mengw15 opened a new pull request, #8379: URL: https://github.com/apache/texera/pull/8379
### What changes were proposed in this PR? The Merge Queue ruleset requires every change into `release/*` to arrive as a PR with one approving review, green required checks, and a pass through the merge queue. Right for people — but it also blocks `direct-backport-push.yml`, whose fast path pushes clean cherry-picks with the workflow's `GITHUB_TOKEN`. Every such push has been rejected since 2026-07-24, and five backports were silently lost (#8377). This splits the ruleset in two, rule-for-rule identical: `Merge Queue` keeps `~DEFAULT_BRANCH`, and a new `Merge Queue (release)` carries the three release branches plus a `bypass_actors` entry for the GitHub Actions app (`actor_id: 15368`). The split exists because a bypass is ruleset-wide — kept in one ruleset, it would let workflows push `main` too. Scope, stated precisely: the bypass exempts actions performed as the Actions app — any workflow's `GITHUB_TOKEN`, not just the backport workflow, since rulesets cannot scope a bypass to one workflow. People and PATs still face every rule on every branch; `main` gets no bypass; force pushes and branch deletion stay blocked for everyone, Actions included, by `Default Branch Protection`. ### Any related issues, documentation, discussions? Closes #8377. #8378 took the PR-plus-auto-merge route to the same problem and is closed in favor of trying the bypass first. What lands on a release branch through this path is still only a cherry-pick of a commit that passed main's full CI and, once #8096 lands, its release manager's approving review. ### How was this PR tested? `.asf.yaml` parses, and a structural check asserts: the two rulesets' `rules` blocks are deep-equal, `Merge Queue` matches only `~DEFAULT_BRANCH`, the release ruleset matches exactly v1.1–v1.3, and the bypass names the Actions app alone. The raw `bypass_actors` form copies the shape `Restrict Branch Creation` already uses in this file. The live effect is only observable after Infra applies the merged file — the next clean backport is the real test. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (claude-fable-5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
