From 70da6fdf7c2ab405d2a6bade911a1fbd0be4fd88 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:07:40 -0700 Subject: [PATCH 1/7] ci: give GitHub Actions bypass on the release-branch ruleset Splits the Merge Queue ruleset in two, rules identical, so the release half can carry a bypass for the Actions app without extending it to main. Workflows (GITHUB_TOKEN) can then push release/* again, which revives direct-backport-push.yml's fast path, rejected by the ruleset since 2026-07-24 (#8377). People and PATs still face every rule. --- .asf.yaml | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/.asf.yaml b/.asf.yaml index 42316db44a0..434046e2b51 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -76,13 +76,63 @@ github: ref_name: exclude: [] include: + # Release branches carry these same rules in "Merge Queue + # (release)" below — a separate ruleset because its Actions + # bypass must not extend to main. - "~DEFAULT_BRANCH" + rules: + - type: deletion + - type: non_fast_forward + - type: merge_queue + parameters: + merge_method: SQUASH + max_entries_to_build: 2 + min_entries_to_merge: 2 + max_entries_to_merge: 5 + min_entries_to_merge_wait_minutes: 3 + grouping_strategy: HEADGREEN + check_response_timeout_minutes: 45 + - type: pull_request + parameters: + allowed_merge_methods: + - squash + dismiss_stale_reviews_on_push: false + require_code_owner_review: false + require_last_push_approval: false + required_approving_review_count: 1 + required_review_thread_resolution: true + - type: required_linear_history + - type: required_status_checks + parameters: + strict_required_status_checks_policy: false + required_status_checks: + - context: Required Checks + - context: Check License Headers + - context: Validate PR title + + # Rule-for-rule identical to "Merge Queue" above; split out so the bypass + # below stays off main. The bypass exempts actions performed as the GitHub + # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what + # direct-backport-push.yml's fast path pushes with (#8377). It cannot be + # scoped to a single workflow. People and PATs still face every rule. + - name: "Merge Queue (release)" + target: branch + enforcement: active + conditions: + ref_name: + exclude: [] + include: # Merge queue rules do NOT support wildcard ref patterns, so # release branches must be listed explicitly (not release/*). # Add each release line here as it is cut. - "refs/heads/release/v1.1" - "refs/heads/release/v1.2" - "refs/heads/release/v1.3" + bypass_actors: + # The GitHub Actions app. + - actor_id: 15368 + actor_type: Integration + bypass_mode: always rules: - type: deletion - type: non_fast_forward From 892b7bbae9d88f385cbdb375e83ceffd97dceb16 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:32:48 -0700 Subject: [PATCH 2/7] ci: create the release ruleset before shrinking the main one asfyaml applies rulesets in file order. With the new ruleset listed first, a rejected creation aborts the apply while today's protections still cover the release branches; the old order would shrink "Merge Queue" first and leave them uncovered if the creation then failed. --- .asf.yaml | 50 ++++++++++++++++++++++++++++---------------------- 1 file changed, 28 insertions(+), 22 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 434046e2b51..7e4f86a3757 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -69,17 +69,35 @@ github: rebase: false rulesets: - - name: Merge Queue + # Rule-for-rule identical to "Merge Queue" below; split out so the bypass + # here stays off main. The bypass exempts actions performed as the GitHub + # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what + # direct-backport-push.yml's fast path pushes with (#8377). It cannot be + # scoped to a single workflow. People and PATs still face every rule. + # + # Listed BEFORE "Merge Queue" deliberately: asfyaml applies rulesets in + # file order, so this one is created before that one stops covering the + # release branches. If GitHub rejects this ruleset, the apply aborts with + # the old protections fully intact; the failure order never leaves the + # release branches uncovered. + - name: "Merge Queue (release)" target: branch enforcement: active conditions: ref_name: exclude: [] include: - # Release branches carry these same rules in "Merge Queue - # (release)" below — a separate ruleset because its Actions - # bypass must not