Yicong-Huang commented on code in PR #8379: URL: https://github.com/apache/texera/pull/8379#discussion_r3936640964
########## .github/scripts/test_asf_rulesets.sh: ########## @@ -0,0 +1,96 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Invariants over the CI configuration that a plain YAML parse cannot see. +# +# 1. "Merge Queue" and "Merge Queue (release)" in .asf.yaml must carry +# identical rules: they are one policy split across two rulesets only so +# the release half can hold an Actions bypass that must not reach main. +# Nothing else keeps the copies from drifting apart. +# 2. .asf.yaml and every workflow must parse with a duplicate-key-strict +# loader. PyYAML silently keeps the last duplicate, but GitHub's loader +# rejects the file, so a duplicated trigger key passes local checks and +# then stops the workflow from ever starting. + +set -uo pipefail + +command -v python3 >/dev/null || { echo "python3 is required to run these tests" >&2; exit 1; } + +cd "$(git rev-parse --show-toplevel)" + +python3 - <<'EOF' +import glob +import sys + +import yaml Review Comment: **Must fix:** PyYAML is not installed in the job that runs this script. `build.yml:1303` auto-discovers it under `set -e`, and that job's only Python install is `amber/dev-requirements.txt` (`build.yml:1290`), which pins no PyYAML. Both infra legs on this head print `ModuleNotFoundError: No module named 'yaml'` right after `==> .github/scripts/test_asf_rulesets.sh` (jobs `101089886899`, `101089886957`). That fails `infra` → `build` → the `Required Checks` context both rulesets require, so the PR is blocked again — same end-state as the duplicate `on:` key, different route. The constraint is already in the tree at `.github/scripts/release_branches.py:19-20` ("GitHub runners have python3 but not necessarily PyYAML"), which is why that file hand-parses YAML. Here a real loader is the whole point, so pin PyYAML in `amber/dev-requirements.txt` instead; its header notes dev deps install after the LICENSE-binary snapshot, so the pin needs no tracking. It also means "verified red before trusting the green" holds only locally — CI never reached the green path. ########## .github/workflows/direct-backport-push.yml: ########## @@ -342,6 +342,15 @@ jobs: needs: discover if: ${{ needs.discover.outputs.has_push == 'true' }} runs-on: ubuntu-latest + permissions: + # Everything this job's steps call, and nothing more: push the + # cherry-pick and comment on the commit (contents), dispatch Required + # Checks (actions), per-target commit status (statuses), annotate the + # original PR (issues). Review Comment: **Advisory:** The list reads as three verb phrases and one bare noun phrase, so the third item does not parse with the rest. ```suggestion # Checks (actions), set the per-target commit status (statuses), # annotate the original PR (issues). ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
