potiuk opened a new pull request, #75654: URL: https://github.com/apache/airflow/pull/75654
When a committer adds `use fork ci` right after a PR opens, the PR's first `pull_request` runs were created without the label, and the workflow-run approver left them for a maintainer (`its waiting runs started before the PR was opened, retargeted or changed a label its decision depends on`) — as happened on #75634. The approver had to: when the fork CI gate could not read the PR's current labels, it fell back to the labels of the run's event, and those could still send an approved run to full project CI on code nobody had reviewed. Anyone able to exhaust the shared token quota could force that fallback. The gate now fails when it cannot read the labels instead of falling back, so a run only ever acts on the PR's current labels and re-running the gate job decides again. With that, a gated PR's runs started before `use fork ci` / `use project ci` changed are as safe to approve as later ones, and the approver no longer holds them back. A failed gate skips every project CI job and fails `CI passed (project CI not run)`, so the PR stays unmergeable until a re-run succeeds. The gate script and config are checked out from the base branch, so pending runs pick up the new behaviour as soon as this merges. A PR that changes CI definition files is still never approved automatically, since it could remove the gate. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
