Yicong-Huang commented on code in PR #8096: URL: https://github.com/apache/texera/pull/8096#discussion_r3923287218
########## .github/workflows/backport-approval-check.yml: ########## @@ -0,0 +1,340 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Blocks the merge while a `release/*` label on the PR has not been approved by +# that branch's release manager (.github/release-branches.yml). +# +# The point is that a merged PR's labels should be a truthful record. A label +# only nominates a branch, so before this check a manager declined a backport by +# staying silent — and the label stayed on, which read afterwards as "this +# shipped in 1.2" when it had not. Here declining is an action: the manager +# either approves, or removes their label. Since the merge waits for every +# remaining label to be approved, the labels on a merged PR are exactly the +# branches Direct Backport Push then sends the fix to. +# +# The author's job is to ask the manager for that call, not to make it for them. +# Editing labels needs triage access, so outside contributors and Renovate or +# Dependabot PRs cannot remove a label themselves — the failure report says so +# and names who to ask. +# +# `Backport Approvals` is a required status check on the default branch +# (.asf.yaml), so this job must produce a result on every pull request into +# `main`, or a PR that never runs it waits forever. That is why it is not +# conditioned on the title or the labels. It is not conditioned on the base +# branch either, for a different reason: a PR already targeting a release +# branch is itself a backport, so the check reports success there. +# Merge groups are re-evaluated rather than waved through, because a +# queued PR's own checks are no longer consulted once it is queued; a group +# whose PRs cannot be resolved fails closed rather than passing unchecked. Do +# not rename the job — its display name is the required context. + +name: Backport Approval Check + +on: + pull_request: + types: + - opened + - reopened + - synchronize + - labeled + - unlabeled + # Retargeting arrives as `edited`, and the verdict depends on the base + # branch: a backport PR into release/* has nothing to approve, the same + # PR moved onto main does. + - edited + pull_request_review: + types: + - submitted + - dismissed + merge_group: + +# Read-only: this job never writes to the PR, and `pull_request_review` runs +# with the base repository's token even for fork PRs. +permissions: + contents: read + pull-requests: read + +concurrency: + group: backport-approvals-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + backport-approvals: + # Do not rename — this display name is the required status check context + # referenced in .asf.yaml. + name: Backport Approvals + runs-on: ubuntu-latest + steps: + # The default branch, not anything the pull request points at. Neither + # release-branches.yml nor its parser existed before #6941, and both the + # head and `base.sha` can predate it: `base.sha` is main's tip at the PR's + # last synchronize, not now, which is stale for 33 of the open PRs into + # main. Either would fail the `run:` step below with a file-not-found and + # turn this required check red with nothing the author could do about it — + # backport-auto-label.yml pins `base.sha` and has been failing exactly that Review Comment: This sentence is right, and it is also the finding. `backport-auto-label.yml:78` still reads `base.sha` and runs the same parser at `:84` — twelve failed runs, 2026-07-28 to 2026-08-11. It matters more after this PR than before it. A labeler that dies applies no `release/*` label, so this check reports "nothing to approve" and passes. The fix is then silently never backported — the same false record the check exists to prevent, arriving through the labeler instead. The repair is the one-liner you just applied here. `:71-74` pins the base because `pull_request_target` has write permissions; main's tip is trusted too, and `:68` already gates the job on `base.ref == 'main'`: ```yaml ref: ${{ github.event.repository.default_branch }} ``` That line is outside a diff hunk, which is why this is anchored here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
