Copilot commented on code in PR #8379:
URL: https://github.com/apache/texera/pull/8379#discussion_r3925991347
##########
.asf.yaml:
##########
@@ -76,13 +76,63 @@ github:
ref_name:
exclude: []
include:
+ # Release branches carry these same rules in "Merge Queue
+ # (release)" below — a separate ruleset because its Actions
+ # bypass must not extend to main.
- "~DEFAULT_BRANCH"
+ rules:
+ - type: deletion
+ - type: non_fast_forward
+ - type: merge_queue
+ parameters:
+ merge_method: SQUASH
+ max_entries_to_build: 2
+ min_entries_to_merge: 2
+ max_entries_to_merge: 5
+ min_entries_to_merge_wait_minutes: 3
+ grouping_strategy: HEADGREEN
+ check_response_timeout_minutes: 45
+ - type: pull_request
+ parameters:
+ allowed_merge_methods:
+ - squash
+ dismiss_stale_reviews_on_push: false
+ require_code_owner_review: false
+ require_last_push_approval: false
+ required_approving_review_count: 1
+ required_review_thread_resolution: true
+ - type: required_linear_history
+ - type: required_status_checks
+ parameters:
+ strict_required_status_checks_policy: false
+ required_status_checks:
+ - context: Required Checks
+ - context: Check License Headers
+ - context: Validate PR title
+
+ # Rule-for-rule identical to "Merge Queue" above; split out so the bypass
+ # below stays off main. The bypass exempts actions performed as the GitHub
+ # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what
+ # direct-backport-push.yml's fast path pushes with (#8377). It cannot be
+ # scoped to a single workflow. People and PATs still face every rule.
+ - name: "Merge Queue (release)"
+ target: branch
+ enforcement: active
+ conditions:
+ ref_name:
+ exclude: []
+ include:
# Merge queue rules do NOT support wildcard ref patterns, so
# release branches must be listed explicitly (not release/*).
# Add each release line here as it is cut.
- "refs/heads/release/v1.1"
- "refs/heads/release/v1.2"
- "refs/heads/release/v1.3"
+ bypass_actors:
+ # The GitHub Actions app.
+ - actor_id: 15368
+ actor_type: Integration
+ bypass_mode: always
Review Comment:
This bypass does not cover the fast-path credential currently used by the
backport workflow. `.github/workflows/direct-backport-push.yml:359-363`
configures `actions/checkout` with `AUTO_MERGE_TOKEN` first and only falls back
to `GITHUB_TOKEN`; the later `git push` reuses that persisted credential. When
the configured PAT is present, GitHub evaluates the push as its user, not
Integration 15368, so the release ruleset will still reject it. Either make
this push authenticate with `GITHUB_TOKEN` (and account for the
downstream-workflow suppression noted there) or explicitly authorize the PAT
identity; the latter would contradict the stated scope that PATs remain gated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
