potiuk commented on PR #75142: URL: https://github.com/apache/airflow/pull/75142#issuecomment-6384262890
Follow-up on the rulesets. The `airflow-committers` team is secret, and GitHub does not accept secret teams as ruleset bypass actors. So both CI rulesets now let the repository's **Write** role bypass them instead (`actor_type: RepositoryRole`, `actor_id: 4`). On this repository the Write role is held by exactly the committers, so nothing in `.asf.yaml` needs to change when committers join or leave. The asfyaml convenience syntax can only name teams, so the two rulesets use the raw payload syntax. That syntax cannot pin the required checks to the GitHub Actions app: asfyaml sends `integration_id` to the API as a string, and GitHub rejects it. So **CI passed** and **check-newsfragment-pr-number** are now matched by name, from any source. I validated the file with asfyaml's parser. I re-ran the earlier checks in a scratch repo with the same unpinned ruleset: - A failing **CI passed** check run followed by a green **CI passed** commit status on the same commit: the PR stays BLOCKED. The status cannot mask a red project CI run. - No check run, only a green **CI passed** commit status (the fork CI reconciler path): the PR becomes CLEAN. - Auto-merge enabled while **CI passed** is still running: the PR stays open and merges after the check succeeds. --- Drafted-by: Claude Code (Claude Opus 5.5); reviewed by @potiuk before posting -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
