mengw15 commented on code in PR #8096: URL: https://github.com/apache/texera/pull/8096#discussion_r3924320815
########## .github/workflows/backport-approval-check.yml: ########## @@ -0,0 +1,318 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Blocks the merge while a `release/*` label on the PR is not approved by that +# branch's release manager (.github/release-branches.yml). +# +# A label only nominates a branch. Before this, a manager declined by staying +# silent and the label stayed on, so a merged PR claimed a backport that never +# happened. Declining is now an action — approve, or remove the label — and the +# merge waits for every remaining label, so a merged PR's labels are the +# branches it reached. +# +# `Backport Approvals` is a required check on the default branch (.asf.yaml), so +# this must report on every PR into `main` or one that never runs it waits +# forever: hence no condition on title, labels, or base. A PR into a release +# branch is itself a backport and reports success. Merge groups are +# re-evaluated rather than waved through, and one whose PRs cannot be resolved +# fails closed. Do not rename the job — its name is the required context. + +name: Backport Approval Check + +on: + pull_request: + types: + - opened + - reopened + - synchronize + - labeled + - unlabeled + # Retargeting arrives as `edited`, and the verdict depends on the base + # branch: a backport PR into release/* has nothing to approve, the same + # PR moved onto main does. + - edited + pull_request_review: + types: + - submitted + - dismissed + merge_group: + +# Read-only: this job never writes to the PR, and `pull_request_review` runs +# with the base repository's token even for fork PRs. +permissions: + contents: read + pull-requests: read + +concurrency: + group: backport-approvals-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + backport-approvals: + # Do not rename — this display name is the required status check context + # referenced in .asf.yaml. + name: Backport Approvals + runs-on: ubuntu-latest + steps: + # The default branch, not the PR's head or base. Neither predates #6941, + # which added release-branches.yml — and `base.sha` is main's tip at the + # PR's last synchronize rather than now, stale for 33 of the open PRs into + # main. Either would fail the step below with a file-not-found and turn + # this required check red unclearably; backport-auto-label.yml pinned + # `base.sha` and failed that way 20 times in production. Reading main also + # lets a PR retargeted onto a release branch, where the config is absent, + # reach the report instead of dying before it. + # + # Direct Backport Push reads main too, so both consumers judge a backport + # by the same config. A PR editing that config is judged by the pre-edit + # copy; those are `ci:`-typed and carry no `release/*` labels. Review Comment: Applied verbatim in f4a8a9f76 — both sentences were mine, from last round's tightening. The labeler repair is now in the description too. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
