use rulesets in the rust repo

Author: marcoieni

config.toml

@@ -87,4 +87,5 @@ enable-rulesets-repos = [
    "rust-lang/cargo",
    "rust-lang/crates.io",
    "rust-lang/rustfmt",
+   "rust-lang/rust",
 ]

repos/rust-lang/rust.toml

@@ -27,64 +27,102 @@ style = "write"
 types = "write"
 triage = "write"
 
+# Only `bors` can push to `main`
 [[branch-protections]]
+name = "main"
 pattern = "main"
 allowed-merge-apps = ["bors"]
+prevent-update = true
 
+# No one can force push to main
 [[branch-protections]]
+name = "main - force-push"
+pattern = "main"
+
+# Only `bors` and `promote-release` can push to `stable`
+[[branch-protections]]
+name = "stable"
 pattern = "stable"
-allowed-merge-apps = ["bors"]
+allowed-merge-apps = ["bors", "promote-release"]
+prevent-update = true
 
+# Only `promote-release` can force-push to `stable`
 [[branch-protections]]
+name = "stable - force-push"
+pattern = "stable"
+allowed-merge-apps = ["promote-release"]
+
+# Only `bors` and `promote-release` can push to `beta`
+[[branch-protections]]
+name = "beta"
 pattern = "beta"
-allowed-merge-apps = ["bors"]
+allowed-merge-apps = ["bors", "promote-release"]
+prevent-update = true
+
+# Only `promote-release` can force-push to `beta`
+[[branch-protections]]
+name = "beta - force-push"
+pattern = "beta"
+allowed-merge-apps = ["promote-release"]
 
 [[branch-protections]]
 pattern = "*"
+allowed-merge-apps = ["promote-release"]
+prevent-deletion = false
+prevent-update = true
 
 [[branch-protections]]
 pattern = "*/**/*"
 pr-required = false
+prevent-update = true
+prevent-deletion = false
 
 [[branch-protections]]
 pattern = "cargo_update"
 pr-required = false
+prevent-deletion = false
 
 # Required for running try builds created by bors.
 # Must support force-pushes.
 [[branch-protections]]
 pattern = "automation/bors/try"
 allowed-merge-apps = ["bors"]
+prevent-update = true
 
 # Required for running try builds created by bors.
 # Must support force-pushes.
 [[branch-protections]]
 pattern = "automation/bors/try-merge"
 allowed-merge-apps = ["bors"]
+prevent-update = true
 
 # Required for running auto builds created by bors.
 # Must support force-pushes.
 [[branch-protections]]
 pattern = "automation/bors/auto"
 allowed-merge-apps = ["bors"]
+prevent-update = true
 
 # Required for running auto builds created by bors.
 # Must support force-pushes.
 [[branch-protections]]
 pattern = "automation/bors/auto-merge"
 allowed-merge-apps = ["bors"]
+prevent-update = true
 
 # Required for unrolled PR builds created by perfbot.
 # Must support force-pushes.
 [[branch-protections]]
 pattern = "try-perf"
 allowed-merge-apps = ["rust-timer"]
+prevent-update = true
 
 # Required for unrolled PR builds created by perfbot.
 # Must support force-pushes.
 [[branch-protections]]
 pattern = "perf-tmp"
 allowed-merge-apps = ["rust-timer"]
+prevent-update = true
 
 [environments.bors]
 branches = ["automation/bors/auto", "automation/bors/try", "try-perf"]

src/validate.rs

@@ -1150,12 +1150,21 @@ fn validate_branch_protections(data: &Data, errors: &mut Vec<String>) {
 
     wrapper(data.repos(), errors, |repo, _| {
         let bors_configured = repo.bots.iter().any(|b| matches!(b, Bot::Bors));
-        let mut patterns = HashSet::new();
+        let mut pattern_counts = HashMap::new();
 
         for protection in &repo.branch_protections {
-            if !patterns.insert((protection.target, &protection.pattern)) {
+            *pattern_counts
+                .entry((protection.target, protection.pattern.as_str()))
+                .or_insert(0usize) += 1;
+        }
+
+        for protection in &repo.branch_protections {
+            let key = (protection.target, protection.pattern.as_str());
+            if pattern_counts.get(&key).copied().unwrap_or_default() > 1
+                && protection.name.is_none()
+            {
                 bail!(
-                    r#"repo '{}' uses multiple {:?} protections with the pattern `{}`"#,
+                    r#"repo '{}' uses multiple {:?} protections with the pattern `{}`; when multiple protections share the same target and pattern, each protection must specify `name`"#,
                     repo.name,
                     protection.target,
                     protection.pattern,