mengw15 commented on code in PR #8379:
URL: https://github.com/apache/texera/pull/8379#discussion_r3935779982
##########
.github/workflows/required-checks.yml:
##########
@@ -22,6 +22,9 @@ on:
branches:
- 'main'
- 'release/**'
+ # The backport fast path pushes release branches with GITHUB_TOKEN, which
+ # starts no push-triggered runs; it dispatches this workflow instead.
+ workflow_dispatch:
Review Comment:
Right — and the trigger already existed at the bottom of the block, so the
insertion was a pure duplicate. Reverted in 1864bdac7, with the comment moved
to the existing key. 711265ba5 adds a strict-loader parse of .asf.yaml and
every workflow to the glob-discovered infra tests, so the next duplicate key
fails the PR's CI instead of the workflow at startup.
##########
.github/workflows/direct-backport-push.yml:
##########
@@ -571,6 +573,17 @@ jobs:
log "new_sha=${new_sha}"
echo "new_sha=${new_sha}" >> "$GITHUB_OUTPUT"
+ - name: Run Required Checks on the pushed release branch
Review Comment:
Fixed in 1864bdac7: the dispatch is best-effort — a failure emits a warning
naming the manual fallback instead of failing the job, so the failure reporter
can no longer contradict a landed push.
##########
.github/workflows/direct-backport-push.yml:
##########
@@ -571,6 +573,17 @@ jobs:
log "new_sha=${new_sha}"
echo "new_sha=${new_sha}" >> "$GITHUB_OUTPUT"
+ - name: Run Required Checks on the pushed release branch
+ if: success()
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ TARGET_BRANCH: ${{ matrix.target }}
+ run: |
+ # The GITHUB_TOKEN push above starts no push-triggered workflows;
+ # dispatch the run the release branch would otherwise have gotten.
+ gh workflow run required-checks.yml \
+ --repo "${GITHUB_REPOSITORY}" --ref "refs/heads/${TARGET_BRANCH}"
Review Comment:
Bare branch name in 1864bdac7.
##########
.asf.yaml:
##########
@@ -69,20 +69,76 @@ github:
rebase: false
rulesets:
- - name: Merge Queue
+ # Rule-for-rule identical to "Merge Queue" below; split out so the bypass
+ # here stays off main. The bypass exempts actions performed as the GitHub
+ # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what
+ # direct-backport-push.yml's fast path pushes with (#8377). It cannot be
+ # scoped to a single workflow. People and PATs still face every rule.
+ #
+ # Listed BEFORE "Merge Queue" deliberately: asfyaml applies rulesets in
+ # file order, so this one is created before that one stops covering the
+ # release branches. If GitHub rejects this ruleset, the apply aborts with
+ # the old protections fully intact; the failure order never leaves the
+ # release branches uncovered.
+ - name: "Merge Queue (release)"
target: branch
enforcement: active
conditions:
ref_name:
exclude: []
include:
- - "~DEFAULT_BRANCH"
# Merge queue rules do NOT support wildcard ref patterns, so
# release branches must be listed explicitly (not release/*).
# Add each release line here as it is cut.
- "refs/heads/release/v1.1"
- "refs/heads/release/v1.2"
- "refs/heads/release/v1.3"
+ bypass_actors:
+ # The GitHub Actions app.
+ - actor_id: 15368
+ actor_type: Integration
+ bypass_mode: always
+ rules:
Review Comment:
CI-enforced now: 711265ba5 asserts the two rules blocks stay deep-equal,
with a failure message that says change both or neither.
##########
.github/workflows/direct-backport-push.yml:
##########
@@ -22,7 +22,8 @@ on:
- main
permissions:
- actions: read
+ # write: the fast path dispatches Required Checks after its push (below).
+ actions: write
Review Comment:
Scoped in 1864bdac7: the workflow returns to actions: read, and
push-backports carries a job-level block naming exactly what its steps call.
##########
.asf.yaml:
##########
@@ -69,20 +69,76 @@ github:
rebase: false
rulesets:
- - name: Merge Queue
+ # Rule-for-rule identical to "Merge Queue" below; split out so the bypass
Review Comment:
The dispatch mechanism is the documented GITHUB_TOKEN exception
("workflow_dispatch and repository_dispatch events always create workflow
runs"), and after 1864bdac7 a surprise there degrades to a warning rather than
a failed job. The .asf.yaml half only takes effect where Infra applies it — the
body's post-merge verification covers that. Happy to stage a fork demo if you'd
still like one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
