rusackas opened a new pull request, #45749: URL: https://github.com/apache/superset/pull/45749
### SUMMARY Two small, unrelated things riding together: 1. Adds [@erickweon](https://github.com/erickweon) to `.github/utsc2026-students.yml`. 2. Adds six `hold:audit-*` labels to `.github/labeler.yml`, auto-applied by the existing path-based labeler (`actions/labeler`) to the same paths `.github/CODEOWNERS` currently requires specific-person review for: | Path | Label | |---|---| | `.github/**` | `hold:audit-gha` | | `scripts/**` | `hold:audit-scripts` | | `.asf.yaml` | `hold:audit-asf-yaml` | | `**/*.geojson`, `**/*.ipynb`, `superset-frontend/plugins/plugin-chart-country-map/**` | `hold:audit-maps` | | extensions surface (4 paths - see `labeler.yml`) | `hold:audit-extensions` | | `superset/config.py` | `hold:audit-config` | Combined with the existing `no-hold-label.yml` required check, any `hold:*` label blocks merge until someone removes it - the same mechanism `hold:sip!` already uses. The intent is for these to eventually replace the matching `CODEOWNERS` entries, which currently gate merge via GitHub's native "require code owner review" instead. **`CODEOWNERS` is deliberately NOT touched in this PR.** The labeler only re-evaluates on `opened`/`synchronize`/`reopened`, so an already-open PR that touches one of these paths won't pick up its `hold:audit-*` label until its next push. Flipping both mechanisms in the same PR would leave those PRs with neither gate for a while. Plan: 1. Merge this PR - new and updated PRs start getting labeled immediately. 2. Manual one-time backfill: label any currently-open PR that already touches one of these paths. 3. Separate follow-up PR deletes the now-redundant `CODEOWNERS` entries. The six `hold:audit-*` labels already exist in the repo's label list (created ahead of this PR, since `actions/labeler` can't apply a label that doesn't exist yet - same gotcha #45656 hit for `utsc2026`). One tradeoff worth flagging: `CODEOWNERS` + `require_code_owner_reviews` requires an *approval* from one of the specifically-named people. `no-hold-label.yml` just requires the label to be *absent* - it doesn't check who removed it, so anyone with write access can clear it, not only the people currently named in `CODEOWNERS` for that path. For `.github/` and `scripts/` specifically (flagged as supply-chain-risk paths), that's a real loosening of who can clear the gate, even though ASF write access is already restricted to vetted committers. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A ### TESTING INSTRUCTIONS 1. Open a PR touching e.g. `.asf.yaml` and confirm it gets `hold:audit-asf-yaml`. 2. Confirm the PR's checks include a failing `check-hold-label` while the label is present. 3. Remove the label and confirm `check-hold-label` passes (and cancelled CI re-runs, per `hold-label-ci-gate.yml`). 4. Push a new commit to the same PR and confirm the label reapplies (path still in diff). ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
