mikebridge opened a new pull request, #42800:
URL: https://github.com/apache/superset/pull/42800
> **DRAFT — do not merge yet.** Blocked on #42641 and #42642 (both FR-010
preconditions, both out of draft and awaiting review). Opened early so the diff
and the operator guidance can be reviewed in parallel.
### SUMMARY
Flips the two soft-delete release defaults for general availability:
| Setting | Before | After |
|---|---|---|
| `SOFT_DELETE` | `False` | **`True`** |
| `SOFT_DELETE_PURGE_DRY_RUN` | `True` | **`False`** |
Deleting a dashboard, chart, or dataset now **archives** it rather than
removing it — hidden from normal listings, recoverable from **Recently
Archived** (#41550), and permanently removed once `SOFT_DELETE_RETENTION_DAYS`
(default 30) elapses. The nightly `deletion_retention.purge_soft_deleted` task
deletes for real instead of only logging `would_purge` counts, which makes the
retention promise in the docs true on a stock deployment.
**Both switches are retained, deliberately.** `SOFT_DELETE = False` restores
hard-delete behaviour; `SOFT_DELETE_PURGE_DRY_RUN = True` suspends purging
without a redeploy. The hard-delete fallback branch and the tests covering
*both* flag states stay in place and keep passing — the way back is only real
if it stays exercised. Removing the toggle is deliberately a separate, later
change (sc-115600), not part of this one.
**Scope: soft delete only.** The versioning flips (`VERSION_HISTORY`,
`ENABLE_VERSIONING_CAPTURE`) are a separate branch. They answer to a different
gate — a SIP-210 [VOTE] rather than the internal determination behind this one
— so the two are kept independently reviewable, independently shippable, and
independently revertible.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — configuration defaults. The UI this enables (Recently Archived,
restore, permanent delete) shipped in #41550 and is unchanged here.
### TESTING INSTRUCTIONS
Exactly one test in the unit suite changes behaviour under the flip, and it
is the deliberate guard: `test_default_config_is_safe` asserted the pre-flip
posture. It is superseded by
`test_default_config_purges_for_real_after_the_retention_window`, which pins
the new defaults and records why dry-run was the introducing release's choice.
Verified before pushing:
- full `tests/unit_tests` run — the flip breaks **only** that one test (the
24 firebolt SQL-dialect failures in that run are a different subsystem,
unrelated and pre-existing)
-
`tests/unit_tests/{tasks/test_deletion_retention,config_test,views/test_soft_delete_filter,daos/test_base_dao_soft_delete,models/test_soft_delete_mixin}.py`
— 66/66
- `tests/integration_tests/deletion_retention/purge_tests.py` — 24/24,
including the `dry_run=True` behavioural coverage that proves the retained
lever still suppresses deletion
- `pre-commit run` green; `docs/static/feature-flags.json` regenerated by
the docs-sync hook
Manual: with default config, delete a chart — it disappears from the list
and appears under **Recently Archived**, recoverable. Set `FEATURE_FLAGS =
{"SOFT_DELETE": False}` and delete another — it is removed outright, as before.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [x] Required feature flags: `SOFT_DELETE` (this changes its default; the
flag itself is retained)
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
**`UPDATING.md`** gains a breaking-change entry covering what changes and
two things operators should do first:
- **Size the first live purge.** The first real run removes everything that
aged past the retention window since soft delete began capturing — on a busy
deployment, potentially a large batch in a single window. Set
`SOFT_DELETE_PURGE_DRY_RUN = True`, read the `would_purge` counts from one
nightly run, then set it back.
- **Check a replaced `CELERY_CONFIG`.** A deployment that redefines rather
than inherits it must carry both `superset.tasks.deletion_retention` in
`imports` and the beat entry. #42641 adds a startup warning naming whichever is
absent — which is why it gates this PR.
It also states the caveat plainly: turning soft delete back **off
resurrects** objects archived while it was on, because those rows were never
removed. That is an emergency stop, not a clean rollback, and operators should
know it before they need it.
**Dependencies:**
- #42641 — beat-schedule startup warning (FR-010 precondition)
- #42642 — sc-112173 no-op migration fix (FR-010 precondition)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
