Add the option to not require a PR for protected branches

[Kobzol]

This PR adds a pr-required = <true/false> option to branch protections. There are some repositories that use branch protections, but that do not require a PR.

I also refactored the branch protection mode to make the data representation clearer/make it impossible to represent invalid states (such as PR not required, but a required approval count is set). This is a compatibility break for the v1 data format, but branch protections are only read by sync-team anyway, so it shouldn't be a big deal.

An interesting thing is that it does not actually make sense to require any CI status checks if a PR is not required, because we do not enable anyone to bypass the branch protections. Because if you set a CI check, and try to push to the branch without a PR, it will be rejected.

Without a required PR, the branch protection still disallows force pushes and deletion, and allows us to set push actor allowances.

Relevant repos:

• Drop branch protections on llvm-project #1346
• Add crates.io-index repository under automation #1306 (comment)
• Remove requirement to create PRs from calendar repo #1360

[Kobzol]

The sync-team side of this change is here.

[jackh726]

This change breaks anything (namely sync-team) that relies on the current schema?

Don't think we can do this (at least not immediately).

[Kobzol]

I don't think that there's anything else than sync-team that read the branch protections, and the sync-team change is ready. I already did some breaking changes recently that broke sync-team, it doesn't seem like a big deal.

Although, it would be bad if this broke other tools that just reuse the schema, even if they don't read the branch protections at all. Not sure if there are any of these though. Is there even any other tool apart from sync-team that reads the repos endpoint?

[MarcoIeni]

Looks good to me. I'm not concerned about the breaking change because we control sync-team so we can redeploy it after changing the format 👍

[Kobzol]

@Turbo87 @jackh726 @rylev Apart from the breaking change to sync-team (which we expect and which will be resolved soon after merging this), do you have any other concerns about this change?

[Turbo87]

Without a required PR, the branch protection still disallows force pushes and deletion, and allows us to set push actor allowances.

FWIW we need force pushes for the index repository too, since we regularly squash the history to keep the download size reasonable, but I guess that is unrelated to this PR?

[Kobzol]

Yes, the index repo will need some additional special treatment I think, that is tangential (although it will also need the ability to avoid PRs on branches, I suppose).

[jdno]

I'm not concerned about the breaking change because we control sync-team so we can redeploy it after changing the format

Theoretically, this is a public API and we're not necessarily the only consumers. But a quick code search doesn't show any uses of the Repo struct outside of sync-team. And it's definitely not worth the effort to bump the API version for this...

[Turbo87]

But a quick code search doesn't show any uses of the Repo struct outside of sync-team.

btw not everyone is necessarily using this as a git dependency... (https://github.com/rust-lang/crates.io/blob/e922d6806cfcb90a4eb8838ec3a29029b65fe9e0/src/team_repo.rs#L63 😉)

[Kobzol]

I was specifically looking for usage of the repos endpoint and the required_approvals attribute before, which didn't seem to show anything.

[MarcoIeni]

merged as asked by Kobzol