You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/10/19 21:17:23 UTC
[PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
potiuk opened a new pull request, #75142:
URL: https://github.com/apache/airflow/pull/75142
Enables GitHub auto-merge for PRs to `main`, as proposed in [LAZY CONSENSUS] Enable auto-merge for PRs (link to be added).
**How it works.** A committer approves a PR and clicks *Enable auto-merge* (or `gh pr merge --squash --auto`); GitHub squash-merges it once it is approved, conversations are resolved and the required checks are green. A push by the PR author disables auto-merge, so the author cannot change the PR after approval.
**What changes**
- `.asf.yaml`: `allow_auto_merge: true`, plus a "Require CI on main" ruleset that requires two checks from GitHub Actions: **CI passed** and **check-newsfragment-pr-number**. The `airflow-committers` team can bypass it.
- A new **CI passed** job in `ci-amd.yml` (mirrored in `ci-arm.yml`, which must stay in sync). It always runs and fails if any other CI job failed or was cancelled. Jobs skipped by selective checks count as passed, so PRs that run only part of the tests still get a result.
- A `check-ci-gate-needs` prek hook (with tests) that fails if a CI job is missing from the gate's `needs`.
- `check-newsfragment-pr-number` now also runs on `labeled`/`unlabeled`, so adding the *skip newsfragment check* label clears a failed run instead of leaving a stale required failure.
- Committer docs in `dev/README_AIRFLOW3_DEV.md`.
**Why it failed in 2025, and what's different now.** Auto-merge was enabled as an experiment in #49746 and turned off a few days later (#50009, #50049).
- To stop auto-merge from merging before CI finished, "Finalize tests" became a required check. That removed the escape hatch: when CI was red for an unrelated reason, nobody could merge.
- It was also switched on without a dev@ discussion first.
Today, `.asf.yaml` rulesets support `bypass_teams`, so committers can still merge past an unrelated red check via *bypass rules*. That's the override the 2025 thread asked for (INFRA-26779). And this change goes through a lazy consensus first.
**Why a new check rather than "Finalize tests".** "Finalize tests" is skipped when tests fail, and GitHub counts a skipped required check as passed, so requiring it would let auto-merge merge red PRs. The dedicated gate always reports a real result.
**What auto-merge does not wait for:** CodeQL (its check names depend on the languages detected), and the path-filtered Dependency review and Registry tests. These are listed in the docs. A PR that edits `.github/workflows/` runs its own copy of the gate, so the docs ask committers to review such changes before enabling auto-merge. The gate is a convenience, not a security boundary; the committer's review still is.
**Note for AIP-120:** fork-CI PRs don't run project CI, so they won't produce **CI passed**. The AIP-120 PRs need to account for that before they merge.
Tested: the gate hook (7 tests) and the hook itself on the real workflows; the CI workflows stay in sync; prek passes (except `lychee`, which needs Docker locally).
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5)
Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "o-nikolas (via GitHub)" <gi...@apache.org>.
o-nikolas commented on code in PR #75142:
URL: https://github.com/apache/airflow/pull/75142#discussion_r4338844542
##########
dev/README_AIRFLOW3_DEV.md:
##########
@@ -179,6 +180,41 @@ PRs should **never** target `v2-11-stable` directly unless explicitly instructed
The following sections explains the protocol for merging PRs.
+## Auto-merge
+
+Auto-merge is enabled for PRs targeting `main`. Instead of waiting for CI to finish, approve the PR and
+click **Enable auto-merge** (or run `gh pr merge <number> --squash --auto`). GitHub squash-merges the PR
+as soon as it has an approval, its conversations are resolved and the required checks are green. Any
+committer can cancel it with **Disable auto-merge**. A push by the PR author (or anyone else without
+write access) disables auto-merge, so the author cannot change the PR after you approved it; review the
+new commits and enable it again. Pushes by committers keep it enabled.
+
+Auto-merge is enabled for the whole repository, so every branch that PRs target requires CI. The
+"Require CI on release branches" ruleset requires **CI passed** on the release, providers, chart and
+`airflow-ctl` branches. A release branch gets the **CI passed** job only once it is backported there; until
+then, its PRs never report the check, and a committer merges them by bypassing the rule. Backport the job to
+the active release branches when this lands.
