This is an automated email from the ASF dual-hosted git repository.
CalvinKirs pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 117a6c69f92 [fix](build) Migrate branch protection to GitHub rulesets
(#70274)
117a6c69f92 is described below
commit 117a6c69f92c0cc76f56c9c3ec3fd067e2e9907e
Author: Calvin Kirs <[email protected]>
AuthorDate: Thu Nov 5 21:07:28 2026 +0800
[fix](build) Migrate branch protection to GitHub rulesets (#70274)
### Background
The repository uses .asf.yaml to manage required CI checks and pull
request reviews for master and seven release branches. ASF Infra
currently reconciles these settings through GitHub's classic branch
protection API.
### What problem does this PR solve?
Issue Number: None
Related PR: None
PR Type: Bugfix
Problem Summary:
ASF Infra reported that GitHub's classic branch protection API fails
with the number of required check contexts, without returning an
actionable error. Migrate all eight protected branches to
github.rulesets using the convenience syntax documented at
https://github.com/apache/infrastructure-asfyaml/blob/main/README.md#rulesets.
Preserve each branch's check names, non-strict status-check policy,
stale review dismissal, approval count, and Code Owner requirement, with
explicit deletion and force-push restrictions.
### Details
- **Frequency:** When Infra reconciles branch protection settings
affected by the GitHub API bug.
- **Root cause:** The classic branch protection API cannot process the
required check contexts reliably, as reported by Infra.
- **Why existing tests missed it:** This failure occurs in GitHub's
remote configuration API; Doris runtime tests do not exercise that API.
- **Fix:** Replace protected_branches with eight named branch rulesets,
using status-check name lists and required_status_checks_strict: false.
Removing protected_branches lets ASF Infra remove the legacy rules
during reconciliation.
- **Other paths and branches:** Cover master and branch-4.2, branch-4.1,
branch-4.0, branch-3.1, branch-3.0, branch-2.1, and branch-2.0. Leave
repository metadata, merge buttons, collaborators, and notifications
unchanged.
- **Behavior change:** Configure branch protection through active
rulesets instead of classic protection. No bypass teams are configured.
### Testing
- ASF's asfyaml-validate --repo <worktree> --branch master passed
locally using apache/infrastructure-asfyaml at ebc4a47.
- Parsed the GitHub configuration through the official schema and
normalized all eight rulesets through the official payload builder.
Verified branch scope, active enforcement, deletion and force-push
restrictions, exact check names and any-source integration IDs,
non-strict policy, and review parameters against the original
configuration.
- git diff --check passed. No Doris build or runtime tests are needed
for this configuration-only change.
### Notes for Reviewers
Live GitHub reconciliation has not been performed; it occurs after the
configuration is merged into the default branch. Rulesets have no
implicit administrator bypass, and this configuration does not add
bypass actors.
### Release note
None
### Check List (For Author)
- Behavior changed: Yes (see Details)
- Does this need documentation: No
- Pre-submission status: Partially verified: local schema and payload
checks passed; live GitHub reconciliation has not been performed.
### AI Disclosure
- Tool: Codex (GPT-6)
- Generated: .asf.yaml migration and this pull request description.
- Human review: Pending.
