From 86cee254734aee8a24923e44c213fb40e731cccf Mon Sep 17 00:00:00 2001
From: Siddharth Kshetrapal <siddharthkp@github.com>
Date: Mon, 30 Mar 2026 22:52:39 +0200
Subject: [PATCH 1/2] =?UTF-8?q?Revert=20"lock-release.yml:=20Use=20legacy?=
 =?UTF-8?q?=20branch=20protection=20instead=20of=20rulesets=20(#=E2=80=A6"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit f4418419f68587b6cda73f26f6d58ae3f3439667.
---
 .github/workflows/lock-release.yml | 56 +++++++++++++++++++-----------
 1 file changed, 35 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/lock-release.yml b/.github/workflows/lock-release.yml
index 29b3a14e7dd..8b02e74b97b 100644
--- a/.github/workflows/lock-release.yml
+++ b/.github/workflows/lock-release.yml
@@ -29,26 +29,23 @@ jobs:
           owner: primer
           repositories: react
           private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
-      - name: Lock main branch
+      - name: Toggle rulesets
         run: |
-          # Lock main but allow react-release-conductor team to push
+          # Allow react-release-conductor to bypass merge queue
           gh api \
             --method PUT \
             -H "Accept: application/vnd.github+json" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            /repos/primer/react/branches/main/protection \
-            --input - <<EOF
-          {
-            "lock_branch": true,
-            "restrictions": {
-              "teams": ["react-release-conductor"],
-              "users": []
-            },
-            "required_status_checks": null,
-            "enforce_admins": true,
-            "required_pull_request_reviews": null
-          }
-          EOF
+            /repos/primer/react/rulesets/4089335 \
+            -F "bypass_actors[][actor_id]=12276524" \
+            -f "bypass_actors[][actor_type]=Team" \
+            -f "bypass_actors[][bypass_mode]=always"
+          gh api \
+            --method PUT \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/primer/react/rulesets/3801256 \
+            -f "enforcement=active"
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
@@ -65,15 +62,32 @@ jobs:
           owner: primer
           repositories: react
           private-key: ${{ secrets.PRIMER_APP_PRIVATE_KEY_SHARED }}
-      - name: Unlock main branch
+      - name: Toggle rulesets
         run: |
-          # Delete the branch protection rule entirely.
-          # Note: This workflow is the only thing using legacy branch protection.
-          # All other branch rules use rulesets, which are unaffected by this delete.
           gh api \
-            --method DELETE \
+            --method PUT \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/primer/react/rulesets/4089335 \
+            -F "bypass_actors[]"
+          gh api \
+            --method PUT \
             -H "Accept: application/vnd.github+json" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            /repos/primer/react/branches/main/protection
+            /repos/primer/react/rulesets/3801256 \
+            -f "enforcement=disabled"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+      - name: Update all PRs that are toggled merge when ready
+        run: |
+          PR_NUMBERS=$(gh pr list -L 100 -R primer/react --state open --json number,baseRefName,autoMergeRequest,reviewDecision -q '.[] | select(.autoMergeRequest != null) | select(.baseRefName == "main") | select(.reviewDecision == "APPROVED") | .number')
+          if [ -n "$PR_NUMBERS" ]; then
+            echo "Updating $PR_NUMBERS"
+            for pr in $PR_NUMBERS; do
+              gh pr update-branch -R primer/react "$pr" || echo "Warning: failed to update PR #$pr (likely has conflicts)"
+            done
+          else
+            echo "No PRs to update."
+          fi
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

From deccf089747677742cf57efe39e2c475981fda2e Mon Sep 17 00:00:00 2001
From: Siddharth Kshetrapal <siddharthkp@github.com>
Date: Mon, 30 Mar 2026 23:11:48 +0200
Subject: [PATCH 2/2] fix(release): toggle auto-merge instead of updating
 branch to avoid extra CI

---
 .github/workflows/lock-release.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lock-release.yml b/.github/workflows/lock-release.yml
index 8b02e74b97b..8b3b9444868 100644
--- a/.github/workflows/lock-release.yml
+++ b/.github/workflows/lock-release.yml
@@ -82,9 +82,10 @@ jobs:
         run: |
           PR_NUMBERS=$(gh pr list -L 100 -R primer/react --state open --json number,baseRefName,autoMergeRequest,reviewDecision -q '.[] | select(.autoMergeRequest != null) | select(.baseRefName == "main") | select(.reviewDecision == "APPROVED") | .number')
           if [ -n "$PR_NUMBERS" ]; then
-            echo "Updating $PR_NUMBERS"
+            echo "Re-enabling auto-merge on $PR_NUMBERS"
             for pr in $PR_NUMBERS; do
-              gh pr update-branch -R primer/react "$pr" || echo "Warning: failed to update PR #$pr (likely has conflicts)"
+              gh pr merge "$pr" -R primer/react --disable-auto || echo "Warning: failed to disable auto-merge on PR #$pr"
+              gh pr merge "$pr" -R primer/react --auto --squash || echo "Warning: failed to enable auto-merge on PR #$pr"
             done
           else
             echo "No PRs to update."