Does this require the merge to be done via the Web UI? My only concern there is that means that those merge commits cannot be signed.
I feel we should be working towards signed commits by author for a stronger supply chain security posture. Thanks, Matt > On Apr 14, 2026, at 12:17 PM, Jean-Baptiste Onofré <[email protected]> wrote: > > Hi everyone, > > Branch protection was enabled on the main branch on January 10, and > subsequently applied to the activemq-6.2.x and activemq-5.19.x branches on > February 19. > > As this impacts all contributors, this is a topic we should have discussed > collectively. I apologize for not bringing it to the list sooner. > > You can view the current configuration here: > https://github.com/apache/activemq/blob/main/.asf.yaml#L40 > > Under this configuration: > > 1. Direct pushes are no longer permitted (including via GitBox). All > changes must go through a PR. > 2. Every PR requires at least one approval to be merged. > > The goals of these changes are to: > > 1. Increase overall quality through peer reviews. > 2. Foster better collaboration. > 3. Improve the onboarding experience for new contributors via guidance and > feedback. > 4. Ensure CI validation before merging (which was previously disabled due > to flaky tests). > > I recognize this represents a shift in our workflow, specifically because > direct pushes are restricted and even minor changes now require a PR. For > rare cases where a direct push is necessary (such as updating build > contexts in .asf.yaml), we can coordinate with Infra to temporarily relax > these protections. > > Personally, after three months of using this workflow, I have seen many > positive results. However, if you have concerns, please share your comments > so we can discuss whether to adjust or disable these settings. > > Thanks > Regards, > JB --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information, visit: https://activemq.apache.org/contact
