Yicong-Huang commented on code in PR #8379:
URL: https://github.com/apache/texera/pull/8379#discussion_r3936582960
##########
.asf.yaml:
##########
@@ -69,20 +69,76 @@ github:
rebase: false
rulesets:
- - name: Merge Queue
+ # Rule-for-rule identical to "Merge Queue" below; split out so the bypass
+ # here stays off main. The bypass exempts actions performed as the GitHub
+ # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what
+ # direct-backport-push.yml's fast path pushes with (#8377). It cannot be
+ # scoped to a single workflow. People and PATs still face every rule.
+ #
+ # Listed BEFORE "Merge Queue" deliberately: asfyaml applies rulesets in
+ # file order, so this one is created before that one stops covering the
+ # release branches. If GitHub rejects this ruleset, the apply aborts with
+ # the old protections fully intact; the failure order never leaves the
+ # release branches uncovered.
+ - name: "Merge Queue (release)"
target: branch
enforcement: active
conditions:
ref_name:
exclude: []
include:
- - "~DEFAULT_BRANCH"
# Merge queue rules do NOT support wildcard ref patterns, so
# release branches must be listed explicitly (not release/*).
# Add each release line here as it is cut.
- "refs/heads/release/v1.1"
- "refs/heads/release/v1.2"
- "refs/heads/release/v1.3"
+ bypass_actors:
+ # The GitHub Actions app.
+ - actor_id: 15368
+ actor_type: Integration
+ bypass_mode: always
+ rules:
Review Comment:
Reopening the loop rather than closing it: the assertion is in the tree and
`build.yml:1303` does discover it, but it never reaches line 85 in CI — `import
yaml` at `.github/scripts/test_asf_rulesets.sh:40` raises `ModuleNotFoundError`
first, on both runner OSes (jobs `101089886899`, `101089886957`). Until PyYAML
is pinned, the two `rules:` blocks are still unguarded.
Separately, the check compares `main_rs["rules"] != release_rs["rules"]` and
nothing else. The invariant this split exists for — `Merge Queue` carrying no
`bypass_actors` — is not asserted, so an edit that copies the bypass onto
`main` keeps both `rules:` blocks equal and still prints `OK`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