extend to main. - - "~DEFAULT_BRANCH" + # Merge queue rules do NOT support wildcard ref patterns, so + # release branches must be listed explicitly (not release/*). + # Add each release line here as it is cut. + - "refs/heads/release/v1.1" + - "refs/heads/release/v1.2" + - "refs/heads/release/v1.3" + bypass_actors: + # The GitHub Actions app. + - actor_id: 15368 + actor_type: Integration + bypass_mode: always rules: - type: deletion - type: non_fast_forward @@ -110,29 +128,17 @@ github: - context: Check License Headers - context: Validate PR title - # Rule-for-rule identical to "Merge Queue" above; split out so the bypass - # below stays off main. The bypass exempts actions performed as the GitHub - # Actions app — i.e. any workflow's GITHUB_TOKEN, which is what - # direct-backport-push.yml's fast path pushes with (#8377). It cannot be - # scoped to a single workflow. People and PATs still face every rule. - - name: "Merge Queue (release)" + - name: Merge Queue target: branch enforcement: active conditions: ref_name: exclude: [] include: - # Merge queue rules do NOT support wildcard ref patterns, so - # release branches must be listed explicitly (not release/*). - # Add each release line here as it is cut. - - "refs/heads/release/v1.1" - - "refs/heads/release/v1.2" - - "refs/heads/release/v1.3" - bypass_actors: - # The GitHub Actions app. - - actor_id: 15368 - actor_type: Integration - bypass_mode: always + # Release branches carry these same rules in "Merge Queue + # (release)" above — a separate ruleset because its Actions + # bypass must not extend to main. + - "~DEFAULT_BRANCH" rules: - type: deletion - type: non_fast_forward From b0ce484f828fd28e8a7b09b03c98da4c8b2f4116 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Thu, 3 Sep 2026 08:32:48 -0700 Subject: [PATCH 3/7] ci: push backports with GITHUB_TOKEN so the ruleset bypass applies The fast path has pushed with AUTO_MERGE_TOKEN since #4676, so GitHub evaluates that push as the PAT's owner, whom the Actions-app bypass does not cover. Pushing with the default GITHUB_TOKEN puts it under the bypass; the release-branch CI the PAT existed to retrigger is dispatched explicitly instead, which workflow_dispatch permits a GITHUB_TOKEN to do. --- .github/workflows/direct-backport-push.yml | 25 ++++++++++++++++------ .github/workflows/required-checks.yml | 3 +++ 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/.github/workflows/direct-backport-push.yml b/.github/workflows/direct-backport-push.yml index b67fcc90fc0..585f4efceab 100644 --- a/.github/workflows/direct-backport-push.yml +++ b/.github/workflows/direct-backport-push.yml @@ -22,7 +22,8 @@ on: - main permissions: - actions: read + # write: the fast path dispatches Required Checks after its push (below). + actions: write checks: read contents: write issues: write @@ -356,11 +357,12 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 - # Use AUTO_MERGE_TOKEN (fine-grained PAT) so the push to the release - # branch retriggers workflows on that branch. GITHUB_TOKEN-authored - # pushes are excluded from triggering downstream workflows, which - # silences post-merge CI on backport commits. - token: ${{ secrets.AUTO_MERGE_TOKEN || secrets.GITHUB_TOKEN }} + # Push with the default GITHUB_TOKEN: the release rulesets admit the + # GitHub Actions app as a bypass actor, while a PAT-authored push is + # evaluated as that person and rejected. A GITHUB_TOKEN push starts + # no downstream workflows, so the step after the cherry-pick + # dispatches Required Checks itself — workflow_dispatch runs are the + # documented exception that GITHUB_TOKEN may create. - name: Cherry-pick merge commit onto target branch id: cherry_pick env: @@ -571,6 +573,17 @@ jobs: log "new_sha=${new_sha}" echo "new_sha=${new_sha}" >> "$GITHUB_OUTPUT" + - name: Run Required Checks on the pushed release branch + if: success() + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TARGET_BRANCH: ${{ matrix.target }} + run: | + # The GITHUB_TOKEN push above starts no push-triggered workflows; + # dispatch the run the release branch would otherwise have gotten. + gh workflow run required-checks.yml \ + --repo "${GITHUB_REPOSITORY}" --ref "refs/heads/${TARGET_BRANCH}" + - name: Annotate original PR and commit on success if: success() uses: actions/github-script@v9 diff --git a/.github/workflows/required-checks.yml