From 62143bd973c6169ba695eec20078c5ef9e967db8 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:07:40 -0700 Subject: [PATCH 1/6] ci: give GitHub Actions bypass on the release-branch ruleset Splits the Merge Queue ruleset in two, rules identical, so the release half can carry a bypass for the Actions app without extending it to main. Workflows (GITHUB_TOKEN) can then push release/* again, which revives direct-backport-push.yml's fast path, rejected by the ruleset since 2026-07-24 (#8377). People and PATs still face every rule. --- .asf.yaml | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/.asf.yaml b/.asf.yaml index 8e2adbc6a72..e507867bff7 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -76,13 +76,63 @@ github: ref_name: exclude: [] include: + # Release branches carry these same rules in "Merge Queue + # (release)" below — a separate ruleset because its Actions + # bypass must not extend to main. - "~DEFAULT_BRANCH" + rules: + - type: deletion + - type: non_fast_forward + - type: merge_queue + parameters: + merge_method: SQUASH + max_entries_to_build: 2 + min_entries_to_merge: 2 + max_entries_to_merge: 5 + min_entries_to_merge_wait_minutes: 3 + grouping_strategy: HEADGREEN + check_response_timeout_minutes: 45 + - type: pull_request + parameters: + allowed_merge_methods: + - squash + dismiss_stale_reviews_on_push: false + require_code_owner_review: false + require_last_push_approval: false + required_approving_review_count: 1 + required_review_thread_resolution: true + - type: required_linear_history + - type: required_status_checks + parameters: + strict_required_status_checks_policy: false + required_status_checks: + - context: Required Checks + - context: Check License Headers + - context: Validate PR title + + # Rule-for-rule identical to "Merge Queue" above; split out so the bypass + # below stays off main. The bypass exempts actions performed as the GitHub + # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what + # direct-backport-push.yml's fast path pushes with (#8377). It cannot be + # scoped to a single workflow. People and PATs still face every rule. + - name: "Merge Queue (release)" + target: branch + enforcement: active + conditions: + ref_name: + exclude: [] + include: # Merge queue rules do NOT support wildcard ref patterns, so # release branches must be listed explicitly (not release/*). # Add each release line here as it is cut. - "refs/heads/release/v1.1" - "refs/heads/release/v1.2" - "refs/heads/release/v1.3" + bypass_actors: + # The GitHub Actions app. + - actor_id: 15368 + actor_type: Integration + bypass_mode: always rules: - type: deletion - type: non_fast_forward From e524cf79ced359b41a191911d85d7a7104dc545f Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:32:48 -0700 Subject: [PATCH 2/6] ci: create the release ruleset before shrinking the main one asfyaml applies rulesets in file order. With the new ruleset listed first, a rejected creation aborts the apply while today's protections still cover the release branches; the old order would shrink "Merge Queue" first and leave them uncovered if the creation then failed. --- .asf.yaml | 50 ++++++++++++++++++++++++++++---------------------- 1 file changed, 28 insertions(+), 22 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index e507867bff7..f45f86ec250 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -69,17 +69,35 @@ github: rebase: false rulesets: - - name: Merge Queue + # Rule-for-rule identical to "Merge Queue" below; split out so the bypass + # here stays off main. The bypass exempts actions performed as the GitHub + # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what + # direct-backport-push.yml's fast path pushes with (#8377). It cannot be + # scoped to a single workflow. People and PATs still face every rule. + # + # Listed BEFORE "Merge Queue" deliberately: asfyaml applies rulesets in + # file order, so this one is created before that one stops covering the + # release branches. If GitHub rejects this ruleset, the apply aborts with + # the old protections fully intact; the failure order never leaves the + # release branches uncovered. + - name: "Merge Queue (release)" target: branch enforcement: active conditions: ref_name: exclude: [] include: - # Release branches carry these same rules in "Merge Queue - # (release)" below — a separate ruleset because its Actions - # bypass must not extend to main. - - "~DEFAULT_BRANCH" + # Merge queue rules do NOT support wildcard ref patterns, so + # release branches must be listed explicitly (not release/*). + # Add each release line here as it is cut. + - "refs/heads/release/v1.1" + - "refs/heads/release/v1.2" + - "refs/heads/release/v1.3" + bypass_actors: + # The GitHub Actions app. + - actor_id: 15368 + actor_type: Integration + bypass_mode: always rules: - type: deletion - type: non_fast_forward @@ -110,29 +128,17 @@ github: - context: Check License Headers - context: Validate PR title - # Rule-for-rule identical to "Merge Queue" above; split out so the bypass - # below stays off main. The bypass exempts actions performed as the GitHub - # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what - # direct-backport-push.yml's fast path pushes with (#8377). It cannot be - # scoped to a single workflow. People and PATs still face every rule. - - name: "Merge Queue (release)" + - name: Merge Queue target: branch enforcement: active conditions: ref_name: exclude: [] include: - # Merge queue rules do NOT support wildcard ref patterns, so - # release branches must be listed explicitly (not release/*). - # Add each release line here as it is cut. - - "refs/heads/release/v1.1" - - "refs/heads/release/v1.2" - - "refs/heads/release/v1.3" - bypass_actors: - # The GitHub Actions app. - - actor_id: 15368 - actor_type: Integration - bypass_mode: always + # Release branches carry these same rules in "Merge Queue + # (release)" above — a separate ruleset because its Actions + # bypass must not extend to main. + - "~DEFAULT_BRANCH" rules: - type: deletion - type: non_fast_forward From 81f8622be527732d3b0f08c9ab5e0d633b318c5c Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:32:48 -0700 Subject: [PATCH 3/6] ci: push backports with GITHUB_TOKEN so the ruleset bypass applies The fast path has pushed with AUTO_MERGE_TOKEN since #4676, so GitHub evaluates that push as the PAT's owner, whom the Actions-app bypass does not cover. Pushing with the default GITHUB_TOKEN puts it under the bypass; the release-branch CI the PAT existed to retrigger is dispatched explicitly instead, which workflow_dispatch permits a GITHUB_TOKEN to do. --- .github/workflows/direct-backport-push.yml | 25 ++++++++++++++++------ .github/workflows/required-checks.yml | 3 +++ 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/.github/workflows/direct-backport-push.yml b/.github/workflows/direct-backport-push.yml index b67fcc90fc0..585f4efceab 100644 --- a/.github/workflows/direct-backport-push.yml +++ b/.github/workflows/direct-backport-push.yml @@ -22,7 +22,8 @@ on: - main permissions: - actions: read + # write: the fast path dispatches Required Checks after its push (below). + actions: write checks: read contents: write issues: write @@ -356,11 +357,12 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 - # Use AUTO_MERGE_TOKEN (fine-grained PAT) so the push to the release - # branch retriggers workflows on that branch. GITHUB_TOKEN-authored - # pushes are excluded from triggering downstream workflows, which - # silences post-merge CI on backport commits. - token: ${{ secrets.AUTO_MERGE_TOKEN || secrets.GITHUB_TOKEN }} + # Push with the default GITHUB_TOKEN: the release rulesets admit the + # GitHub Actions app as a bypass actor, while a PAT-authored push is + # evaluated as that person and rejected. A GITHUB_TOKEN push starts + # no downstream workflows, so the step after the cherry-pick + # dispatches Required Checks itself — workflow_dispatch runs are the + # documented exception that GITHUB_TOKEN may create. - name: Cherry-pick merge commit onto target branch id: cherry_pick env: @@ -571,6 +573,17 @@ jobs: log "new_sha=${new_sha}" echo "new_sha=${new_sha}" >> "$GITHUB_OUTPUT" + - name: Run Required Checks on the pushed release branch + if: success() + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TARGET_BRANCH: ${{ matrix.target }} + run: | + # The GITHUB_TOKEN push above starts no push-triggered workflows; + # dispatch the run the release branch would otherwise have gotten. + gh workflow run required-checks.yml \ + --repo "${GITHUB_REPOSITORY}" --ref "refs/heads/${TARGET_BRANCH}" + - name: Annotate original PR and commit on success if: success() uses: actions/github-script@v9 diff --git a/.github/workflows/required-checks.yml b/.github/workflows/required-checks.yml index 1db8a52668e..7b5e2214b15 100644 --- a/.github/workflows/required-checks.yml +++ b/.github/workflows/required-checks.yml @@ -22,6 +22,9 @@ on: branches: - 'main' - 'release/**' + # The backport fast path pushes release branches with GITHUB_TOKEN, which + # starts no push-triggered runs; it dispatches this workflow instead. + workflow_dispatch: pull_request: types: - opened From 1864bdac795393b225d41c25053ea50df169661f Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Fri, 4 Sep 2026 08:56:14 -0700 Subject: [PATCH 4/6] ci: fix the duplicate dispatch trigger and make the dispatch best-effort required-checks.yml already carried workflow_dispatch at the bottom of its trigger block, so the added one was a duplicate key -- PyYAML keeps the last silently, GitHub's loader rejects the file. The explanatory comment moves to the existing key instead. The dispatch after a fast-path