sadpandajoe commented on code in PR #45749: URL: https://github.com/apache/superset/pull/45749#discussion_r4395856530
########## AGENTS.md: ########## @@ -95,6 +95,17 @@ Automated scanners (LLM-based code scanners, static analyzers, dependency tools) Findings that cannot identify both should be filed as questions, not vulnerabilities. This requirement exists to ensure every reported issue is testable against the published security model and to keep speculative or pattern-match-only reports out of the triage queue. +## Hold Labels for Sensitive Paths + +A PR touching certain paths is automatically tagged with a `hold:audit-*` label (see `.github/labeler.yml`) and blocked from merging (`no-hold-label.yml` fails while any `hold:*` label is present) until a reviewer removes it. Removing the label is an explicit acknowledgment that the specific risk below was checked and is either not present or has been addressed - not a formality to clear once the rest of the review looks fine. Review Comment: Neither path holds the merge while the label is on. The labeler adds labels with `GITHUB_TOKEN`, and events created that way don't trigger other workflows, so `hold-label-ci-gate.yml` never sees `labeled` for an auto-applied `hold:audit-*`. And when a person applies it, any later push finds the label already present, so no new `labeled` event cancels the new head's CI; the required checks go green while `check-hold-label` fails but isn't required. Should `check-hold-label` be added to `required_status_checks` in `.asf.yaml` (and this line reworded) rather than relying on cancellation? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
