You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by po...@apache.org on 2026/10/24 10:39:34 UTC
(magpie-site) branch main updated: Let committers merge a pull request over failed checks (#246)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie-site.git
The following commit(s) were added to refs/heads/main by this push:
new 6d56165 Let committers merge a pull request over failed checks (#246)
6d56165 is described below
commit 6d561653519885f2393fd09d5daae0e762489908
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Sat Oct 24 12:39:28 2026 +0200
Let committers merge a pull request over failed checks (#246)
Move main's protection from classic branch protection, which cannot be
bypassed from .asf.yaml, to two rulesets: one that blocks force-pushes and
deletion with no bypass, and one requiring lint and build that the
magpie-committers team may bypass through a pull request only. A browser
shard that times out on a slow Ubuntu mirror then no longer blocks a merge
that is otherwise ready.
Generated-by: Claude Opus 5
---
.asf.yaml | 62 +++++++++++++++++++++++++++++++++++++++++++-------------------
1 file changed, 43 insertions(+), 19 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
index 1079d6b..51b930a 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -30,26 +30,50 @@ github:
merge: false
rebase: false
- # Branch protection for main. Only checks that run on EVERY pull request may
- # be listed here: a required context whose workflow does not trigger is never
- # reported, and the pull request blocks forever with nothing to re-run.
- #
- # Deliberately NOT required:
- # asf-allowlist-check - path-filtered to .github/**, so it is absent on any
- # pull request that does not touch a workflow.
- # deploy - gated to refs/heads/main; never runs on a PR.
- # publish - PR previews: workflow_run / issue_comment /
- # workflow_dispatch; never a pull request check.
- # signal - preview-signal.yml; runs only on some PR events.
- protected_branches:
- main:
+ # Branch protection for main, as rulesets rather than classic protection,
+ # which has no way to let committers override a check. Classic protection
+ # and rulesets would both apply, so classic protection is removed.
+ protected_branches: ~
+ rulesets:
+ # Nobody bypasses this one: main is never force-pushed or deleted.
+ - name: "main history"
+ branches:
+ includes:
+ - "main"
+ restrict_deletion: true
+ restrict_force_push: true
+
+ # Only checks that run on EVERY pull request may be listed here: a
+ # required context whose workflow does not trigger is never reported, and
+ # the pull request blocks forever with nothing to re-run.
+ #
+ # Deliberately NOT required:
+ # asf-allowlist-check - path-filtered to .github/**, so it is absent on
+ # any pull request that does not touch a workflow.
+ # deploy - gated to refs/heads/main; never runs on a PR.
+ # publish - PR previews: workflow_run / issue_comment /
+ # workflow_dispatch; never a pull request check.
+ # signal - preview-signal.yml; runs only on some PR events.
+ #
+ # A committer can merge a pull request whose checks have not passed, e.g.
+ # when a browser shard timed out on the Ubuntu mirror (gh pr merge
+ # --admin). The bypass works through pull requests only, so nobody pushes
+ # to main directly.
+ - name: "main checks"
+ branches:
+ includes:
+ - "main"
+ bypass_teams:
+ - "magpie-committers"
+ bypass_mode: pull_request
+ restrict_deletion: false
+ restrict_force_push: false
required_status_checks:
- # Not strict: main moves quickly, and requiring every branch to be
- # up to date would mean rebasing each PR whenever anything merges.
- strict: false
- contexts:
- - lint
- - build
+ - lint
+ - build
+ # Not strict: main moves quickly, and requiring every branch to be up to
+ # date would mean rebasing each PR whenever anything merges.
+ required_status_checks_strict: false
notifications:
commits: commits@magpie.apache.org