rusackas commented on code in PR #45749: URL: https://github.com/apache/superset/pull/45749#discussion_r4395595387
########## AGENTS.md: ########## @@ -95,6 +95,17 @@ Automated scanners (LLM-based code scanners, static analyzers, dependency tools) Findings that cannot identify both should be filed as questions, not vulnerabilities. This requirement exists to ensure every reported issue is testable against the published security model and to keep speculative or pattern-match-only reports out of the triage queue. +## Hold Labels for Sensitive Paths + +A PR touching certain paths is automatically tagged with a `hold:audit-*` label (see `.github/labeler.yml`) and blocked from merging (`no-hold-label.yml` fails while any `hold:*` label is present) until a reviewer removes it. Removing the label is an explicit acknowledgment that the specific risk below was checked and is either not present or has been addressed - not a formality to clear once the rest of the review looks fine. Review Comment: Good catch on the wording. `check-hold-label` itself isn't required, but `hold-label-ci-gate.yml` cancels all in-flight runs when a `hold*` label is applied, so the required checks never go green until it's removed (and it re-runs them on unlabel). So the block is real, just indirect. @sadpandajoe want me to reword it to say that, or add `check-hold-label` to `.asf.yaml` as well? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
