"
+          gh api \
+            --method PUT \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/primer/react/rulesets/3801256 \
+            -f "enforcement=active"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+
+  unlock:
+    if: ${{ github.event.inputs.action == 'unlock' || github.event.action == 'released' }}
+    name: Unlock the release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get App Token
+        uses: actions/create-github-app-token@21cfef2b496dd8ef5b904c159339626a10ad380e
+        id: app-token
+        with:
+          app-id: ${{ vars.PRIMER_APP_ID_SHARED }}
+          owner: primer
+          repositories: react
+          private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
+      - name: Toggle rulesets
+        run: |
+          gh api \
+            --method PUT \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/primer/react/rulesets/4089335 \
+            -F "bypass_actors[]"
           gh api \
             --method PUT \
             -H "Accept: application/vnd.github+json" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
             /repos/primer/react/rulesets/3801256 \
-            -f "enforcement=${enforcement}"
+            -f "enforcement=disabled"
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-      # - name: Toggle Rule > Update Before Merging
-      #   run: |
-      #     enforcement=$([ "${{ github.event.inputs.action }}" == "lock" ] && echo "active" || echo "disabled")
-      #     gh api \
-      #       --method PUT \
-      #       -H "Accept: application/vnd.github+json" \
-      #       -H "X-GitHub-Api-Version: 2022-11-28" \
-      #       /repos/primer/react/rulesets/4089341 \
-      #       -f "enforcement=${enforcement}"
-      #   env:
-      #     GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-      # - name: Toggle Rule > Merge Queue
-      #   run: |
-      #     enforcement=$([ "${{ github.event.inputs.action }}" == "lock" ] && echo "disabled" || echo "active")
-      #     gh api \
-      #       --method PUT \
-      #       -H "Accept: application/vnd.github+json" \
-      #       -H "X-GitHub-Api-Version: 2022-11-28" \
-      #       /repos/primer/react/rulesets/4089335 \
-      #       -f "enforcement=${enforcement}"
-      #   env:
-      #     GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}