This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg-python.git
The following commit(s) were added to refs/heads/main by this push:
new d37149c8b move required status checks into Merge Queue ruleset (#4113)
d37149c8b is described below
commit d37149c8b5d1b737da0eb9fdcb585bc3ef3bac69
Author: Alex Stephen <[email protected]>
AuthorDate: Wed Oct 21 22:48:20 2026 +0000
move required status checks into Merge Queue ruleset (#4113)
* move required status checks into Merge Queue ruleset
* Let committers bypass the Merge Queue ruleset for urgent fixes
Replace classic branch protection with an equivalent ruleset, since
classic protection blocks ruleset bypass, and add apache/iceberg-public
as a pull-request bypass actor on the Merge Queue ruleset. Ports
apache/iceberg-rust#3458, #3481, and #3489.
* Move urgent PR merge docs to end of contributing guide
Keep the committer-only procedure out of the contributor setup flow, and
indent the code block 4 spaces so mkdocs renders it inside the list.
Co-authored-by: Copilot App <[email protected]>
---------
Co-authored-by: Kevin Liu <[email protected]>
Co-authored-by: Copilot App <[email protected]>
---
.asf.yaml | 64 ++++++++++++++++++++++++++++++---------------
AGENTS.md | 2 +-
mkdocs/docs/contributing.md | 14 ++++++++++
3 files changed, 58 insertions(+), 22 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
index f2d710ec8..347490f61 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -33,38 +33,60 @@ github:
squash: true
squash_commit_message: PR_TITLE_AND_COMMIT_DETAILS
rebase: true
- protected_branches:
- main:
- required_status_checks:
- contexts:
- # Repository policy and security checks.
- - Analyze Actions
- - Run zizmor 🌈
- - asf-allowlist-check
- - rat
-
- # Documentation checks.
- - docs
- - markdown-link-check
-
- # Python workflow gates.
- - python-ci-required
- - python-integration-required
-
+ # Disabled: GitHub blocks ruleset bypass while classic protection exists.
+ # The "Default Branch Protection" ruleset replaces it.
+ protected_branches: ~
+ rulesets:
+ - name: "Default Branch Protection"
+ type: branch
+ branches:
+ includes:
+ - "~DEFAULT_BRANCH"
+ excludes: []
+ bypass_teams:
+ - root
+ restrict_deletion: true
+ restrict_force_push: true
+ required_linear_history: true
required_pull_request_reviews:
required_approving_review_count: 1
-
- required_linear_history: true
- rulesets:
- name: Merge Queue
target: branch
enforcement: active
+ bypass_actors:
+ # apache/root (ASF Infra).
+ - actor_id: 118420
+ actor_type: Team
+ bypass_mode: always
+ # apache/iceberg-public. Iceberg committers can opt into this team via
+ # https://gitbox.apache.org/boxer/.
+ - actor_id: 20107235
+ actor_type: Team
+ bypass_mode: pull_request
conditions:
ref_name:
include:
- "~DEFAULT_BRANCH"
exclude: []
rules:
+ - type: required_status_checks
+ parameters:
+ # Merge Queue already tests each entry against the latest main
+ strict_required_status_checks_policy: false
+ required_status_checks:
+ # Repository policy and security checks.
+ - context: Analyze Actions
+ - context: Run zizmor 🌈
+ - context: asf-allowlist-check
+ - context: rat
+
+ # Documentation checks.
+ - context: docs
+ - context: markdown-link-check
+
+ # Python workflow gates.
+ - context: python-ci-required
+ - context: python-integration-required
- type: merge_queue
parameters:
check_response_timeout_minutes: 90
diff --git a/AGENTS.md b/AGENTS.md
index db95902ed..c13a75c39 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -68,7 +68,7 @@ lives under `pyiceberg/`, organized by concern rather than by
engine:
### Required CI and Merge Queue
-- Keep the `required_status_checks.contexts` list in `.asf.yaml` synchronized
whenever a required job/check is added, renamed, or removed. Each entry is a
job/check context name, not a workflow filename.
+- Keep the `required_status_checks` list in the `Merge Queue` ruleset in
`.asf.yaml` synchronized whenever a required job/check is added, renamed, or
removed. Each entry is a job/check context name, not a workflow filename.
- Verify that every required context reports for both `pull_request` and
`merge_group`. Its producer workflow must run on both events.
- When a workflow uses an aggregate required job, such as
`python-ci-required`, keep `if: always()` and its `needs` list in sync with
every job whose result should block merging.
- Do not use `pull_request` path filters in workflows that produce required
contexts. A skipped workflow does not report its required context, which blocks
pull requests and causes Merge Queue entries to time out.
diff --git a/mkdocs/docs/contributing.md b/mkdocs/docs/contributing.md
index 025109346..2e9cf126d 100644
--- a/mkdocs/docs/contributing.md
+++ b/mkdocs/docs/contributing.md
@@ -338,3 +338,17 @@ For the type annotation the types from the `Typing`
package are used.
### Third party libraries
PyIceberg naturally integrates into the rich Python ecosystem, however it is
important to be hesitant adding third party packages. Adding a lot of packages
makes the library heavyweight, and causes incompatibilities with other projects
if they use a different version of the library. Also, big libraries such as
`s3fs`, `adlfs`, `pyarrow`, `thrift` should be optional to avoid downloading
everything, while not being sure if is actually being used.
+
+## Merging an urgent PR
+
+Committers can merge an urgent, approved pull request without waiting for the
merge queue or required checks (for example, a security fix while CI is stuck).
Use this only when necessary; otherwise, let the merge queue run.
+
+<!-- markdown-link-check-disable-next-line -->
+1. Join the
[`apache/iceberg-public`](https://github.com/orgs/apache/teams/iceberg-public)
team via [Boxer](https://gitbox.apache.org/boxer/) (one-time; membership syncs
in about 15 minutes).
+2. Get the pull request approved by a committer.
+3. If the pull request is in the merge queue, click **Remove from queue**.
+4. Merge it directly:
+
+ ```sh
+ gh pr merge <number> --squash --admin
+ ```
