Allow authorized users to bypass branch protection when merging - #9144

@microsoft-github-policy-service agree

Thanks for this, it is exactly what we were missing. I built it locally on top of 0.174.0 and hit one gap worth sharing.

viewerCanMergeAsAdmin does not reflect repository ruleset bypass. Our protected branches use rulesets only (no classic branch protection). I am a bypass actor (bypass_mode: pull_request) on the ruleset that requires an approving review. On a PR where all required checks pass and only the review is missing:

• github.com shows "Merge without waiting for requirements to be met (bypass rules)" and the merge works.
• GraphQL returns mergeStateStatus: BLOCKED and viewerCanMergeAsAdmin: false for the same user and PR.
• REST GET /repos/{owner}/{repo}/rulesets/{id} returns current_user_can_bypass: "pull_requests_only" for that ruleset (and "never" for the one holding the required status checks).

So with this PR as is, the checkbox never appears for ruleset-based repos. Locally I added a fallback that only runs when the PR is BLOCKED/BEHIND and viewerCanMergeAsAdmin is not true:

// GitHubRepository
async canViewerBypassBranchRules(branch: string): Promise<boolean> {
	// cached per branch for 5 minutes
	const { octokit, remote } = await this.ensure();
	const owner = remote.owner;
	const repo = remote.repositoryName;
	const rules = await octokit.call(octokit.api.repos.getBranchRules, { owner, repo, branch, per_page: 100 });
	const ids = [...new Set(rules.data.map(rule => rule.ruleset_id).filter((id): id is number => typeof id === 'number'))];
	for (const ruleset_id of ids) {
		const ruleset = await octokit.call(octokit.api.repos.getRepoRuleset, { owner, repo, ruleset_id });
		const can = ruleset.data.current_user_can_bypass;
		if (can === 'always' || can === 'pull_requests_only' || can === 'exempt') {
			return true;
		}
	}
	return false;
}

// PullRequestModel.getMergeability, after the PullRequestMergeability query
const fetched = data.repository?.pullRequest;
if (fetched && fetched.viewerCanMergeAsAdmin !== true
	&& (fetched.mergeStateStatus === 'BLOCKED' || fetched.mergeStateStatus === 'BEHIND')
	&& this.base?.ref) {
	fetched.viewerCanMergeAsAdmin = await this.githubRepository.canViewerBypassBranchRules(this.base.ref);
}

With that the checkbox shows up on our blocked PR, matching the web UI. Two caveats:

• It is coarser than the web UI: it answers "can the viewer bypass any ruleset on this branch", not "can the viewer bypass the specific unmet rules". If the unmet rule is one the viewer cannot bypass (e.g. required checks with never), the checkbox still appears and GitHub rejects the merge. Authorization stays server-side either way.
• It costs 1 + N REST calls (N = rulesets on the branch), only for blocked/behind PRs. A short cache keeps the 3s mergeability polling from repeating them.

Happy to open this as a follow-up PR if that is easier to review separately.

Also a small visual note: the checkbox has no styling, so in the overview it sits flush against the bottom border of the status box with the label touching the input.

Thanks for picking this up so quickly. I rebuilt e7ad01a on top of 0.174.0 and tried it on the same ruleset-only repo: on a PR blocked only by the required review, the "Bypass branch rules and merge" checkbox now appears in the overview, and the new layout reads well.

The enforcement === 'active' check and the includes_parents lookup also cover two cases my local version missed.

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.