revert: "ci: give GitHub Actions bypass on the release-branch ruleset" - #8624
Merged
mengw15 merged 2 commits intoSep 21, 2026
Merged
Conversation
This reverts commit 069cd20 (apache#8379). GitHub will not create the "Merge Queue (release)" ruleset it adds: Validation failed while creating ruleset 'Merge Queue (release)': ['Actor GitHub Actions integration must be part of the ruleset source or owner organization'] asfyaml has raised it on every push to main since apache#8379 merged, 38 mails to commits@ so far. The apply fails closed, so the rulesets on GitHub are still the ones from before apache#8379 -- but the abort takes the whole github feature in .asf.yaml with it, which has therefore been unapplied since 2026-09-11. Reverting also drops the push-backports job's narrowed permissions, which omitted pull-requests and so silenced the failure comment that tells the original PR its backport did not arrive.
mengw15
force-pushed
the
ci/8377-drop-rejected-actions-bypass-ruleset
branch
from
September 21, 2026 07:21
07718b5 to
eb3d068
Compare
mengw15
changed the title
Contributor
Automated Reviewer SuggestionsBased on the
|
github-actions
Bot
added
dependencies
This was referenced Sep 21, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8624 +/- ##
============================================
- Coverage 92.80% 92.80% -0.01%
+ Complexity 4899 4898 -1
============================================
Files 1239 1239
Lines 52252 52252
Branches 6425 6425
============================================
- Hits 48494 48493 -1
- Misses 2182 2183 +1
Partials 1576 1576
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
|
| config | throughput | MB/s | latency | max Δ latest / 7d | |
|---|---|---|---|---|---|
| 🔴 | bs=10 sw=10 sl=64 | 378 | 0.231 | 25,469/32,312/32,312 us | 🔴 -10.0% / 🔴 +107.5% |
| 🔴 | bs=100 sw=10 sl=64 | 792 | 0.483 | 125,885/139,467/139,467 us | 🟢 -7.3% / 🔴 +28.8% |
| ⚪ | bs=1000 sw=10 sl=64 | 920 | 0.561 | 1,085,198/1,198,546/1,198,546 us | ⚪ within ±5% / 🔴 +15.6% |
Baseline details
Latest main 6857871 from same runner
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---|---|---|---|---|
| bs=10 sw=10 sl=64 | throughput | 378 tuples/sec | 420 tuples/sec | 775.4 tuples/sec | -10.0% | -51.3% |
| bs=10 sw=10 sl=64 | MB/s | 0.231 MB/s | 0.256 MB/s | 0.473 MB/s | -9.8% | -51.2% |
| bs=10 sw=10 sl=64 | p50 | 25,469 us | 23,513 us | 12,716 us | +8.3% | +100.3% |
| bs=10 sw=10 sl=64 | p95 | 32,312 us | 34,131 us | 15,572 us | -5.3% | +107.5% |
| bs=10 sw=10 sl=64 | p99 | 32,312 us | 34,131 us | 19,527 us | -5.3% | +65.5% |
| bs=100 sw=10 sl=64 | throughput | 792 tuples/sec | 830 tuples/sec | 992.44 tuples/sec | -4.6% | -20.2% |
| bs=100 sw=10 sl=64 | MB/s | 0.483 MB/s | 0.507 MB/s | 0.606 MB/s | -4.7% | -20.3% |
| bs=100 sw=10 sl=64 | p50 | 125,885 us | 119,502 us | 102,140 us | +5.3% | +23.2% |
| bs=100 sw=10 sl=64 | p95 | 139,467 us | 150,516 us | 108,282 us | -7.3% | +28.8% |
| bs=100 sw=10 sl=64 | p99 | 139,467 us | 150,516 us | 118,936 us | -7.3% | +17.3% |
| bs=1000 sw=10 sl=64 | throughput | 920 tuples/sec | 921 tuples/sec | 1,023 tuples/sec | -0.1% | -10.1% |
| bs=1000 sw=10 sl=64 | MB/s | 0.561 MB/s | 0.562 MB/s | 0.624 MB/s | -0.2% | -10.2% |
| bs=1000 sw=10 sl=64 | p50 | 1,085,198 us | 1,087,274 us | 998,263 us | -0.2% | +8.7% |
| bs=1000 sw=10 sl=64 | p95 | 1,198,546 us | 1,144,033 us | 1,036,365 us | +4.8% | +15.6% |
| bs=1000 sw=10 sl=64 | p99 | 1,198,546 us | 1,144,033 us | 1,064,941 us | +4.8% | +12.5% |
Raw CSV
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,528.44,200,128000,378,0.231,25469.31,32311.99,32311.99
1,100,10,64,20,2525.72,2000,1280000,792,0.483,125885.20,139467.29,139467.29
2,1000,10,64,20,21748.84,20000,12800000,920,0.561,1085198.49,1198545.81,1198545.81
renovate-bot
pushed a commit
to renovate-bot/apache-_-texera
that referenced
this pull request
Sep 21, 2026
…pache#8626) ### What changes were proposed in this PR? `Direct Backport Push` cherry-picks a cleanly-applying fix onto the release branch and pushes it. Every one of those pushes has been rejected since 2026-07-24: `release/*` is covered by the Merge Queue ruleset, which requires a pull request of everyone. apache#8379 tried to exempt the Actions app from it; GitHub refuses to create that bypass, and apache#8624 reverts it. ASF policy points the same way — an automated service must not push to a branch subject to official release without prior authorization from Infrastructure. Both outcomes now open a pull request. The conflicted one is unchanged: a draft, assigned to its author. A clean one opens **ready for review and assigned to nobody**, because there is no code for anyone to write on it. What a clean backport still needs is its checks started, and that is the part worth stating plainly. GitHub creates no workflow run for anything `GITHUB_TOKEN` does, so a bot-opened pull request has none — and nothing will arrive on its own: | action on a pull request with no checks | starts the three required contexts | | --- | --- | | push any commit to the branch | yes (`synchronize`) | | close and reopen it | yes (`reopened`) | | mark it ready for review | **no** — none of the three workflows listens for `ready_for_review` | | add or remove a label | only `Required Checks` | | "Re-run all jobs" | no — with no run there is nothing to re-run | A conflicted backport never had this problem: its author pushes a resolution, and that push brings CI with it. A clean one has nobody to push anything. So the comment the conflict path already posts for its instructions now says, for a clean backport, the one action that works — and says that marking it ready for review is not it. That leaves the release manager three ordinary buttons: reopen, approve, and auto-merge if they would rather not come back when the checks finish. The approval is not automated and should not be: the `release/*` label on the original PR records the decision, and this is the look at the tree that actually lands. Nothing here depends on a token's pull-request scope, on an Actions bypass, or on a close/reopen the workflow performs itself. Those are the paths that can only be proven in production, and that fail quietly when they are wrong — which is how apache#8432, apache#8494 and apache#8562 were lost. `push_entries` is now always empty, leaving `push-backports` unreachable. Removing it is left to a separate change, so that this one is a behaviour change and that one is a pure deletion. ### Any related issues, documentation, discussions? Closes apache#8377. apache#8378 proposed the same routing with the workflow performing the close/reopen itself and arming auto-merge; this drops both in favour of the release manager's own click, and is closed in favour of this. ### How was this PR tested? The routing was driven locally against a stubbed `github-script` environment. With the pre-merge preflight green, both targets come out as pull-request entries carrying `clean: "true"` and `push_entries` empty; with it neutral, `clean: "false"`; with no completed signal, neither target is acted on, as before. Restoring the old `pushEntries.push` turns that check red, so it is not vacuous. The workflow parses, and all four inline `github-script` bodies pass `node --check`. That a bot-opened pull request starts with no checks is what this repository already shows: apache#8584 — bot-opened, one commit, nobody pushed to it — carries no check runs at all, while apache#8553, opened the same way, has the full set after a commit was pushed. That `ready_for_review` does not start them is in the triggers: `required-checks.yml` lists `opened`/`reopened`/`synchronize`/`labeled`/`unlabeled`, `check-header.yml` takes the bare `pull_request:` defaults, and `lint-pr.yml` lists `opened`/`edited`/`reopened`/`synchronize`. Not provable before merge: that a human reopen produces the three contexts on a backport PR. apache#8619 to apache#8623 — five backports into `release/v1.3` opened by hand this week — show that the contexts do appear and pass on a pull request into a release branch; the reopen path shares everything with them but the event that starts the run. ### Was this PR authored or co-authored using generative AI tooling? Yes. Generated-by: Claude Code (claude-opus-5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this PR?
Reverts #8379. GitHub will not create the
Merge Queue (release)ruleset it adds — asfyaml has rejected it on every push to main since that PR merged, 38 mails tocommits@so far, the first 49 seconds after the merge:The fail-safe ordering #8379 built held: the apply aborts on that ruleset, so
Merge Queuewas never shrunk and the release branches were never left uncovered. But the abort takes the wholegithubfeature with it, so nothing in.asf.yaml'sgithub:block has been applied to this repo since 2026-09-11 — the next label, notification or collaborator change would merge, do nothing, and say so only on a list its author does not read.Two side effects of #8379 go with it. The
push-backportsjob's permissions were narrowed toactions,contents,issuesandstatuses; commenting on a pull request is scoped bypull-requests, notissues, so since 2026-09-11 the step that annotates the original PR when a backport fails has taken four 403s and given up with a warning, leaving the step green. The 2026-09-03 failures (#8347, #8343) did comment and were noticed; #8432, #8494 and #8562 did not. Dropping the block restores the workflow-level scope, which haspull-requests: write. The push also goes back toAUTO_MERGE_TOKEN, and theworkflow_dispatchofRequired Checksthat only aGITHUB_TOKENpush needed goes with it.This does not revive the backport fast path — that push stays rejected, as it has been since 2026-07-24. Routing a clean backport through a pull request instead is #8378's job, and #8377 stays open until it lands.
Any related issues, documentation, discussions?
Relates to #8377 (closed by #8379, not actually fixed) and #8379.
How was this PR tested?
git revertapplies cleanly to main, and the resulting.asf.yamlis byte-identical to the commit before #8379 — the file was not touched in between — so applying it asks asfyaml for exactly the configurationGET /repos/apache/texera/rulesetsalready returns..github/scripts/test_asf_rulesets.shis removed with the rest of #8379. Its duplicate-key-strict parse of.asf.yamland every workflow is worth keeping and comes back on its own, without the ruleset assertions that no longer have a subject.Was this PR authored or co-authored using generative AI tooling?
Yes. Generated-by: Claude Code (claude-opus-5)