b/.github/workflows/required-checks.yml index 1db8a52668e..7b5e2214b15 100644 --- a/.github/workflows/required-checks.yml +++ b/.github/workflows/required-checks.yml @@ -22,6 +22,9 @@ on: branches: - 'main' - 'release/**' + # The backport fast path pushes release branches with GITHUB_TOKEN, which + # starts no push-triggered runs; it dispatches this workflow instead. + workflow_dispatch: pull_request: types: - opened From b7a773b8b7562340d7d8ceb9408366661928f1a7 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Fri, 4 Sep 2026 08:56:14 -0700 Subject: [PATCH 4/7] ci: fix the duplicate dispatch trigger and make the dispatch best-effort required-checks.yml already carried workflow_dispatch at the bottom of its trigger block, so the added one was a duplicate key -- PyYAML keeps the last silently, GitHub's loader rejects the file. The explanatory comment moves to the existing key instead. The dispatch after a fast-path push is now best-effort with a warning: the backport has landed by then, and a failed dispatch would otherwise trip the failure reporter into claiming the backport was lost. The ref uses the documented bare branch form, and actions: write shrinks from the workflow to the one job whose step dispatches. --- .github/workflows/direct-backport-push.yml | 21 +++++++++++++++++---- .github/workflows/required-checks.yml | 5 ++--- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/.github/workflows/direct-backport-push.yml b/.github/workflows/direct-backport-push.yml index 585f4efceab..6515b256aa8 100644 --- a/.github/workflows/direct-backport-push.yml +++ b/.github/workflows/direct-backport-push.yml @@ -22,8 +22,7 @@ on: - main permissions: - # write: the fast path dispatches Required Checks after its push (below). - actions: write + actions: read checks: read contents: write issues: write @@ -343,6 +342,15 @@ jobs: needs: discover if: ${{ needs.discover.outputs.has_push == 'true' }} runs-on: ubuntu-latest + permissions: + # Everything this job's steps call, and nothing more: push the + # cherry-pick and comment on the commit (contents), dispatch Required + # Checks (actions), per-target commit status (statuses), annotate the + # original PR (issues). + actions: write + contents: write + issues: write + statuses: write name: "backport #${{ matrix.pr_number }} to ${{ matrix.target }}" strategy: fail-fast: false @@ -581,8 +589,13 @@ jobs: run: | # The GITHUB_TOKEN push above starts no push-triggered workflows; # dispatch the run the release branch would otherwise have gotten. - gh workflow run required-checks.yml \ - --repo "${GITHUB_REPOSITORY}" --ref "refs/heads/${TARGET_BRANCH}" + # Best-effort: the backport itself has landed, so a dispatch + # failure must not demote this job to failed -- the failure + # reporter below would then claim a landed backport was lost. + if ! gh workflow run required-checks.yml \ + --repo "${GITHUB_REPOSITORY}" --ref "${TARGET_BRANCH}"; then + echo "::warning::Could not start Required Checks on ${TARGET_BRANCH}; start it manually from the Actions tab." + fi - name: Annotate original PR and commit on success if: success() diff --git a/.github/workflows/required-checks.yml b/.github/workflows/required-checks.yml index 7b5e2214b15..42b31d37fd8 100644 --- a/.github/workflows/required-checks.yml +++ b/.github/workflows/required-checks.yml @@ -22,9 +22,6 @@ on: branches: - 'main' - 'release/**' - # The backport fast path pushes release branches with GITHUB_TOKEN, which - # starts no push-triggered runs; it dispatches this workflow instead. - workflow_dispatch: pull_request: types: - opened @@ -33,6 +30,8 @@ on: - labeled - unlabeled merge_group: + # Also dispatched by direct-backport-push.yml after its GITHUB_TOKEN push + # to a release branch, which starts no push-triggered runs. workflow_dispatch: permissions: From 8570648e4118b760ad463e01d4bb83c47b3b1b04 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Fri, 4 Sep 2026 08:56:14 -0700 Subject: [PATCH 5/7] ci: assert the split rulesets stay identical and keys stay unique The two Merge Queue rulesets are one policy split so the release half can hold an Actions bypass that must not reach main; nothing else kept the copies equal. The same script parses .asf.yaml and every workflow with a duplicate-key-strict loader, the class of error a plain parse passes and GitHub's loader rejects. --- .github/scripts/test_asf_rulesets.sh | 96 ++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100755 .github/scripts/test_asf_rulesets.sh diff --git a/.github/scripts/test_asf_rulesets.sh b/.github/scripts/test_asf_rulesets.sh new file mode 100755 index 00000000000..f0f8eedb0a0 --- /dev/null +++ b/.github/scripts/test_asf_rulesets.sh @@ -0,0 +1,96 @@ +#!