ci: give GitHub Actions bypass on the release-branch ruleset

.asf.yaml

@@ -69,20 +69,76 @@ github:
     rebase: false
 
   rulesets:
-    - name: Merge Queue
+    # Rule-for-rule identical to "Merge Queue" below; split out so the bypass
+    # here stays off main. The bypass exempts actions performed as the GitHub
+    # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what
+    # direct-backport-push.yml's fast path pushes with (#8377). It cannot be
+    # scoped to a single workflow. People and PATs still face every rule.
+    #
+    # Listed BEFORE "Merge Queue" deliberately: asfyaml applies rulesets in
+    # file order, so this one is created before that one stops covering the
+    # release branches. If GitHub rejects this ruleset, the apply aborts with
+    # the old protections fully intact; the failure order never leaves the
+    # release branches uncovered.
+    - name: "Merge Queue (release)"
       target: branch
       enforcement: active
       conditions:
         ref_name:
           exclude: []
           include:
-            - "~DEFAULT_BRANCH"
             # Merge queue rules do NOT support wildcard ref patterns, so
             # release branches must be listed explicitly (not release/*).
             # Add each release line here as it is cut.
             - "refs/heads/release/v1.1"
             - "refs/heads/release/v1.2"
             - "refs/heads/release/v1.3"
+      bypass_actors:
+        # The GitHub Actions app.
+        - actor_id: 15368
+          actor_type: Integration
+          bypass_mode: always
+      rules:
+        - type: deletion
+        - type: non_fast_forward
+        - type: merge_queue
+          parameters:
+            merge_method: SQUASH
+            max_entries_to_build: 2
+            min_entries_to_merge: 2
+            max_entries_to_merge: 5
+            min_entries_to_merge_wait_minutes: 3
+            grouping_strategy: HEADGREEN
+            check_response_timeout_minutes: 45
+        - type: pull_request
+          parameters:
+            allowed_merge_methods:
+              - squash
+            dismiss_stale_reviews_on_push: false
+            require_code_owner_review: false
+            require_last_push_approval: false
+            required_approving_review_count: 1
+            required_review_thread_resolution: true
+        - type: required_linear_history
+        - type: required_status_checks
+          parameters:
+            strict_required_status_checks_policy: false
+            required_status_checks:
+              - context: Required Checks
+              - context: Check License Headers
+              - context: Validate PR title
+
+    - name: Merge Queue
+      target: branch
+      enforcement: active
+      conditions:
+        ref_name:
+          exclude: []
+          include:
+            # Release branches carry these same rules in "Merge Queue
+            # (release)" above — a separate ruleset because its Actions
+            # bypass must not extend to main.
+            - "~DEFAULT_BRANCH"
       rules:
         - type: deletion
         - type: non_fast_forward

.github/workflows/direct-backport-push.yml

@@ -22,7 +22,8 @@ on:
       - main
 
 permissions:
-  actions: read
+  # write: the fast path dispatches Required Checks after its push (below).
+  actions: write
   checks: read
   contents: write
   issues: write
@@ -356,11 +357,12 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          # Use AUTO_MERGE_TOKEN (fine-grained PAT) so the push to the release
-          # branch retriggers workflows on that branch. GITHUB_TOKEN-authored
-          # pushes are excluded from triggering downstream workflows, which
-          # silences post-merge CI on backport commits.
-          token: ${{ secrets.AUTO_MERGE_TOKEN || secrets.GITHUB_TOKEN }}
+          # Push with the default GITHUB_TOKEN: the release rulesets admit the
+          # GitHub Actions app as a bypass actor, while a PAT-authored push is
+          # evaluated as that person and rejected. A GITHUB_TOKEN push starts
+          # no downstream workflows, so the step after the cherry-pick
+          # dispatches Required Checks itself — workflow_dispatch runs are the
+          # documented exception that GITHUB_TOKEN may create.
       - name: Cherry-pick merge commit onto target branch
         id: cherry_pick
         env:
@@ -571,6 +573,17 @@ jobs:
           log "new_sha=${new_sha}"
           echo "new_sha=${new_sha}" >> "$GITHUB_OUTPUT"
 
+      - name: Run Required Checks on the pushed release branch
+        if: success()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TARGET_BRANCH: ${{ matrix.target }}
+        run: |
+          # The GITHUB_TOKEN push above starts no push-triggered workflows;
+          # dispatch the run the release branch would otherwise have gotten.
+          gh workflow run required-checks.yml \
+            --repo "${GITHUB_REPOSITORY}" --ref "refs/heads/${TARGET_BRANCH}"
+
       - name: Annotate original PR and commit on success
         if: success()
         uses: actions/github-script@v9

.github/workflows/required-checks.yml

@@ -22,6 +22,9 @@ on:
     branches:
       - 'main'
       - 'release/**'
+  # The backport fast path pushes release branches with GITHUB_TOKEN, which
+  # starts no push-triggered runs; it dispatches this workflow instead.
+  workflow_dispatch:
   pull_request:
     types:
       - opened