revert: "ci: give GitHub Actions bypass on the release-branch ruleset"

.asf.yaml

@@ -69,76 +69,20 @@ github:
     rebase: false
 
   rulesets:
-    # Rule-for-rule identical to "Merge Queue" below; split out so the bypass
-    # here stays off main. The bypass exempts actions performed as the GitHub
-    # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what
-    # direct-backport-push.yml's fast path pushes with (#8377). It cannot be
-    # scoped to a single workflow. People and PATs still face every rule.
-    #
-    # Listed BEFORE "Merge Queue" deliberately: asfyaml applies rulesets in
-    # file order, so this one is created before that one stops covering the
-    # release branches. If GitHub rejects this ruleset, the apply aborts with
-    # the old protections fully intact; the failure order never leaves the
-    # release branches uncovered.
-    - name: "Merge Queue (release)"
+    - name: Merge Queue
       target: branch
       enforcement: active
       conditions:
         ref_name:
           exclude: []
           include:
+            - "~DEFAULT_BRANCH"
             # Merge queue rules do NOT support wildcard ref patterns, so
             # release branches must be listed explicitly (not release/*).
             # Add each release line here as it is cut.
             - "refs/heads/release/v1.1"
             - "refs/heads/release/v1.2"
             - "refs/heads/release/v1.3"
-      bypass_actors:
-        # The GitHub Actions app.
-        - actor_id: 15368
-          actor_type: Integration
-          bypass_mode: always
-      rules:
-        - type: deletion
-        - type: non_fast_forward
-        - type: merge_queue
-          parameters:
-            merge_method: SQUASH
-            max_entries_to_build: 2
-            min_entries_to_merge: 2
-            max_entries_to_merge: 5
-            min_entries_to_merge_wait_minutes: 3
-            grouping_strategy: HEADGREEN
-            check_response_timeout_minutes: 45
-        - type: pull_request
-          parameters:
-            allowed_merge_methods:
-              - squash
-            dismiss_stale_reviews_on_push: false
-            require_code_owner_review: false
-            require_last_push_approval: false
-            required_approving_review_count: 1
-            required_review_thread_resolution: true
-        - type: required_linear_history
-        - type: required_status_checks
-          parameters:
-            strict_required_status_checks_policy: false
-            required_status_checks:
-              - context: Required Checks
-              - context: Check License Headers
-              - context: Validate PR title
-
-    - name: Merge Queue
-      target: branch
-      enforcement: active
-      conditions:
-        ref_name:
-          exclude: []
-          include:
-            # Release branches carry these same rules in "Merge Queue
-            # (release)" above — a separate ruleset because its Actions
-            # bypass must not extend to main.
-            - "~DEFAULT_BRANCH"
       rules:
         - type: deletion
         - type: non_fast_forward

.github/workflows/direct-backport-push.yml

@@ -342,15 +342,6 @@ jobs:
     needs: discover
     if: ${{ needs.discover.outputs.has_push == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      # Everything this job's steps call, and nothing more: push the
-      # cherry-pick and comment on the commit (contents), dispatch Required
-      # Checks (actions), set the per-target commit status (statuses),
-      # annotate the original PR (issues).
-      actions: write
-      contents: write
-      issues: write
-      statuses: write
     name: "backport #${{ matrix.pr_number }} to ${{ matrix.target }}"
     strategy:
       fail-fast: false
@@ -365,12 +356,11 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          # Push with the default GITHUB_TOKEN: the release rulesets admit the
-          # GitHub Actions app as a bypass actor, while a PAT-authored push is
-          # evaluated as that person and rejected. A GITHUB_TOKEN push starts
-          # no downstream workflows, so the step after the cherry-pick
-          # dispatches Required Checks itself — workflow_dispatch runs are the
-          # documented exception that GITHUB_TOKEN may create.
+          # Use AUTO_MERGE_TOKEN (fine-grained PAT) so the push to the release
+          # branch retriggers workflows on that branch. GITHUB_TOKEN-authored
+          # pushes are excluded from triggering downstream workflows, which
+          # silences post-merge CI on backport commits.
+          token: ${{ secrets.AUTO_MERGE_TOKEN || secrets.GITHUB_TOKEN }}
       - name: Cherry-pick merge commit onto target branch
         id: cherry_pick
         env:
@@ -581,22 +571,6 @@ jobs:
           log "new_sha=${new_sha}"
           echo "new_sha=${new_sha}" >> "$GITHUB_OUTPUT"
 
-      - name: Run Required Checks on the pushed release branch
-        if: success()
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ matrix.target }}
-        run: |
-          # The GITHUB_TOKEN push above starts no push-triggered workflows;
-          # dispatch the run the release branch would otherwise have gotten.
-          # Best-effort: the backport itself has landed, so a dispatch
-          # failure must not demote this job to failed -- the failure
-          # reporter below would then claim a landed backport was lost.
-          if ! gh workflow run required-checks.yml \
-              --repo "${GITHUB_REPOSITORY}" --ref "${TARGET_BRANCH}"; then
-            echo "::warning::Could not start Required Checks on ${TARGET_BRANCH}; start it manually from the Actions tab."
-          fi
-
       - name: Annotate original PR and commit on success
         if: success()
         uses: actions/github-script@v9

.github/workflows/required-checks.yml

@@ -30,8 +30,6 @@ on:
       - labeled
       - unlabeled
   merge_group:
-  # Also dispatched by direct-backport-push.yml after its GITHUB_TOKEN push
-  # to a release branch, which starts no push-triggered runs.
   workflow_dispatch:
 
 permissions:

amber/dev-requirements.txt

@@ -42,5 +42,4 @@ textual==8.2.8
 
 # Reads bin/k8s/values.yaml in bin/k8s/tests/test_helm_values.sh. That check fails
 # rather than skipping when this is missing, so the suite cannot go green by accident.
-# Also read by .github/scripts/test_asf_rulesets.sh (infra job shell tests).
 PyYAML==6.0.2