/usr/bin/env bash +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Invariants over the CI configuration that a plain YAML parse cannot see. +# +# 1. "Merge Queue" and "Merge Queue (release)" in .asf.yaml must carry +# identical rules: they are one policy split across two rulesets only so +# the release half can hold an Actions bypass that must not reach main. +# Nothing else keeps the copies from drifting apart. +# 2. .asf.yaml and every workflow must parse with a duplicate-key-strict +# loader. PyYAML silently keeps the last duplicate, but GitHub's loader +# rejects the file, so a duplicated trigger key passes local checks and +# then stops the workflow from ever starting. + +set -uo pipefail + +command -v python3 >/dev/null || { echo "python3 is required to run these tests" >&2; exit 1; } + +cd "$(git rev-parse --show-toplevel)" + +python3 - <<'EOF' +import glob +import sys + +import yaml + + +class StrictLoader(yaml.SafeLoader): + pass + + +def no_duplicates(loader, node, deep=False): + seen = set() + for key_node, _ in node.value: + key = loader.construct_object(key_node, deep=deep) + if key in seen: + raise yaml.YAMLError( + f"duplicate key {key!r} at line {key_node.start_mark.line + 1}" + ) + seen.add(key) + return yaml.SafeLoader.construct_mapping(loader, node, deep) + + +StrictLoader.add_constructor( + yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, no_duplicates +) + +failures = [] + +files = sorted(glob.glob(".github/workflows/*.yml")) + [".asf.yaml"] +for path in files: + with open(path) as fh: + try: + yaml.load(fh, StrictLoader) + except yaml.YAMLError as exc: + failures.append(f"{path}: {exc}") + +with open(".asf.yaml") as fh: + rulesets = { + r.get("name"): r + for r in yaml.safe_load(fh)["github"]["rulesets"] + if isinstance(r, dict) + } +main_rs = rulesets.get("Merge Queue") +release_rs = rulesets.get("Merge Queue (release)") +if main_rs is None or release_rs is None: + failures.append( + ".asf.yaml: expected rulesets named 'Merge Queue' and 'Merge Queue (release)'" + ) +elif main_rs["rules"] != release_rs["rules"]: + failures.append( + ".asf.yaml: 'Merge Queue' and 'Merge Queue (release)' rules differ -- " + "these are one policy in two rulesets; change both or neither" + ) + +for failure in failures: + print(f"FAIL: {failure}") +if failures: + sys.exit(1) +print(f"OK: {len(files)} files duplicate-key clean; Merge Queue rules identical") +EOF From a74f193a2b40a1e477e75b54f7717735ce525b42 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Fri, 4 Sep 2026 11:03:21 -0700 Subject: [PATCH 6/7] ci: pin PyYAML for the infra shell tests and assert bypass placement The infra job's only Python install is amber/dev-requirements.txt, and setup-python ships no PyYAML, so the new invariant check died on import in both legs -- the constraint release_branches.py already records. The check now also asserts what the split exists for: no bypass_actors on "Merge Queue", exactly the Actions app on "Merge Queue (release)". --- .github/scripts/test_asf_rulesets.sh | 19 ++++++++++++++++++- .github/workflows/direct-backport-push.yml | 4 ++-- amber/dev-requirements.txt | 1 + 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/scripts/test_asf_rulesets.sh b/.github/scripts/test_asf_rulesets.sh index f0f8eedb0a0..9836fd48d4b 100755 --- a/.github/scripts/test_asf_rulesets.sh +++ b/.github/scripts/test_asf_rulesets.sh @@ -30,6 +30,9 @@ set -uo pipefail command -v python3 >/dev/null || { echo "python3 is required to run these tests" >&2; exit 1; } +# Runners ship python3 but not necessarily PyYAML (see release_branches.py); +# CI installs it via amber/dev-requirements.txt. +python3 -c 'import yaml' 2>/dev/null || { echo "PyYAML is required (pip install pyyaml)" >&2; exit 1; } cd "$(git rev-parse --show-toplevel)" @@ -87,10 +90,24 @@ elif main_rs["rules"] != release_rs["rules"]: ".asf.yaml: 'Merge Queue' and 'Merge Queue (release)' rules differ -- " "these are one policy in two rulesets; change both or neither" ) +if main_rs is not None and "bypass_actors" in main_rs: + failures.append( + ".asf.yaml: 'Merge Queue' must not carry bypass_actors -- " + "keeping the bypass off main is what the split exists for" + ) +ACTIONS_APP = [{"actor_id": 15368, "actor_type": "Integration", "bypass_mode": "always"}] +if release_rs is not None and release_rs.get("bypass_actors") != ACTIONS_APP: + failures.append( + ".asf.yaml: 'Merge Queue (release)' bypass_actors must be exactly the " + "GitHub Actions app -- widen this list and the test together, deliberately" + ) for failure in failures: print(f"FAIL: {failure}") if failures: sys.exit(1) -print(f"OK: {len(files)} files duplicate-key clean; Merge Queue rules identical") +print( + f"OK: {len(files)} files duplicate-key clean; " + "Merge Queue rules identical; bypass only on the release ruleset" +) EOF diff --git a/.github/workflows/direct-backport-push.yml b/.github/workflows/direct-backport-push.yml index 6515b256aa8..149c6085566 100644 --- a/.github/workflows/direct-backport-push.yml +++ b/.github/workflows/direct-backport-push.yml @@ -345,8 +345,8 @@ jobs: permissions: # Everything this job's steps call, and nothing more: push the # cherry-pick and comment on the commit (contents), dispatch Required - # Checks (actions), per-target commit status (statuses), annotate the - # original PR (issues). + # Checks (actions), set the per-target commit status (statuses), + # annotate the original PR (issues). actions: write contents: write issues: write diff --git a/amber/dev-requirements.txt b/amber/dev-requirements.txt index 848104e776a..593c70d1308 100644 --- a/amber/dev-requirements.txt +++ b/amber/dev-requirements.txt @@ -42,4 +42,5 @@ textual==8.2.8 # Reads bin/k8s/values.yaml in bin/k8s/tests/test_helm_values.sh. That check fails # rather than skipping when this is missing, so the suite cannot go green by accident. +# Also read by .github/scripts/test_asf_rulesets.sh (infra job shell tests). PyYAML==6.0.2 From 7da8b077d61f2d77e00a43a7e6d02d1ff035e965 Mon Sep 17 00:00:00 2001 From: mengw15 <125719918+mengw15@users.noreply.github.com> Date: Fri, 4 Sep 2026 13:00:03 -0700 Subject: [PATCH 7/7] ci: assert the release ruleset stays listed first The header comment in .asf.yaml declares file order load-bearing (asfyaml applies rulesets in order, so the release ruleset must be created before the main one shrinks), but the test keyed the rulesets into a dict and could not see a reorder. Keep the parsed list and fail when 'Merge Queue (release)' no longer precedes 'Merge Queue'. Also give the pyyaml pin its own blank-line-separated group in dev-requirements.txt, matching the file. --- .github/scripts/test_asf_rulesets.sh | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/.github/scripts/test_asf_rulesets.sh b/.github/scripts/test_asf_rulesets.sh index 9836fd48d4b..66bd29c3dc6 100755 --- a/.github/scripts/test_asf_rulesets.sh +++ b/.github/scripts/test_asf_rulesets.sh @@ -74,11 +74,10 @@ for path in files: failures.append(f"{path}: {exc}") with open(".asf.yaml") as fh: - rulesets = { - r.get("name"): r - for r in yaml.safe_load(fh)["github"]["rulesets"] - if isinstance(r, dict) - } + ruleset_list = [ + r for r in yaml.safe_load(fh)["github"]["rulesets"] if isinstance(r, dict) + ] +rulesets = {r.get("name"): r for r in ruleset_list} main_rs = rulesets.get("Merge Queue") release_rs = rulesets.get("Merge Queue (release)") if main_rs is None or release_rs is None: @@ -101,6 +100,15 @@ if release_rs is not None and release_rs.get("bypass_actors") != ACTIONS_APP: ".asf.yaml: 'Merge Queue (release)' bypass_actors must be exactly the " "GitHub Actions app -- widen this list and the test together, deliberately" ) +names = [r.get("name") for r in ruleset_list] +if main_rs is not None and release_rs is not None and names.index( + "Merge Queue (release)" +) > names.index("Merge Queue"): + failures.append( + ".asf.yaml: 'Merge Queue (release)' must be listed before 'Merge Queue' -- " + "asfyaml applies rulesets in file order, and creating the release ruleset " + "before shrinking the main one is what keeps a rejected run fail-safe" + ) for failure in failures: print(f"FAIL: {failure}") @@ -108,6 +116,7 @@ if failures: sys.exit(1) print( f"OK: {len(files)} files duplicate-key clean; " - "Merge Queue rules identical; bypass only on the release ruleset" + "Merge Queue rules identical; bypass only on the release ruleset; " + "release ruleset listed first" ) EOF