This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/logging-parent.git
The following commit(s) were added to refs/heads/main by this push:
new 4c425e1 Switch to GitHub Rulesets (second attempt) (#477)
4c425e1 is described below
commit 4c425e1046e5cddbd5d8087116e73e52384cebf0
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Sun Aug 16 19:16:57 2026 +0200
Switch to GitHub Rulesets (second attempt) (#477)
* Switch to GitHub Rulesets (second attempt)
The first attempt (#456) had to be reverted in #471 because a bug in
ASFYaml made the resulting rulesets impossible to modify or remove through
`.asf.yaml`. We rolled back to the legacy `protected_branches` configuration.
apache/infrastructure-asfyaml#93 has now landed and addresses the
underlying issues (broken `app_slug` resolution, silent REST API failures,
missing `refs/heads/` / `refs/tags/` prefixing), so we can move back to
Rulesets.
The benefits over `protected_branches` remain:
- Tag references can also be protected (see the new `rel/*` ruleset).
- A single ruleset can target a glob of refs (e.g. `gha/*`) instead of one
branch at a time.
- Rules are publicly visible at
https://github.com/apache/logging-parent/rules, so we can verify that the
effective rules are those configured and third parties can audit the project's
protection policy too.
* fix: use raw syntax for tags
* fix: remove `protected_branches`
No longer needed since apache/infrastructure-asfyaml#121 was merged.
---
.asf.yaml | 53 ++++++++++++++++++++++++++++++++++++++---------------
1 file changed, 38 insertions(+), 15 deletions(-)
diff --git a/.asf.yaml b/.asf.yaml
index 6a6eb53..4e88d2c 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -61,32 +61,55 @@ github:
features:
issues: true
- # Prevent force pushes to primary branches
- protected_branches:
- main:
+ rulesets:
+ - name: "Branch protection: parent POM"
+ type: branch
+ branches:
+ includes:
+ - "~DEFAULT_BRANCH"
# All reviews must be addressed before merging
required_conversation_resolution: true
# Require checks to pass before merging
required_status_checks:
- checks:
- # The GitHub Actions app: 15368
- - app_id: 15368
- context: "build / build (ubuntu-latest)"
- # The GitHub Advanced Security app: 57789
- - app_id: 57789
- context: "CodeQL"
+ # The GitHub Actions app
+ - app_slug: github-actions
+ name: "build / build (ubuntu-latest)"
+ # The GitHub Advanced Security app
+ - app_slug: github-advanced-security
+ name: "CodeQL"
# At least one positive review must be present
required_pull_request_reviews:
required_approving_review_count: 1
- gha/v0:
+ - name: "Branch protection: reusable actions"
+ type: branch
+ branches:
+ includes:
+ - "gha/*"
# All reviews must be addressed before merging
required_conversation_resolution: true
# Require checks to pass before merging
required_status_checks:
- checks:
- # The GitHub Advanced Security app: 57789
- - app_id: 57789
- context: "CodeQL"
+ # The GitHub Advanced Security app
+ - app_slug: github-advanced-security
+ name: "CodeQL"
# At least one positive review must be present
required_pull_request_reviews:
required_approving_review_count: 1
+ # Use raw rules, until a convenience notation for `restrict_update` is
introduced.
+ # See: https://github.com/apache/infrastructure-asfyaml/issues/96
+ #
+ # The raw rules need to follow the syntax given in:
+ #
https://docs.github.com/en/rest/repos/rules?apiVersion=2026-03-10#update-a-repository-ruleset
+ - name: "Tag protection"
+ target: tag
+ enforcement: active
+ bypass_actors: []
+ conditions:
+ ref_name:
+ include:
+ - "refs/tags/rel/*"
+ exclude: []
+ rules:
+ - type: deletion
+ - type: non_fast_forward
+ - type: update
