(magpie) 01/01: infra(.asf.yaml): require one approving review on main

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch infra/require-review-on-main
in repository https://gitbox.apache.org/repos/asf/magpie.git

commit d7409e8e06f8de8030f6f680d4d61ef2a3eedfdf
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Sat Jul 11 15:11:05 2026 +0200

    infra(.asf.yaml): require one approving review on main
    
    Now that Apache Magpie is an established Top-Level Project with its own
    PMC, add branch protection requiring at least one approving review from
    a committer before any PR merges into `main`, replacing the bootstrap
    posture where a maintainer could self-merge after CI green.
    
      required_pull_request_reviews:
        required_approving_review_count: 1
        dismiss_stale_reviews: true
    
    dismiss_stale_reviews ensures the approving reviewer signs off on the
    final state of the diff after any further pushes. require_code_owner_reviews
    is left off — there is no CODEOWNERS file, so any committer's approval
    satisfies the requirement.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
 .asf.yaml | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/.asf.yaml b/.asf.yaml
index 94f7e7ec..794df645 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -111,17 +111,17 @@ github:
   # ever existed, so the protection now lives here next to the rest
   # of the repo config.
   #
-  # TEMPORARY POSTURE — REVISIT AT PMC FORMATION
-  # --------------------------------------------
-  # Pull-request approvals are intentionally NOT required while the
-  # framework is in its bootstrap phase under the Airflow PMC
-  # umbrella with a small set of committers (see MISSION.md). Once
-  # the project establishes its own PMC, this block MUST be
-  # revisited: add a `required_pull_request_reviews:` section with
-  # `required_approving_review_count: 1` (or higher) and
-  # `dismiss_stale_reviews` / `require_code_owner_reviews` tuned to
-  # the new committer / CODEOWNERS shape. Until then, status checks
-  # alone gate merges — a maintainer can self-merge after CI green.
+  # ONE APPROVING REVIEW REQUIRED ON `main`
+  # ---------------------------------------
+  # During the framework's bootstrap phase (running under the Airflow
+  # PMC umbrella with a small set of committers, see MISSION.md) PR
+  # approvals were NOT required and a maintainer could self-merge
+  # after CI green. Now that Magpie is a Top-Level Project with its
+  # own PMC, every PR into `main` requires at least one approving
+  # review from a committer
+  # (`required_pull_request_reviews.required_approving_review_count: 1`
+  # below), so self-merge without a second pair of eyes is no longer
+  # possible.
   protected_branches:
     main:
       # Required status checks. Listed contexts MUST run on every PR
@@ -173,8 +173,15 @@ github:
           # fails unless all succeed, so the gate semantics are the
           # same.
           - "tests-ok"
-      # `required_pull_request_reviews:` deliberately omitted — see
-      # the TEMPORARY POSTURE note above. Re-add at PMC formation.
+      # One approving review from a committer is required before any
+      # PR merges into `main` (see the note above). `dismiss_stale_reviews:
+      # true` — a new push after approval dismisses the stale approval,
+      # so the approving reviewer sees the final state of the diff.
+      # `require_code_owner_reviews` is left off: there is no CODEOWNERS
+      # file, so any committer's approval satisfies the requirement.
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+        dismiss_stale_reviews: true
       #
       # Linear history matches `enabled_merge_buttons.squash: true`
       # above — squash is the only enabled merge mode, so every