potiuk opened a new pull request, #75455: URL: https://github.com/apache/airflow/pull/75455
GitHub holds the CI runs of fork PRs until a maintainer approves them. With self-hosted runners ([AIP-118](https://cwiki.apache.org/confluence/x/-JXwGg), #74889) that gate becomes part of the trust model, but approving every push by hand doesn't scale and makes contributors wait. This adds an `Auto approve workflow runs` workflow that approves the runs that are cheap and can't change how CI works, and leaves the rest to maintainers with a `need workflow approval` label. related: #74889 ## What gets approved Every 30 minutes, using only `main`'s code (the PR's code is never checked out or run), `breeze ci approve-workflow-runs` approves the waiting runs of a commit started in the last 24 hours when: - the PR targets `main` - it changes nothing under `.github/`, `dev/breeze/` or `scripts/ci/` - it changes no dependency manifest or lock file and adds no new provider - selective checks need neither the full test set, all versions, a canary build nor a dependency upgrade - the selected jobs are estimated at no more than **310 job-minutes** on public runners (about a quarter of a full run) - it changes at most **100 lines of source code** (tests, docs, translations and lock files are not counted) The job summary lists each waiting PR with its decision, the expected job groups and the estimated job-minutes and wall-clock time. `--report-only` (or the `report-only` dispatch input) shows the decisions without approving or labelling. ## CI-minutes estimate `ci_minutes_estimate.py` turns selective-check outputs into job groups. The numbers are medians from 310 recent `Tests (AMD)` PR runs (224 of them with a partial provider set). Provider tests are weighted by the size of each provider's test suite. `dev/calibrate_ci_minutes_estimates.py` measures them again; `.github/AGENTS.md` asks agents to refresh them after workflow changes. RunsOn estimates come later, once there is data. ## Expected effect Replaying the rules on the 349 external fork PRs from 2026-10-09..23: 147 (42%) would be approved automatically, about 10 a day. That's about 20% of their estimated job-minutes (27.7k of 141k). The rest wait for a maintainer: | Reason | PRs | |---|---| | over 310 job-minutes | 122 | | CI files | 21 | | full tests | 21 | | dependencies | 16 | | over 100 source lines | 16 | | not targeting `main` | 6 | ## Verified - Approving a fork PR's `action_required` run with a workflow's `GITHUB_TOKEN` (`actions: write`) was tested in a scratch repository. It returned `201`, the run started within seconds, and a downstream `workflow_run` workflow still triggered. - The new `test_workflow_run_approval.py` and `test_ci_minutes_estimate.py` pass. The rest of the `dev/breeze` suite passes except two tests that depend on the local environment (the local AWS config and an SVN reproducibility check). - prek pre-commit and manual-stage hooks and `mypy-dev` pass. For it to cover returning contributors, the repository's fork-PR approval setting needs to become "Require approval for all external contributors" (ASF Infra). Today only first-time contributors wait for approval. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
