mengw15 commented on code in PR #8379: URL: https://github.com/apache/texera/pull/8379#discussion_r3936681330
########## .github/scripts/test_asf_rulesets.sh: ########## @@ -0,0 +1,96 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Invariants over the CI configuration that a plain YAML parse cannot see. +# +# 1. "Merge Queue" and "Merge Queue (release)" in .asf.yaml must carry +# identical rules: they are one policy split across two rulesets only so +# the release half can hold an Actions bypass that must not reach main. +# Nothing else keeps the copies from drifting apart. +# 2. .asf.yaml and every workflow must parse with a duplicate-key-strict +# loader. PyYAML silently keeps the last duplicate, but GitHub's loader +# rejects the file, so a duplicated trigger key passes local checks and +# then stops the workflow from ever starting. + +set -uo pipefail + +command -v python3 >/dev/null || { echo "python3 is required to run these tests" >&2; exit 1; } + +cd "$(git rev-parse --show-toplevel)" + +python3 - <<'EOF' +import glob +import sys + +import yaml Review Comment: Pinned in 6bae0ba3d — pyyaml==6.0.3 in amber/dev-requirements.txt, following the file's existing per-dep comment style, plus a guard that names the missing dep instead of a bare import traceback. Fair hit on "verified red": this PR's own infra legs are now the first CI execution of the green path. ########## .asf.yaml: ########## @@ -69,20 +69,76 @@ github: rebase: false rulesets: - - name: Merge Queue + # Rule-for-rule identical to "Merge Queue" below; split out so the bypass + # here stays off main. The bypass exempts actions performed as the GitHub + # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what + # direct-backport-push.yml's fast path pushes with (#8377). It cannot be + # scoped to a single workflow. People and PATs still face every rule. + # + # Listed BEFORE "Merge Queue" deliberately: asfyaml applies rulesets in + # file order, so this one is created before that one stops covering the + # release branches. If GitHub rejects this ruleset, the apply aborts with + # the old protections fully intact; the failure order never leaves the + # release branches uncovered. + - name: "Merge Queue (release)" target: branch enforcement: active conditions: ref_name: exclude: [] include: - - "~DEFAULT_BRANCH" # Merge queue rules do NOT support wildcard ref patterns, so # release branches must be listed explicitly (not release/*). # Add each release line here as it is cut. - "refs/heads/release/v1.1" - "refs/heads/release/v1.2" - "refs/heads/release/v1.3" + bypass_actors: + # The GitHub Actions app. + - actor_id: 15368 + actor_type: Integration + bypass_mode: always + rules: Review Comment: Both asserted in 6bae0ba3d: any bypass_actors on "Merge Queue" fails, and the release list must be exactly the Actions app — the failure message says to widen the list and the test together. Verified red on both. ########## .github/workflows/direct-backport-push.yml: ########## @@ -342,6 +342,15 @@ jobs: needs: discover if: ${{ needs.discover.outputs.has_push == 'true' }} runs-on: ubuntu-latest + permissions: + # Everything this job's steps call, and nothing more: push the + # cherry-pick and comment on the commit (contents), dispatch Required + # Checks (actions), per-target commit status (statuses), annotate the + # original PR (issues). Review Comment: Applied verbatim. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