---
.asf.yaml | 298 +++++++++++++++++++++++++++++++++++---------------------------
1 file changed, 169 insertions(+), 129 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
index ca9e5e0c381..a790c06cbbf 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -41,171 +41,211 @@ github:
squash: true
merge: false
rebase: false
- protected_branches:
- master:
+ rulesets:
+ - name: "Branch Protection: master"
+ type: branch
+ branches:
+ includes:
+ - master
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - Check for secrets
- - Clang Formatter
- - CheckStyle
- - P0 Regression (Doris Regression)
- - NonConcurrent Regression (nonConcurrent)
- - External Regression (Doris External Regression)
- - cloud_p0 (Doris Cloud Regression)
- - vault_p0 (Doris Cloud Regression)
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - Build Third Party Libraries (Linux)
- - Build Third Party Libraries (macOS)
- - Build Third Party Libraries (macOS-arm64)
- - COMPILE (DORIS_COMPILE)
- - code-review
- - Cloud UT (Doris Cloud UT)
- - performance (Doris Performance)
+ - License Check
+ - Check for secrets
+ - Clang Formatter
+ - CheckStyle
+ - P0 Regression (Doris Regression)
+ - NonConcurrent Regression (nonConcurrent)
+ - External Regression (Doris External Regression)
+ - cloud_p0 (Doris Cloud Regression)
+ - vault_p0 (Doris Cloud Regression)
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - Build Third Party Libraries (Linux)
+ - Build Third Party Libraries (macOS)
+ - Build Third Party Libraries (macOS-arm64)
+ - COMPILE (DORIS_COMPILE)
+ - code-review
+ - Cloud UT (Doris Cloud UT)
+ - performance (Doris Performance)
required_pull_request_reviews:
dismiss_stale_reviews: true
require_code_owner_reviews: true
required_approving_review_count: 1
- branch-4.2:
+ - name: "Branch Protection: branch-4.2"
+ type: branch
+ branches:
+ includes:
+ - branch-4.2
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - Clang Formatter
- - CheckStyle
- - Build Broker
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - Cloud UT (Doris Cloud UT)
- - COMPILE (DORIS_COMPILE)
- - P0 Regression (Doris Regression)
- - NonConcurrent Regression (nonConcurrent)
- - External Regression (Doris External Regression)
- - cloud_p0 (Doris Cloud Regression)
- - vault_p0 (Doris Cloud Regression)
+ - License Check
+ - Clang Formatter
+ - CheckStyle
+ - Build Broker
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - Cloud UT (Doris Cloud UT)
+ - COMPILE (DORIS_COMPILE)
+ - P0 Regression (Doris Regression)
+ - NonConcurrent Regression (nonConcurrent)
+ - External Regression (Doris External Regression)
+ - cloud_p0 (Doris Cloud Regression)
+ - vault_p0 (Doris Cloud Regression)
required_pull_request_reviews:
require_code_owner_reviews: true
required_approving_review_count: 1
dismiss_stale_reviews: true
- branch-4.1:
+ - name: "Branch Protection: branch-4.1"
+ type: branch
+ branches:
+ includes:
+ - branch-4.1
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - Clang Formatter
- - CheckStyle
- - Build Broker
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - Cloud UT (Doris Cloud UT)
- - COMPILE (DORIS_COMPILE)
- - P0 Regression (Doris Regression)
- - NonConcurrent Regression (nonConcurrent)
- - External Regression (Doris External Regression)
- - cloud_p0 (Doris Cloud Regression)
- - vault_p0 (Doris Cloud Regression)
+ - License Check
+ - Clang Formatter
+ - CheckStyle
+ - Build Broker
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - Cloud UT (Doris Cloud UT)
+ - COMPILE (DORIS_COMPILE)
+ - P0 Regression (Doris Regression)
+ - NonConcurrent Regression (nonConcurrent)
+ - External Regression (Doris External Regression)
+ - cloud_p0 (Doris Cloud Regression)
+ - vault_p0 (Doris Cloud Regression)
required_pull_request_reviews:
require_code_owner_reviews: true
required_approving_review_count: 1
dismiss_stale_reviews: true
- branch-4.0:
+ - name: "Branch Protection: branch-4.0"
+ type: branch
+ branches:
+ includes:
+ - branch-4.0
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - Clang Formatter
- - CheckStyle
- - Build Broker
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - Cloud UT (Doris Cloud UT)
- - COMPILE (DORIS_COMPILE)
- - P0 Regression (Doris Regression)
- - NonConcurrent Regression (nonConcurrent)
- - External Regression (Doris External Regression)
- - cloud_p0 (Doris Cloud Regression)
- - vault_p0 (Doris Cloud Regression)
+ - License Check
+ - Clang Formatter
+ - CheckStyle
+ - Build Broker
