This is an automated email from the ASF dual-hosted git repository. github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-3481-1be091a2135a5908537a5b45786ae7207a723aab in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git
commit 0a345f202d9233481884f0d7a3ae3a4b6181044b Author: Kevin Liu <[email protected]> AuthorDate: Mon Oct 19 23:53:31 2026 +0000 ci: replace classic branch protection with a ruleset so the bypass works (#3481) * ci: move branch protection into the Merge Queue ruleset Classic branch protection can only be bypassed by admins, and while it exists GitHub blocks direct merges for the ruleset's bypass actors even when every requirement is met. Move the approval, linear-history, deletion and force-push rules into the Merge Queue ruleset and disable classic protection, as apache/seatunnel does, so iceberg-public members can use the breakglass. Requirements are otherwise unchanged. Co-authored-by: Copilot App <[email protected]> * ci: keep the approval rule out of the bypassable ruleset Put deletion, force-push, linear-history and approval rules in a separate Branch Protection ruleset that only apache/root can bypass, so the iceberg-public breakglass skips only the merge queue and required checks. Co-authored-by: Copilot App <[email protected]> * ci: use infra's default branch protection ruleset template Co-authored-by: Copilot App <[email protected]> * ci: keep dismiss_stale_reviews explicit Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Copilot App <[email protected]> --- .asf.yaml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 2b3dd9295..fbdde3222 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -33,14 +33,24 @@ github: squash_commit_message: PR_TITLE_AND_COMMIT_DETAILS merge: false rebase: false - protected_branches: - main: + # Disabled: GitHub blocks ruleset bypass while classic protection exists. + # The "Default Branch Protection" ruleset replaces it. + protected_branches: ~ + rulesets: + - name: "Default Branch Protection" + type: branch + branches: + includes: + - "~DEFAULT_BRANCH" + excludes: [] + bypass_teams: + - root + restrict_deletion: true + restrict_force_push: true + required_linear_history: true required_pull_request_reviews: required_approving_review_count: 1 dismiss_stale_reviews: false - - required_linear_history: true - rulesets: - name: Merge Queue target: branch enforcement: active