+
+The `main` ruleset requires two checks. **CI passed** is a job in the `Tests (AMD)` workflow that always
Review Comment:
It looks like arm as well, judging by the PR changes?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #75142:
URL: https://github.com/apache/airflow/pull/75142#issuecomment-6384262890
Follow-up on the rulesets. The `airflow-committers` team is secret, and GitHub does not accept secret teams as ruleset bypass actors. So both CI rulesets now let the repository's **Write** role bypass them instead (`actor_type: RepositoryRole`, `actor_id: 4`). On this repository the Write role is held by exactly the committers, so nothing in `.asf.yaml` needs to change when committers join or leave. The asfyaml convenience syntax can only name teams, so the two rulesets use the raw payload syntax. That syntax cannot pin the required checks to the GitHub Actions app: asfyaml sends `integration_id` to the API as a string, and GitHub rejects it. So **CI passed** and **check-newsfragment-pr-number** are now matched by name, from any source. I validated the file with asfyaml's parser.
I re-ran the earlier checks in a scratch repo with the same unpinned ruleset:
- A failing **CI passed** check run followed by a green **CI passed** commit status on the same commit: the PR stays BLOCKED. The status cannot mask a red project CI run.
- No check run, only a green **CI passed** commit status (the fork CI reconciler path): the PR becomes CLEAN.
- Auto-merge enabled while **CI passed** is still running: the PR stays open and merges after the check succeeds.
---
Drafted-by: Claude Code (Claude Opus 5.5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #75142:
URL: https://github.com/apache/airflow/pull/75142
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #75142:
URL: https://github.com/apache/airflow/pull/75142#issuecomment-6384141350
### Backport successfully created: v3-4-test
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-4-test</td>
<td><a href="https://github.com/apache/airflow/pull/75550"><img src="https://img.shields.io/badge/PR-75550-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #75142:
URL: https://github.com/apache/airflow/pull/75142#issuecomment-6383188378
Merge order with AIP-120: this PR goes in first, the fork CI stack (#74819 → #74825) after it. Until #74819 adds its condition to `build-info`, the gate job always reports as "CI passed", and the "CI passed (project CI not run)" name only starts to appear once the fork CI gate lands. From then on the fork CI reconciler (#74822) posts the "CI passed" status for PRs whose fork run is green and trusted, so gated PRs can auto-merge too.
I verified the two GitHub behaviours this relies on in a scratch repo with the same ruleset shape:
- `gh pr merge --squash --auto` run by a ruleset bypass actor while the required check is in progress does **not** merge immediately - the PR stays BLOCKED and merges once "CI passed" is green.
- A failing "CI passed" check run is not overridden by a successful "CI passed" commit status from `github-actions` on the same commit - the PR stays BLOCKED. So the reconciler's status cannot mask a red project CI run (e.g. after "use project ci").
---
Drafted-by: Claude Code (Claude Opus 5.5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "o-nikolas (via GitHub)" <gi...@apache.org>.
o-nikolas commented on code in PR #75142:
URL: https://github.com/apache/airflow/pull/75142#discussion_r4338822658
##########
dev/README_AIRFLOW3_DEV.md:
##########
@@ -179,6 +180,41 @@ PRs should **never** target `v2-11-stable` directly unless explicitly instructed
The following sections explains the protocol for merging PRs.
+## Auto-merge
+
+Auto-merge is enabled for PRs targeting `main`. Instead of waiting for CI to finish, approve the PR and
+click **Enable auto-merge** (or run `gh pr merge <number> --squash --auto`). GitHub squash-merges the PR
+as soon as it has an approval, its conversations are resolved and the required checks are green. Any
+committer can cancel it with **Disable auto-merge**. A push by the PR author (or anyone else without
+write access) disables auto-merge, so the author cannot change the PR after you approved it; review the
+new commits and enable it again. Pushes by committers keep it enabled.
+
+Auto-merge is enabled for the whole repository, so every branch that PRs target requires CI. The
+"Require CI on release branches" ruleset requires **CI passed** on the release, providers, chart and
+`airflow-ctl` branches. A release branch gets the **CI passed** job only once it is backported there; until
+then, its PRs never report the check, and a committer merges them by bypassing the rule. Backport the job to
+the active release branches when this lands.
