(iceberg-rust) branch gh-readonly-queue/main/pr-3481-1be091a2135a5908537a5b45786ae7207a723aab created (now 0a345f202)

[gi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

github-merge-queue[bot] pushed a change to branch gh-readonly-queue/main/pr-3481-1be091a2135a5908537a5b45786ae7207a723aab
in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git


      at 0a345f202 ci: replace classic branch protection with a ruleset so the bypass works (#3481)

This branch includes the following new commits:

     new 0a345f202 ci: replace classic branch protection with a ruleset so the bypass works (#3481)

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(iceberg-rust) 01/01: ci: replace classic branch protection with a ruleset so the bypass works (#3481)

[gi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

github-merge-queue[bot] pushed a commit to branch gh-readonly-queue/main/pr-3481-1be091a2135a5908537a5b45786ae7207a723aab
in repository https://gitbox.apache.org/repos/asf/iceberg-rust.git

commit 0a345f202d9233481884f0d7a3ae3a4b6181044b
Author: Kevin Liu <ke...@users.noreply.github.com>
AuthorDate: Mon Oct 19 23:53:31 2026 +0000

    ci: replace classic branch protection with a ruleset so the bypass works (#3481)
    
    * ci: move branch protection into the Merge Queue ruleset
    
    Classic branch protection can only be bypassed by admins, and while it
    exists GitHub blocks direct merges for the ruleset's bypass actors even
    when every requirement is met. Move the approval, linear-history,
    deletion and force-push rules into the Merge Queue ruleset and disable
    classic protection, as apache/seatunnel does, so iceberg-public members
    can use the breakglass. Requirements are otherwise unchanged.
    
    Co-authored-by: Copilot App <22...@users.noreply.github.com>
    
    * ci: keep the approval rule out of the bypassable ruleset
    
    Put deletion, force-push, linear-history and approval rules in a separate
    Branch Protection ruleset that only apache/root can bypass, so the
    iceberg-public breakglass skips only the merge queue and required checks.
    
    Co-authored-by: Copilot App <22...@users.noreply.github.com>
    
    * ci: use infra's default branch protection ruleset template
    
    Co-authored-by: Copilot App <22...@users.noreply.github.com>
    
    * ci: keep dismiss_stale_reviews explicit
    
    Co-authored-by: Copilot App <22...@users.noreply.github.com>
    
    ---------
    
    Co-authored-by: Copilot App <22...@users.noreply.github.com>
---
 .asf.yaml | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/.asf.yaml b/.asf.yaml
index 2b3dd9295..fbdde3222 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -33,14 +33,24 @@ github:
     squash_commit_message: PR_TITLE_AND_COMMIT_DETAILS
     merge: false
     rebase: false
-  protected_branches:
-    main:
+  # Disabled: GitHub blocks ruleset bypass while classic protection exists.
+  # The "Default Branch Protection" ruleset replaces it.
+  protected_branches: ~
+  rulesets:
+    - name: "Default Branch Protection"
+      type: branch
+      branches:
+        includes:
+          - "~DEFAULT_BRANCH"
+        excludes: []
+      bypass_teams:
+        - root
+      restrict_deletion: true
+      restrict_force_push: true
+      required_linear_history: true
       required_pull_request_reviews:
         required_approving_review_count: 1
         dismiss_stale_reviews: false
-
-      required_linear_history: true
-  rulesets:
     - name: Merge Queue
       target: branch
       enforcement: active