[PR] Require one ci-passed check on main, with a committer bypass and auto-merge [magpie-site]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #251:
URL: https://github.com/apache/magpie-site/pull/251

   `main` has had no required status check since #246 merged. Its "main checks" ruleset was never created: on every `.asf.yaml` run since, ASF Infra has reported `Validation failed while creating ruleset 'main checks': ['Actor magpie committers team must be part of the ruleset source or owner organization']`. GitHub refused `magpie-committers`, a secret team, as a bypass actor. Only "main history" (no deletion, no force-push) was created, and classic protection was removed as intended.
   
   This sets `main` up the way apache/infrastructure-actions is:
   
   - **One required check, `ci-passed`**, in a ruleset whose bypass actors are repository roles rather than a team: write access with `bypass_mode: pull_request`, so a committer can merge a pull request past the checks (`gh pr merge --admin`, e.g. when a browser shard timed out on a slow runner) but never push past them, and admins always. infrastructure-actions' ruleset reports `current_user_can_bypass: pull_requests_only` for a committer there. It uses the raw ruleset syntax, as roles have no convenience key, and replaces both of #246's rulesets.
   - **Classic protection** stays only as `main: {}`, which keeps `main` from being force-pushed or deleted.
   - **`ci-passed`** is a new last job in `build.yml`, like apache/magpie's `tests-ok`. It needs `changes`, `lint`, `browser` and `build`, runs with `if: always()`, and fails when any of them failed or was cancelled. `build` alone could not be required: it is skipped when a need fails, and a skipped required check counts as passing, which is how #245 showed mergeable with a failed browser suite. Jobs skipped on purpose, like the browser suites on a PR that changes neither the site nor the tests, are fine.
   - **`allow_auto_merge` and `allow_update_branch`** under `pull_requests`, as in apache/magpie, so a PR can merge itself once `ci-passed` is green.
   - `scripts/preview-workflows.test.mjs` checks that `ci-passed` needs every other job but `deploy`, so a job added later cannot fail without blocking a merge, and that the ruleset requires it alone.
   
   The file passes asfyaml's schema check. Its rulesets directive, run against a fake GitHub, creates "Required checks" with exactly infrastructure-actions' bypass actors and, given #246's rulesets as the previous config, deletes "main history".
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Require one ci-passed check on main, with a committer bypass and auto-merge [magpie-site]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #251:
URL: https://github.com/apache/magpie-site/pull/251


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org