400Ping opened a new pull request, #1517:
URL: https://github.com/apache/mahout/pull/1517
## Why
GitHub auto-merge only waits for *required* status checks. On `main` the only
required check is `Committer approval`, so a committer/PMC member who enables
auto-merge gets the PR merged as soon as that check passes, even when
pre-commit, Python Testing, etc. fail afterwards.
Making the CI jobs themselves required is not what we want either: branch
protection applies to manual merges too, and committers must still be able to
merge a PR manually when they judge a failure acceptable. PMC members also
need
a way to merge urgent PRs immediately, e.g. when the ASF runner queue is
stuck
and no check can run at all.
## What
**1. `Auto-merge gate` required status check**
(`.github/workflows/automerge-gate.yml` +
`.github/scripts/automerge_gate.py`),
re-evaluated every time a `pull_request` workflow of the PR finishes:
- While any CI workflow is still running: the gate is red ("waiting"), so
auto-merge cannot fire early.
- All CI workflows passed or skipped: the gate passes; auto-merge (if
enabled)
merges.
- Any CI workflow failed: the gate **disables auto-merge** on the PR, leaves
a
comment, then passes. The PR is not merged automatically, but a committer
can still merge it manually. Auto-merge is never re-enabled automatically.
CI jobs stay non-required. The workflow only ever checks out the default
branch script; no PR code is executed.
**2. `main` ruleset with PMC bypass** (`.asf.yaml`, raw Rulesets payload).
Same rules as the classic protection (linear history, no deletion/force push,
pull request required, required checks `Committer approval` + `Auto-merge
gate`), plus `bypass_actors`: the PMC members of `.github/pmc-members.txt` by
GitHub user id, `bypass_mode: pull_request`. A PMC member then gets "Merge
without waiting for requirements to be met (bypass rules)" on any PR. They
still have to go through a PR and every bypass lands in the audit log. Only
rulesets support bypass actors; `.asf.yaml` convenience syntax only takes
teams and the ASF org has no (non-secret) PMC team for Mahout, hence raw
payload with user ids.
Auto-merge is not affected by bypass: it keeps waiting for the required
checks, so the gate above still applies to it.
**Migration note:** the classic `protected_branches` block is kept in this
PR.
GitHub applies the most restrictive of classic protection and rulesets, so
the
bypass only becomes effective after a follow-up PR removes the classic block,
once we have confirmed that the ruleset was created
(`gh api repos/apache/mahout/rulesets`).
Docs updated in `docs/community/pr-policy-and-review-guidelines.md`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
