From b75771a709f8141491b06d9cbb953486c4f5f7e5 Mon Sep 17 00:00:00 2001 From: Alex Stephen Date: Thu, 15 Oct 2026 17:29:49 +0000 Subject: [PATCH 1/3] move required status checks into Merge Queue ruleset --- .asf.yaml | 34 ++++++++++++++++++---------------- AGENTS.md | 2 +- 2 files changed, 19 insertions(+), 17 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index f2d710ec8e..63aade1bc7 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -35,22 +35,6 @@ github: rebase: true protected_branches: main: - required_status_checks: - contexts: - # Repository policy and security checks. - - Analyze Actions - - Run zizmor 🌈 - - asf-allowlist-check - - rat - - # Documentation checks. - - docs - - markdown-link-check - - # Python workflow gates. - - python-ci-required - - python-integration-required - required_pull_request_reviews: required_approving_review_count: 1 @@ -65,6 +49,24 @@ github: - "~DEFAULT_BRANCH" exclude: [] rules: + - type: required_status_checks + parameters: + # Merge Queue already tests each entry against the latest main + strict_required_status_checks_policy: false + required_status_checks: + # Repository policy and security checks. + - context: Analyze Actions + - context: Run zizmor 🌈 + - context: asf-allowlist-check + - context: rat + + # Documentation checks. + - context: docs + - context: markdown-link-check + + # Python workflow gates. + - context: python-ci-required + - context: python-integration-required - type: merge_queue parameters: check_response_timeout_minutes: 90 diff --git a/AGENTS.md b/AGENTS.md index db95902ed2..c13a75c396 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -68,7 +68,7 @@ lives under `pyiceberg/`, organized by concern rather than by engine: ### Required CI and Merge Queue -- Keep the `required_status_checks.contexts` list in `.asf.yaml` synchronized whenever a required job/check is added, renamed, or removed. Each entry is a job/check context name, not a workflow filename. +- Keep the `required_status_checks` list in the `Merge Queue` ruleset in `.asf.yaml` synchronized whenever a required job/check is added, renamed, or removed. Each entry is a job/check context name, not a workflow filename. - Verify that every required context reports for both `pull_request` and `merge_group`. Its producer workflow must run on both events. - When a workflow uses an aggregate required job, such as `python-ci-required`, keep `if: always()` and its `needs` list in sync with every job whose result should block merging. - Do not use `pull_request` path filters in workflows that produce required contexts. A skipped workflow does not report its required context, which blocks pull requests and causes Merge Queue entries to time out. From e7024bbf105a24e87930122dd4ae33b08f5e5723 Mon Sep 17 00:00:00 2001 From: Alex Stephen Date: Tue, 20 Oct 2026 22:41:24 +0000 Subject: [PATCH 2/3] Let committers bypass the Merge Queue ruleset for urgent fixes Replace classic branch protection with an equivalent ruleset, since classic protection blocks ruleset bypass, and add apache/iceberg-public as a pull-request bypass actor on the Merge Queue ruleset. Ports apache/iceberg-rust#3458, #3481, and #3489. --- .asf.yaml | 30 +++++++++++++++++++++++++----- mkdocs/docs/contributing.md | 14 ++++++++++++++ 2 files changed, 39 insertions(+), 5 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 63aade1bc7..347490f615 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -33,16 +33,36 @@ github: squash: true squash_commit_message: PR_TITLE_AND_COMMIT_DETAILS rebase: true - protected_branches: - main: + # Disabled: GitHub blocks ruleset bypass while classic protection exists. + # The "Default Branch Protection" ruleset replaces it. + protected_branches: ~ + rulesets: + - name: "Default Branch Protection" + type: branch + branches: + includes: + - "~DEFAULT_BRANCH" + excludes: [] + bypass_teams: + - root + restrict_deletion: true + restrict_force_push: true + required_linear_history: true required_pull_request_reviews: required_approving_review_count: 1 - - required_linear_history: true - rulesets: - name: Merge Queue target: branch enforcement: active + bypass_actors: + # apache/root (ASF Infra). + - actor_id: 118420 + actor_type: Team + bypass_mode: always + # apache/iceberg-public. Iceberg committers can opt into this team via + # https://gitbox.apache.org/boxer/. + - actor_id: 20107235 + actor_type: Team + bypass_mode: pull_request conditions: ref_name: include: diff --git a/mkdocs/docs/contributing.md b/mkdocs/docs/contributing.md index 025109346a..39faaf0c64 100644 --- a/mkdocs/docs/contributing.md +++ b/mkdocs/docs/contributing.md @@ -263,6 +263,20 @@ This command spins up the full integration test infrastructure via Docker Compos After running `make notebook-infra`, open `spark_integration_example.ipynb` in the Jupyter Lab interface to explore Spark integration capabilities. +## Merging an urgent PR + +Committers can merge an urgent, approved pull request without waiting for the merge queue or required checks (for example, a security fix while CI is stuck). Use this only when necessary; otherwise, let the merge queue run. + + +1. Join the [`apache/iceberg-public`](https://github.com/orgs/apache/teams/iceberg-public) team via [Boxer](https://gitbox.apache.org/boxer/) (one-time; membership syncs in about 15 minutes). +2. Get the pull request approved by a committer. +3. If the pull request is in the merge queue, click **Remove from queue**. +4. Merge it directly: + + ```sh + gh pr merge --squash --admin + ``` + ## Code standards Below are the formalized conventions that we adhere to in the PyIceberg project. The goal of this is to have a common agreement on how to evolve the codebase, but also using it as guidelines for newcomers to the project. From 946698301387cfadef3666fd38d8889c9da95a83 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Wed, 21 Oct 2026 13:31:36 -0700 Subject: [PATCH 3/3] Move urgent PR merge docs to end of contributing guide Keep the committer-only procedure out of the contributor setup flow, and indent the code block 4 spaces so mkdocs renders it inside the list. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- mkdocs/docs/contributing.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/mkdocs/docs/contributing.md b/mkdocs/docs/contributing.md index 39faaf0c64..2e9cf126d1 100644 --- a/mkdocs/docs/contributing.md +++ b/mkdocs/docs/contributing.md @@ -263,20 +263,6 @@ This command spins up the full integration test infrastructure via Docker Compos After running `make notebook-infra`, open `spark_integration_example.ipynb` in the Jupyter Lab interface to explore Spark integration capabilities. -## Merging an urgent PR - -Committers can merge an urgent, approved pull request without waiting for the merge queue or required checks (for example, a security fix while CI is stuck). Use this only when necessary; otherwise, let the merge queue run. - - -1. Join the [`apache/iceberg-public`](https://github.com/orgs/apache/teams/iceberg-public) team via [Boxer](https://gitbox.apache.org/boxer/) (one-time; membership syncs in about 15 minutes). -2. Get the pull request approved by a committer. -3. If the pull request is in the merge queue, click **Remove from queue**. -4. Merge it directly: - - ```sh - gh pr merge --squash --admin - ``` - ## Code standards Below are the formalized conventions that we adhere to in the PyIceberg project. The goal of this is to have a common agreement on how to evolve the codebase, but also using it as guidelines for newcomers to the project. @@ -352,3 +338,17 @@ For the type annotation the types from the `Typing` package are used. ### Third party libraries PyIceberg naturally integrates into the rich Python ecosystem, however it is important to be hesitant adding third party packages. Adding a lot of packages makes the library heavyweight, and causes incompatibilities with other projects if they use a different version of the library. Also, big libraries such as `s3fs`, `adlfs`, `pyarrow`, `thrift` should be optional to avoid downloading everything, while not being sure if is actually being used. + +## Merging an urgent PR + +Committers can merge an urgent, approved pull request without waiting for the merge queue or required checks (for example, a security fix while CI is stuck). Use this only when necessary; otherwise, let the merge queue run. + + +1. Join the [`apache/iceberg-public`](https://github.com/orgs/apache/teams/iceberg-public) team via [Boxer](https://gitbox.apache.org/boxer/) (one-time; membership syncs in about 15 minutes). +2. Get the pull request approved by a committer. +3. If the pull request is in the merge queue, click **Remove from queue**. +4. Merge it directly: + + ```sh + gh pr merge --squash --admin + ```