Add ZuulOnly branch protection

[mnasiadka]

stackhpc/neutron is a first example of a Zuul only CI repo, stackhpc/2025.1 and stackhpc/2026.1 only run Zuul jobs and we can use gate label to gate the patches for Zuul to merge them.

Disable the permission for regular human users to merge patches in these repositories.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: stackhpc/stackhpc-release-train/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d93d60d3-2b8c-45b6-ac07-a5b66a34de12

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Summary

Adds Zuul-only branch protection for stackhpc/neutron, stackhpc/2025.1, and stackhpc/2026.1. Excludes these repositories from standard protection and allows only the Zuul GitHub App to merge patches using the gate label.

Walkthrough

Terraform adds the ZuulOnly repository group, assigns neutron to it, and applies dedicated protection to the stackhpc/2025.1 and stackhpc/2026.1 branches. Standard OpenStack protection excludes these repositories.

Changes

Zuul-only branch protection

Layer / File(s)	Summary
Repository group configuration terraform/github/variables.tf, terraform/github/terraform.tfvars.json	The repositories map defines ZuulOnly. The variables assign neutron to this group.
Zuul-only branch protection resources terraform/github/branches.tf	The standard OpenStack protections exclude ZuulOnly repositories. Dedicated resources protect the stackhpc/2025.1 and stackhpc/2026.1 branches. Only local.zuul_app_node_id is allowed to push or merge.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 8b809

Applying this change can temporarily remove the release-branch protections while Terraform recreates them. Preserve the existing resource state with moves before merging.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e6db8569-db5c-43a0-8bd1-5e40d4ec1075

📥 Commits

Reviewing files that changed from the base of the PR and between 8d6e4fc and 8b80997.

📒 Files selected for processing (3)

• terraform/github/branches.tf
• terraform/github/terraform.tfvars.json
• terraform/github/variables.tf

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

[stackhpc-ci]

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan

undefined

Pusher: @mnasiadka, Action: pull_request, Working Directory: ``, Workflow: Terraform GitHub

[Alex-Welsh]

CI failing, looks like the config from #578 has already been applied. Best path forward is probably to merge #578 then rebase this branch