Note that the ASF's policy is actually from a security perspective, as commits can potentially exfiltrate secrets or run malicious jobs. With AI it is easier than ever for a motivated attacker to put in legitimate patches before acting. See the xz hack for an extreme example of this behavior. In that sense I don't think clearing the "first time conributor" bar is enough to warrant access to ASF CI resources.
I actually think we should push for less CI running in the main apache repo anyways. The apache repo is where it costs the ASF money. CI running on the contributor's fork is identical to upstream and only one extra click away for reviewers. Regardless of committership it would be nice if we had a way to prevent any CI from running in apache until PRs are approved, relying only on the fork's CI during the review process. If github doesn't support this OOTB we could probably create a label and job that handles it. Draft mode is a workaround because it also communicates that a PR is not ready for broad review. Ethan On Sun, Aug 2, 2026 at 5:07 AM Attila Doroszlai <[email protected]> wrote: > > We could improve the documentation on this in the contributing guide > (make > > these points explicit that the contributors can check their forked CI for > > status) > > It is already documented: > > https://github.com/apache/ozone/blob/a481e65272a67182c812e4c042a4518a2a638df2/CONTRIBUTING.md#contribute-your-modifications > > > and the same could be attached to the PR (probably a description on the > PR > > template saying edit and attach forked CI status if applicable?) > > Agree, the PR template should be improved. > > -Attila > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
