sadpandajoe commented on code in PR #45749: URL: https://github.com/apache/superset/pull/45749#discussion_r4384665403
########## AGENTS.md: ########## @@ -95,6 +95,17 @@ Automated scanners (LLM-based code scanners, static analyzers, dependency tools) Findings that cannot identify both should be filed as questions, not vulnerabilities. This requirement exists to ensure every reported issue is testable against the published security model and to keep speculative or pattern-match-only reports out of the triage queue. +## Hold Labels for Sensitive Paths + +A PR touching certain paths is automatically tagged with a `hold:audit-*` label (see `.github/labeler.yml`) and blocked from merging (`no-hold-label.yml` fails while any `hold:*` label is present) until a reviewer removes it. Removing the label is an explicit acknowledgment that the specific risk below was checked and is either not present or has been addressed - not a formality to clear once the rest of the review looks fine. Review Comment: This says a PR touching these paths is "blocked from merging" while a `hold:audit-*` label is present, but `check-hold-label` isn't in the `required_status_checks` contexts in `.asf.yaml` (and `gh pr checks --required` doesn't list it). As written, a PR that still carries `hold:audit-config` could get its code-owner approval, pass the required checks, and merge with the hold check red. Is the check required via a ruleset I can't see, or does it need adding to `.asf.yaml` (or the wording softened) before CODEOWNERS is dropped? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
