mengw15 commented on code in PR #8379:
URL: https://github.com/apache/texera/pull/8379#discussion_r3926197342
##########
.asf.yaml:
##########
@@ -76,13 +76,63 @@ github:
ref_name:
exclude: []
include:
+ # Release branches carry these same rules in "Merge Queue
+ # (release)" below — a separate ruleset because its Actions
+ # bypass must not extend to main.
- "~DEFAULT_BRANCH"
+ rules:
+ - type: deletion
+ - type: non_fast_forward
+ - type: merge_queue
+ parameters:
+ merge_method: SQUASH
+ max_entries_to_build: 2
+ min_entries_to_merge: 2
+ max_entries_to_merge: 5
+ min_entries_to_merge_wait_minutes: 3
+ grouping_strategy: HEADGREEN
+ check_response_timeout_minutes: 45
+ - type: pull_request
+ parameters:
+ allowed_merge_methods:
+ - squash
+ dismiss_stale_reviews_on_push: false
+ require_code_owner_review: false
+ require_last_push_approval: false
+ required_approving_review_count: 1
+ required_review_thread_resolution: true
+ - type: required_linear_history
+ - type: required_status_checks
+ parameters:
+ strict_required_status_checks_policy: false
+ required_status_checks:
+ - context: Required Checks
+ - context: Check License Headers
+ - context: Validate PR title
+
+ # Rule-for-rule identical to "Merge Queue" above; split out so the bypass
+ # below stays off main. The bypass exempts actions performed as the GitHub
+ # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what
+ # direct-backport-push.yml's fast path pushes with (#8377). It cannot be
+ # scoped to a single workflow. People and PATs still face every rule.
+ - name: "Merge Queue (release)"
+ target: branch
+ enforcement: active
+ conditions:
+ ref_name:
+ exclude: []
+ include:
# Merge queue rules do NOT support wildcard ref patterns, so
# release branches must be listed explicitly (not release/*).
# Add each release line here as it is cut.
- "refs/heads/release/v1.1"
- "refs/heads/release/v1.2"
- "refs/heads/release/v1.3"
+ bypass_actors:
+ # The GitHub Actions app.
+ - actor_id: 15368
+ actor_type: Integration
+ bypass_mode: always
Review Comment:
Right — the PAT has authenticated that push since #4676, and every
pre-ruleset direct push shows a person as the pusher. Fixed in 582d9f626: the
push job now checks out with the default GITHUB_TOKEN so the Actions-app bypass
covers the push, and the release-branch CI the PAT existed to retrigger is
dispatched explicitly (workflow_dispatch is the documented exception a
GITHUB_TOKEN may create).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
