kevinjqliu opened a new pull request, #3458: URL: https://github.com/apache/iceberg-rust/pull/3458
## Which issue does this PR close? - N/A. Motivated by #3455: an approved lockfile bump for RUSTSEC advisories that is stuck waiting for `ubuntu-latest` runners. ## What changes are included in this PR? Adds a breakglass to the `Merge Queue` ruleset. Users with the write repository role (committers) can bypass it, but only when merging a PR (`bypass_mode: pull_request`), so direct pushes stay blocked. For an urgent, approved fix, a committer can tick "Merge without waiting for requirements to be met (bypass rules)" or run `gh pr merge --squash --admin` to skip the queue. The required status checks are still in classic branch protection, which only admins can bypass. A companion PR moves them into this ruleset so the bypass covers them as well. The two PRs are independent and apply cleanly in either order, but the breakglass needs both. Approvals and linear history stay in classic protection, so a PR must still be approved before it can be merged this way. The bypass actor is a role, not `iceberg-committers`. ASF project teams are secret, and GitHub excludes secret teams from bypass lists (INFRA-28376). ## Are these changes tested? - Validated with [apache/infrastructure-asfyaml](https://redirect.github.com/apache/infrastructure-asfyaml) at `83d367df`: schema validation (`run_parts(validate_only=True)`) and the generated ruleset payload, for this PR alone and combined with the companion PR. Passed. - Tested in a throwaway repo. Merge queues aren't available on personal repos, so the ruleset there held only a required check that never reports, with a `pull_request` bypass: - The PR merged as a single squash commit. - A direct push was rejected with GH013. - With the same check in classic protection under `enforce_admins`, the merge was rejected. - apache/seatunnel uses the same shape: merge queue, required checks and a `pull_request` team bypass in one ruleset. Its bypass actors have merged PRs that never entered the queue while the required `Build` check had timed out, for example [seatunnel PR 12603](https://redirect.github.com/apache/seatunnel/pull/12603). ## AI Disclosure Drafted with GitHub Copilot. Please check: - `actor_id: 4` maps to the `write` role. I confirmed this with GraphQL, but GitHub doesn't document it. - It's unverified whether a `write` bypass covers committers, who hold the custom `committers` role (based on write). After this applies, a committer can check with `gh api repos/apache/iceberg-rust/rulesets/22979505 --jq .current_user_can_bypass`, which should print `pull_requests_only`. If it doesn't, we need the custom role's ID or a public team from Infra. - The `write` role also includes the `asf-gitbox-commits` account, limited to PR merges. - No other ASF repo uses a `RepositoryRole` bypass actor yet. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