Review Comment:
This portion is a request for immediate action (you've already added the label) I'm not sure it should stay in the readme.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "o-nikolas (via GitHub)" <gi...@apache.org>.
o-nikolas commented on code in PR #75142:
URL: https://github.com/apache/airflow/pull/75142#discussion_r4338851360
##########
.github/workflows/ci-arm.yml:
##########
@@ -1240,6 +1240,64 @@ jobs:
use-uv: ${{ needs.build-info.outputs.use-uv }}
debug-resources: ${{ needs.build-info.outputs.debug-resources }}
+ ci-passed:
Review Comment:
Is there a way to not have this be a copy/paste of the ci-amd version? Is there a prek hook or other mechanism we can use to keep them in sync if not?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Enable auto-merge, gated on a dedicated CI passed check [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #75142:
URL: https://github.com/apache/airflow/pull/75142#discussion_r4366869922
##########
dev/README_AIRFLOW3_DEV.md:
##########
@@ -179,6 +180,41 @@ PRs should **never** target `v2-11-stable` directly unless explicitly instructed
The following sections explains the protocol for merging PRs.
+## Auto-merge
+
+Auto-merge is enabled for PRs targeting `main`. Instead of waiting for CI to finish, approve the PR and
+click **Enable auto-merge** (or run `gh pr merge <number> --squash --auto`). GitHub squash-merges the PR
+as soon as it has an approval, its conversations are resolved and the required checks are green. Any
+committer can cancel it with **Disable auto-merge**. A push by the PR author (or anyone else without
+write access) disables auto-merge, so the author cannot change the PR after you approved it; review the
+new commits and enable it again. Pushes by committers keep it enabled.
+
+Auto-merge is enabled for the whole repository, so every branch that PRs target requires CI. The
+"Require CI on release branches" ruleset requires **CI passed** on the release, providers, chart and
+`airflow-ctl` branches. A release branch gets the **CI passed** job only once it is backported there; until
+then, its PRs never report the check, and a committer merges them by bypassing the rule. Backport the job to
+the active release branches when this lands.
Review Comment:
Agreed - removed in ce0853cb0c. The README now only describes how the release-branch ruleset behaves; the backports of the "CI passed" job to the active release branches will be follow-up PRs, not an instruction in the docs.
---
Drafted-by: Claude Code (Claude Opus 5.5); reviewed by @potiuk before posting
##########
dev/README_AIRFLOW3_DEV.md:
##########
@@ -179,6 +180,41 @@ PRs should **never** target `v2-11-stable` directly unless explicitly instructed
The following sections explains the protocol for merging PRs.
+## Auto-merge
+
+Auto-merge is enabled for PRs targeting `main`. Instead of waiting for CI to finish, approve the PR and
+click **Enable auto-merge** (or run `gh pr merge <number> --squash --auto`). GitHub squash-merges the PR
+as soon as it has an approval, its conversations are resolved and the required checks are green. Any
+committer can cancel it with **Disable auto-merge**. A push by the PR author (or anyone else without
+write access) disables auto-merge, so the author cannot change the PR after you approved it; review the
+new commits and enable it again. Pushes by committers keep it enabled.
+
+Auto-merge is enabled for the whole repository, so every branch that PRs target requires CI. The
+"Require CI on release branches" ruleset requires **CI passed** on the release, providers, chart and
+`airflow-ctl` branches. A release branch gets the **CI passed** job only once it is backported there; until
+then, its PRs never report the check, and a committer merges them by bypassing the rule. Backport the job to
+the active release branches when this lands.
+
+The `main` ruleset requires two checks. **CI passed** is a job in the `Tests (AMD)` workflow that always
Review Comment:
Yes - PRs only run `Tests (AMD)`, so the required check comes from there, but `Tests (ARM)` has the identical job for its push and scheduled runs. The README now says so (ce0853cb0c).
---
Drafted-by: Claude Code (Claude Opus 5.5); reviewed by @potiuk before posting
##########
.github/workflows/ci-arm.yml:
##########
@@ -1240,6 +1240,64 @@ jobs:
use-uv: ${{ needs.build-info.outputs.use-uv }}
debug-resources: ${{ needs.build-info.outputs.debug-resources }}
+ ci-passed:
Review Comment:
It is a copy by necessity - GitHub Actions has no cross-file include, and the gate has to list every job of its own workflow in `needs:`, so it cannot live in a reusable workflow. They cannot drift though: `check-ci-workflows-in-sync` already requires `ci-amd.yml` and `ci-arm.yml` to be byte-identical apart from a short documented list of divergences, and the gate job is not on that list - editing one copy without the other fails static checks.
---
Drafted-by: Claude Code (Claude Opus 5.5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org