comphead opened a new pull request, #7540: URL: https://github.com/apache/datafusion-comet/pull/7540
## Which issue does this PR close? N/A. No issue filed. This ports the committer bypass apache/iceberg-rust added in apache/iceberg-rust#3459, apache/iceberg-rust#3458 and apache/iceberg-rust#3481. ## Rationale for this change Today nothing reaches `main` except through the merge queue, and only ASF Infra (`apache/root`) can bypass it. That leaves no fast path for an urgent, approved fix, for example a security fix, or the fix for a queue that evicts every entry for a reason outside the PR. That happened on 2026-11-06, when GitHub retired the `macos-14` runner image. It also means a required context that never reports blocks every merge, including the one that would fix `.asf.yaml`, until Infra steps in. iceberg-rust solved this with a ruleset bypass for a public committer team. This PR does the same for Comet with `apache/datafusion-public`. ## What changes are included in this PR? `.asf.yaml`: | Ruleset | Rules | Who can bypass | |---|---|---| | `Default Branch Protection` (new) | 1 approving review, no force push, no deletion | `apache/root` | | `Merge Queue` | merge queue, plus `Required Checks` (moved here from classic protection) | `apache/root`, `apache/datafusion-public` with `bypass_mode: pull_request` (new) | - `main` is removed from `protected_branches`, and the release branches keep their entries. iceberg-rust found that GitHub refuses a ruleset bypass while classic protection exists on the branch, even on an approved PR with green checks (`DIRECT_MERGE: BLOCKED`, apache/iceberg-rust#3481). asfyaml removes classic protection from branches no longer listed, so only `main` changes. - `Default Branch Protection` carries the rules classic protection gave `main`. Classic protection blocked force pushes and deletion implicitly, so the ruleset lists them. It sets no `required_linear_history`, same as today. Squash is the only merge method anyway. - `strict_required_status_checks_policy: false` keeps today's behavior. PR branches need not be up to date, because the queue tests against the latest `main`. - `apache/datafusion-public` (team id `19468222`) is the public team DataFusion committers opt into through Boxer. Secret teams such as `datafusion-committers` cannot be bypass actors. `pull_request` mode allows the bypass only through a PR, never a direct push. Because of the `Default Branch Protection` ruleset, a bypass merge still needs an approval. `dev/ci/check-ci-config.py`: `asf_required_contexts()` now reads the `- context:` entries under `rulesets:`. It used to read `protected_branches.main`, so without this change it would have silently stopped checking the context. A new check fails if `main` reappears under `protected_branches`, since that would quietly disable the bypass. Docs: a "Merging an urgent pull request" section in `docs/source/contributor-guide/ci.md`. The "Branch protection" section of `.github/workflows/README.md` now describes the two rulesets. `release_process.md` no longer shows a `main:` entry, and the "needs an INFRA ticket" comments are updated. To merge an urgent PR, a committer joins `apache/datafusion-public` once, gets the PR approved, removes it from the queue, and runs `gh pr merge <number> --squash --admin`. ### For discussion before this leaves draft - `apache/datafusion-public` is shared by every DataFusion repository, so any DataFusion committer who joins can bypass on Comet. Comet committers are DataFusion committers, so this matches iceberg-rust's setup with `iceberg-public`, but the PMC should agree to it. - `main` changes from classic protection to rulesets in one asfyaml run. I have not checked the order in which asfyaml applies `protected_branches` and `rulesets`. If the ruleset step failed after the classic step, `main` would be left with only the `Merge Queue` ruleset, which has no review requirement. iceberg-rust made the same switch in one PR (apache/iceberg-rust#3481) without trouble. Splitting this PR is the cautious alternative. ## How are these changes tested? - `python3 dev/ci/check-ci-config.py` passes. With a `main:` entry added back under `protected_branches`, it fails with the new message. - I ran both rulesets through asfyaml's own `normalize_rulesets` and `ensure_no_copilot_overlap` (from `apache/infrastructure-asfyaml`, with GitHub lookups stubbed out). They produce the expected Rulesets API payloads. After merge, these should hold. This is unverified until then. ```sh gh api repos/apache/datafusion-comet/branches/main --jq .protection.enabled # false gh api repos/apache/datafusion-comet/rulesets --jq '.[].name' # includes Default Branch Protection gh api repos/apache/datafusion-comet/rulesets/22969349 --jq .current_user_can_bypass # pull_requests_only for a datafusion-public member gh api repos/apache/datafusion-comet/branches/branch-1.2 --jq .protected # still true ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
