potiuk commented on PR #77074: URL: https://github.com/apache/airflow/pull/77074#issuecomment-6868738735
Sandbox-tested with the asfyaml sandbox workflow, using the parser at [`e4c2644`](https://github.com/apache/infrastructure-asfyaml/commit/e4c2644ca10f37dd35bd11ce71d49d22546eb146), the commit production gitbox is pinned to. The sandbox was `potiuk/infrastructure-asfyaml-sandbox`, with the config on its `main`. Its `.asf.yaml` was Airflow's `meta`, `protected_branches`, `rulesets` and `creation_cap`, copied from this PR's parent commit (before) and head (after). Only the bypass users were swapped for test accounts. Every "after" value below was read back from the GitHub API, not taken from the log. | Row | Config | Legacy protection on `main` | Rules on `main` | Bypass list | Run | |---|---|---|---|---|---| | A: `main` today | legacy `protected_branches.main`, `[octocat]` | linear, 1 review, conversations, no force-push | "Require CI on main" only | `[octocat]` | [run](https://github.com/potiuk/infrastructure-asfyaml/actions/runs/43534238002) | | B: this PR, noop | `protected_branches: ~`, `~DEFAULT_BRANCH`, `[octocat, hubot]` | plan: `Remove branch protection from branch 'main'` | unchanged | plan: `Adding … hubot` | [run](https://github.com/potiuk/infrastructure-asfyaml/actions/runs/43534618111) | | B: this PR, live | same | **removed** (`404 Branch not protected`) | "Branch protection" (linear history, 1 review, thread resolution, no deletion/force-push) + "Require CI on main" | `[hubot, octocat]` | [run](https://github.com/potiuk/infrastructure-asfyaml/actions/runs/43534897201) | | C: re-run | same | no call made | unchanged | `already up to date` | [run](https://github.com/potiuk/infrastructure-asfyaml/actions/runs/43535059286) | In row B the bypass list changed in the same run that removed the legacy protection. So with this change, the cap step runs after branch protection instead of being cut off by it. After the migration the "Branch protection" ruleset reads `enforcement: active` and `include: ["~DEFAULT_BRANCH", …]`. Row C shows the next run doesn't touch the legacy protection endpoint at all. Not covered: - **The 502 itself.** The sandbox can't reproduce GitHub's 502 on `apache/airflow`'s `branches/main/protection`. If the DELETE of the legacy rule also gets a 502 in production, the first run after merge will still fail. Infra can remove that rule by hand. - **`previous_yaml`.** It is empty in every sandbox run. That doesn't matter here: with `protected_branches: ~` present, the directive runs without the cache. Sandbox reset afterwards and confirmed through the API: baseline `.asf.yaml`, no rulesets, no branch protection, cap off, empty bypass list. --- Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