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - Cloud UT (Doris Cloud UT)
+ - COMPILE (DORIS_COMPILE)
+ - P0 Regression (Doris Regression)
+ - NonConcurrent Regression (nonConcurrent)
+ - External Regression (Doris External Regression)
+ - cloud_p0 (Doris Cloud Regression)
+ - vault_p0 (Doris Cloud Regression)
required_pull_request_reviews:
require_code_owner_reviews: true
required_approving_review_count: 1
dismiss_stale_reviews: true
- branch-3.1:
+ - name: "Branch Protection: branch-3.1"
+ type: branch
+ branches:
+ includes:
+ - branch-3.1
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - Clang Formatter
- - CheckStyle
- - Build Broker
- - Build Third Party Libraries (Linux)
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - Cloud UT (Doris Cloud UT)
- - COMPILE (DORIS_COMPILE)
- - P0 Regression (Doris Regression)
- - NonConcurrent Regression (nonConcurrent)
- - External Regression (Doris External Regression)
- - cloud_p0 (Doris Cloud Regression)
- - vault_p0 (Doris Cloud Regression)
+ - License Check
+ - Clang Formatter
+ - CheckStyle
+ - Build Broker
+ - Build Third Party Libraries (Linux)
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - Cloud UT (Doris Cloud UT)
+ - COMPILE (DORIS_COMPILE)
+ - P0 Regression (Doris Regression)
+ - NonConcurrent Regression (nonConcurrent)
+ - External Regression (Doris External Regression)
+ - cloud_p0 (Doris Cloud Regression)
+ - vault_p0 (Doris Cloud Regression)
required_pull_request_reviews:
require_code_owner_reviews: true
required_approving_review_count: 1
dismiss_stale_reviews: true
- branch-3.0:
+ - name: "Branch Protection: branch-3.0"
+ type: branch
+ branches:
+ includes:
+ - branch-3.0
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - Clang Formatter
- - CheckStyle
- - Build Broker
- - Build Third Party Libraries (Linux)
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - Cloud UT (Doris Cloud UT)
- - COMPILE (DORIS_COMPILE)
- - P0 Regression (Doris Regression)
- - NonConcurrent Regression (nonConcurrent)
- - External Regression (Doris External Regression)
- - cloud_p0 (Doris Cloud Regression)
- - vault_p0 (Doris Cloud Regression)
+ - License Check
+ - Clang Formatter
+ - CheckStyle
+ - Build Broker
+ - Build Third Party Libraries (Linux)
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - Cloud UT (Doris Cloud UT)
+ - COMPILE (DORIS_COMPILE)
+ - P0 Regression (Doris Regression)
+ - NonConcurrent Regression (nonConcurrent)
+ - External Regression (Doris External Regression)
+ - cloud_p0 (Doris Cloud Regression)
+ - vault_p0 (Doris Cloud Regression)
required_pull_request_reviews:
require_code_owner_reviews: true
required_approving_review_count: 1
dismiss_stale_reviews: true
- branch-2.1:
+ - name: "Branch Protection: branch-2.1"
+ type: branch
+ branches:
+ includes:
+ - branch-2.1
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - CheckStyle
- - Build Broker
- - Build Third Party Libraries (Linux)
- - COMPILE (DORIS_COMPILE)
- - External Regression (Doris External Regression)
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - P0 Regression (Doris Regression)
+ - License Check
+ - CheckStyle
+ - Build Broker
+ - Build Third Party Libraries (Linux)
+ - COMPILE (DORIS_COMPILE)
+ - External Regression (Doris External Regression)
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - P0 Regression (Doris Regression)
required_pull_request_reviews:
require_code_owner_reviews: true
required_approving_review_count: 1
dismiss_stale_reviews: true
- branch-2.0:
+ - name: "Branch Protection: branch-2.0"
+ type: branch
+ branches:
+ includes:
+ - branch-2.0
+ restrict_deletion: true
+ restrict_force_push: true
+ required_status_checks_strict: false
required_status_checks:
- strict: false
- contexts:
- - License Check
- - CheckStyle
- - P0 Regression (Doris Regression)
- - External Regression (Doris External Regression)
- - FE UT (Doris FE UT)
- - BE UT (Doris BE UT)
- - Build Broker
- - Build Third Party Libraries (Linux)
- - Build Third Party Libraries (macOS)
- - COMPILE (DORIS_COMPILE)
+ - License Check
+ - CheckStyle
+ - P0 Regression (Doris Regression)
+ - External Regression (Doris External Regression)
+ - FE UT (Doris FE UT)
+ - BE UT (Doris BE UT)
+ - Build Broker
+ - Build Third Party Libraries (Linux)
+ - Build Third Party Libraries (macOS)
+ - COMPILE (DORIS_COMPILE)
required_pull_request_reviews:
dismiss_stale_reviews: true
required_approving_review_count: 1
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
