Repository navigation
ci: replace classic branch protection with a ruleset so the bypass works - #3481
Open
kevinjqliu wants to merge 4 commits into
Open
kevinjqliu wants to merge 4 commits into
kevinjqliu wants to merge 4 commits into
Conversation
Classic branch protection can only be bypassed by admins, and while it exists GitHub blocks direct merges for the ruleset's bypass actors even when every requirement is met. Move the approval, linear-history, deletion and force-push rules into the Merge Queue ruleset and disable classic protection, as apache/seatunnel does, so iceberg-public members can use the breakglass. Requirements are otherwise unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
kevinjqliu
marked this pull request as draft
October 16, 2026 17:44
Put deletion, force-push, linear-history and approval rules in a separate Branch Protection ruleset that only apache/root can bypass, so the iceberg-public breakglass skips only the merge queue and required checks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
kevinjqliu
changed the title
Copilot stopped reviewing on behalf of
kevinjqliu due to an error
October 16, 2026 18:09
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
kevinjqliu
commented
Oct 16, 2026
| type: branch | ||
| branches: | ||
| includes: | ||
| - "~DEFAULT_BRANCH" |
Contributor
Author
There was a problem hiding this comment.
this refers to the same main branch as before
| required_approving_review_count: 1 | ||
| dismiss_stale_reviews: false | ||
|
|
||
| required_linear_history: true |
Contributor
Author
There was a problem hiding this comment.
required_linear_history is not removed, still set to true in the default branch ruleset
Comment on lines
+48
to
+49
| restrict_deletion: true | ||
| restrict_force_push: true |
Contributor
Author
There was a problem hiding this comment.
newly added, to match the existing "classic protection" behavior (what protected_branches sets)
kevinjqliu
marked this pull request as ready for review
October 16, 2026 18:15
Contributor
Author
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue does this PR close?
What changes are included in this PR?
The breakglass from #3458 doesn't work yet. While classic branch protection exists, GitHub blocks the bypass even on an approved PR with green checks (
DIRECT_MERGE: BLOCKED).This replaces classic protection with Infra's "Default Branch Protection" ruleset (the template Infra rolled out across ASF repos), keeping the same rules.
mainthen has two rulesets, and bypass is per ruleset:required_approving_review_count: 1): changes go through a PR with at least 1 approval from a committerdismiss_stale_reviews: false): an approval still counts after new commits are pushedrequired_linear_history: true): no merge commits onmainrestrict_force_push: true): nobody can rewritemain's historyrestrict_deletion: true): nobody can deletemainapache/root(ASF Infra) onlytype: merge_queue): PRs merge through the queue, tested against the latestmaintype: required_status_checks): CI must pass before mergingapache/root,iceberg-public(PRs only)restrict_force_pushandrestrict_deletionaren't new: classic protection already blocked both (asfyaml setsallow_force_pushes: false, and GitHub blocks deletion by default). Rulesets don't, so they need to be listed.A typical PR needs to pass both. Once a PR passes Default Branch Protection (it's approved), an
iceberg-publicmember can bypass Merge Queue and merge without waiting for the queue or required checks.Other projects did the same: Mahout hit the same bypass issue, and seatunnel uses
protected_branches: ~.Are these changes tested?
Validated with apache/infrastructure-asfyaml. After merge:
gh api repos/apache/iceberg-rust/branches/main --jq .protection.enabledshould printfalse.viewerMergeActionsshould showDIRECT_MERGE: ALLOWED_WITH_BYPASSfor aniceberg-publicmember.AI Disclosure
Drafted with GitHub Copilot. Bypassing one ruleset while another applies to the same branch isn't explicitly documented by GitHub; apache/age's
PG15branch is the only Apache example I found.