Hello everyone,

With some initial teething problems we've enabled an "experimental" feature
of "auto-merging" PRs in our repo. It should potentially help with "focus"
of maintainers, because they will not have to come-back to the PRs to merge
it once they enabled auto-merge for them.

It works in the way, that when "required status checks", "reviews" and
"resolved conversations" (the required conditions for "main" protected
branch) are not met, committer can use "Enable auto-merge" on the PR and
when all conditions are met, the PR will get merged automatically.

But after enabling it, it turns out that this has one **serious** drawback.
We currently cannot override the protection from GitHub UI, and it's not
possible to merge PR that did not pass one of the checks (So "Finalize
tests / Summarize warnings" has to complete successfully in order to be
able to merge PR,

This is quite a bit of a blocker. But not entirely, because I've learned (I
did not know it before) that we (committers) already have a way to bypass
ANY protection - by directly pushing code to main branch via gitbox URL
exposed by Apache Infrastructure:

https://gitbox.apache.org/repos/asf

Specifically - you can set this as remote
https://gitbox.apache.org/repos/asf/airflow.git - and push changes directly
to "main" branch. It will bypass any protection. You do not even need to
get a review from another maintainer (yes - I just tested it and it works).
You just need to authenticate with your apache id / password.

That is not great from a security and provenance point of view, but well,
ASF allows it for now (which is something we will have to fix eventually I
think.  It requires using git CLI/local client to push such branches and
there are some small things we have to remember (like manually adding PR #
to the branch we are pushing or not having PR# in the merged commit at all).

Certainly not as convenient as the merge button in PR - but workable if we
want to merge something quickly, regardless of the status (and apparently
regardless of review / approval which is a bummer).

I  left it enabled for a moment - the weekend maximum and maybe beginning
of Monday and would love to hear what you think.

J.

Reply via email to