push is now best-effort with a warning: the backport has landed by then, and a failed dispatch would otherwise trip the failure reporter into claiming the backport was lost. The ref uses the documented bare branch form, and actions: write shrinks from the workflow to the one job whose step dispatches. --- .github/workflows/direct-backport-push.yml | 21 +++++++++++++++++---- .github/workflows/required-checks.yml | 5 ++--- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/.github/workflows/direct-backport-push.yml b/.github/workflows/direct-backport-push.yml index 585f4efceab..6515b256aa8 100644 --- a/.github/workflows/direct-backport-push.yml +++ b/.github/workflows/direct-backport-push.yml @@ -22,8 +22,7 @@ on: - main permissions: - # write: the fast path dispatches Required Checks after its push (below). - actions: write + actions: read checks: read contents: write issues: write @@ -343,6 +342,15 @@ jobs: needs: discover if: ${{ needs.discover.outputs.has_push == 'true' }} runs-on: ubuntu-latest + permissions: + # Everything this job's steps call, and nothing more: push the + # cherry-pick and comment on the commit (contents), dispatch Required + # Checks (actions), per-target commit status (statuses), annotate the + # original PR (issues). + actions: write + contents: write + issues: write + statuses: write name: "backport #${{ matrix.pr_number }} to ${{ matrix.target }}" strategy: fail-fast: false @@ -581,8 +589,13 @@ jobs: run: | # The GITHUB_TOKEN push above starts no push-triggered workflows; # dispatch the run the release branch would otherwise have gotten. - gh workflow run required-checks.yml \ - --repo "${GITHUB_REPOSITORY}" --ref "refs/heads/${TARGET_BRANCH}" + # Best-effort: the backport itself has landed, so a dispatch + # failure must not demote this job to failed -- the failure + # reporter below would then claim a landed backport was lost. + if ! gh workflow run required-checks.yml \ + --repo "${GITHUB_REPOSITORY}" --ref "${TARGET_BRANCH}"; then + echo "::warning::Could not start Required Checks on ${TARGET_BRANCH}; start it manually from the Actions tab." + fi - name: Annotate original PR and commit on success if: success() diff --git a/.github/workflows/required-checks.yml b/.github/workflows/required-checks.yml index 7b5e2214b15..42b31d37fd8 100644 --- a/.github/workflows/required-checks.yml +++ b/.github/workflows/required-checks.yml @@ -22,9 +22,6 @@ on: branches: - 'main' - 'release/**' - # The backport fast path pushes release branches with GITHUB_TOKEN, which - # starts no push-triggered runs; it dispatches this workflow instead. - workflow_dispatch: pull_request: types: - opened @@ -33,6 +30,8 @@ on: - labeled - unlabeled merge_group: + # Also dispatched by direct-backport-push.yml after its GITHUB_TOKEN push + # to a release branch, which starts no push-triggered runs. workflow_dispatch: permissions: From 711265ba5306750488aaef7e10e0b853bdd1a7c3 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Fri, 4 Sep 2026 08:56:14 -0700 Subject: [PATCH 5/6] ci: assert the split rulesets stay identical and keys stay unique The two Merge Queue rulesets are one policy split so the release half can hold an Actions bypass that must not reach main; nothing else kept the copies equal. The same script parses .asf.yaml and every workflow with a duplicate-key-strict loader, the class of error a plain parse passes and GitHub's loader rejects. --- .github/scripts/test_asf_rulesets.sh | 96 ++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100755 .github/scripts/test_asf_rulesets.sh diff --git a/.github/scripts/test_asf_rulesets.sh b/.github/scripts/test_asf_rulesets.sh new file mode 100755 index 00000000000..f0f8eedb0a0 --- /dev/null +++ b/.github/scripts/test_asf_rulesets.sh @@ -0,0 +1,96 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Invariants over the CI configuration that a plain YAML parse cannot see. +# +# 1. "Merge Queue" and "Merge Queue (release)" in .asf.yaml must carry +# identical rules: they are one policy split across two rulesets only so +# the release half can hold an Actions bypass that must not reach main. +# Nothing else keeps the copies from drifting apart. +# 2. .asf.yaml and every workflow must parse with a duplicate-key-strict +# loader. PyYAML silently keeps the last duplicate, but GitHub's loader +# rejects the file, so a duplicated trigger key passes local checks and +# then stops the workflow from ever starting. + +set -uo pipefail + +command -v python3 >/dev/null || { echo "python3 is required to run these tests" >&2; exit 1; } + +cd "$(git rev-parse --show-toplevel)" + +python3 - <<'EOF' +import glob +import sys + +import yaml + + +class StrictLoader(yaml.SafeLoader): + pass + + +def no_duplicates(loader, node, deep=False): + seen = set() + for key_node, _ in node.value: + key = loader.construct_object(key_node, deep=deep) + if key in seen: + raise yaml.YAMLError( + f"duplicate key {key!r} at line {key_node.start_mark.line + 1}" + ) + seen.add(key) + return yaml.SafeLoader.construct_mapping(loader, node, deep) + + +StrictLoader.add_constructor( + yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, no_duplicates +) + +failures = [] + +files = sorted(glob.glob(".github/workflows/*.yml")) + [".asf.yaml"] +for path in files: + with open(path) as fh: + try: + yaml.load(fh, StrictLoader) + except yaml.YAMLError as exc: + failures.append(f"{path}: {exc}") + +with open(".asf.yaml") as fh: + rulesets = { + r.get("name"): r + for r in yaml.safe_load(fh)["github"]["rulesets"] + if isinstance(r, dict) + } +main_rs = rulesets.get("Merge Queue") +release_rs = rulesets.get("Merge Queue (release)") +if main_rs is None or release_rs is None: + failures.append( + ".asf.yaml: expected rulesets named 'Merge Queue' and 'Merge Queue (release)'" + ) +elif main_rs["rules"] != release_rs["rules"]: + failures.append( + ".asf.yaml: 'Merge Queue' and 'Merge Queue (release)' rules differ -- " + "these are one policy in two rulesets; change both or neither" + ) + +for failure in failures: + print(f"FAIL: {failure}") +if failures: + sys.exit(1) +print(f"OK: {len(files)} files duplicate-key clean; Merge Queue rules identical") +EOF From 6bae0ba3d4f40d9c435811f7e02a958f2922e652 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Fri, 4 Sep 2026 11:03:21 -0700 Subject: [PATCH 6/6] ci: pin PyYAML for the infra shell tests and assert bypass placement The infra job's only Python install is amber/dev-requirements.txt, and setup-python ships no PyYAML, so the new invariant check died on import in both legs -- the constraint release_branches.py already records. The check now also asserts what the split exists for: no bypass_actors on "Merge Queue", exactly the Actions app on "Merge Queue (release)". --- .github/scripts/test_asf_rulesets.sh | 19 ++++++++++++++++++- .github/workflows/direct-backport-push.yml | 4 ++-- amber/dev-requirements.txt | 2 ++ 3 files changed, 22 insertions(+), 3 deletions(-) diff --git a/.github/scripts/test_asf_rulesets.sh b/.github/scripts/test_asf_rulesets.sh index f0f8eedb0a0..9836fd48d4b 100755 --- a/.github/scripts/test_asf_rulesets.sh +++ b/.github/scripts/test_asf_rulesets.sh @@ -30,6 +30,9 @@ set -uo pipefail command -v python3 >/dev/null || { echo "python3 is required to run these tests" >&2; exit 1; } +# Runners ship python3 but not necessarily PyYAML (see release_branches.py); +# CI installs it via amber/dev-requirements.txt. +python3 -c 'import yaml' 2>/dev/null || { echo "PyYAML is required (pip install pyyaml)" >&2; exit 1; } cd "$(git rev-parse --show-toplevel)" @@ -87,10 +90,24 @@ elif main_rs["rules"] != release_rs["rules"]: ".asf.yaml: 'Merge Queue' and 'Merge Queue (release)' rules differ -- " "these are one policy in two rulesets; change both or neither" ) +if main_rs is not None and "bypass_actors" in main_rs: + failures.append( + ".asf.yaml: 'Merge Queue' must not carry bypass_actors -- " + "keeping the bypass off main is what the split exists for" + ) +ACTIONS_APP = [{"actor_id": 15368, "actor_type": "Integration", "bypass_mode": "always"}] +if release_rs is not None and release_rs.get("bypass_actors") != ACTIONS_APP: + failures.append( + ".asf.yaml: 'Merge Queue (release)' bypass_actors must be exactly the " + "GitHub Actions app -- widen this list and the test together, deliberately" + ) for failure in failures: print(f"FAIL: {failure}") if failures: sys.exit(1) -print(f"OK: {len(files)} files duplicate-key clean; Merge Queue rules identical") +print( + f"OK: {len(files)} files duplicate-key clean; " + "Merge Queue rules identical; bypass only on the release ruleset" +) EOF diff --git a/.github/workflows/direct-backport-push.yml b/.github/workflows/direct-backport-push.yml index 6515b256aa8..149c6085566 100644 --- a/.github/workflows/direct-backport-push.yml +++ b/.github/workflows/direct-backport-push.yml @@ -345,8 +345,8 @@ jobs: permissions: # Everything this job's steps call, and nothing more: push the # cherry-pick and comment on the commit (contents), dispatch Required - # Checks (actions), per-target commit status (statuses), annotate the - # original PR (issues). + # Checks (actions), set the per-target commit status (statuses), + # annotate the original PR (issues). actions: write contents: write issues: write diff --git a/amber/dev-requirements.txt b/amber/dev-requirements.txt index f1c03738e4a..f7e0b42542e 100644 --- a/amber/dev-requirements.txt +++ b/amber/dev-requirements.txt @@ -39,3 +39,5 @@ betterproto[compiler]==2.0.0b7 # Required by `bin/local-dev.sh -i` (the interactive Textual TUI). textual==8.2.8 +# .github/scripts/test_asf_rulesets.sh (infra job shell tests) +pyyaml==6.0.3