Copilot commented on code in PR #3458:
URL: https://github.com/apache/iceberg-rust/pull/3458#discussion_r4275460018
##########
.asf.yaml:
##########
@@ -63,6 +63,15 @@ github:
- name: Merge Queue
target: branch
enforcement: active
+ bypass_actors:
+ # Breakglass for urgent fixes: committers can merge an approved PR
+ # without waiting for the queue or this ruleset's required checks.
+ # `pull_request` mode still blocks direct pushes. Uses the write
+ # repository role because ASF project teams are secret, and secret
+ # teams cannot be bypass actors.
Review Comment:
The numeric `actor_id: 4` is a magic value and (per PR description) is not
documented by GitHub, which makes this brittle for future maintainers. Consider
expanding the inline comment to include a reproducible way to re-derive/verify
the ID (e.g., the exact GraphQL query or API command used to confirm the role
mapping), and/or a pointer to where maintainers can validate effective bypass
(`.../rulesets/<id> --jq .current_user_can_bypass`) after deployment.
##########
.asf.yaml:
##########
@@ -63,6 +63,15 @@ github:
- name: Merge Queue
target: branch
enforcement: active
+ bypass_actors:
+ # Breakglass for urgent fixes: committers can merge an approved PR
+ # without waiting for the queue or this ruleset's required checks.
+ # `pull_request` mode still blocks direct pushes. Uses the write
+ # repository role because ASF project teams are secret, and secret
+ # teams cannot be bypass actors.
+ - actor_id: 4 # RepositoryRole "write"
+ actor_type: RepositoryRole
+ bypass_mode: pull_request
Review Comment:
Using the broad `RepositoryRole` = `write` as a bypass actor may
unintentionally grant bypass ability to non-committer principals that also have
`write` (e.g., service/bot accounts or other collaborators), which is wider
than the stated intent (“committers”). If the goal is strictly committers,
prefer targeting the specific custom repository role (committers) by its role
ID (if available), or a non-secret/public GitHub team that maps to committers.
If neither is possible, consider adding an explicit note in this comment about
known non-committer `write` actors (e.g., gitbox/bots) and why the risk is
acceptable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
