From 58d1bddf98a7fc0b1946f2abf340cedf9201bea7 Mon Sep 17 00:00:00 2001 From: deacon-mp Date: Thu, 23 Jul 2026 20:16:34 -0400 Subject: [PATCH 1/3] fix(.asf.yaml): add discussions notification target; use real check names in branch protection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ASF Infra rejects the github feature block with 'GitHub discussions can only be enabled if a mailing list target exists for it' — features.discussions requires a notifications.discussions target. Route it to dev@, alongside issues and pullrequests. Because that error aborted the whole github block, protected_branches has never actually applied. Its required_status_checks contexts named workflows (Code Quality, Security Checks) rather than check runs, which would never be reported and would wedge every merge once active. Replace them with the six real job names as recorded on GitHub check runs. Review requirement (1 approving review, stale-review dismissal) and strict up-to-date checks now take effect deliberately. --- .asf.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index fe7b58788..1d35a6ed3 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -12,6 +12,7 @@ notifications: commits: commits@caldera.apache.org issues: dev@caldera.apache.org pullrequests: dev@caldera.apache.org + discussions: dev@caldera.apache.org # required for github.features.discussions to be enabled # jobs: dev@caldera.apache.org # GitHub Actions build status — enable if the project wants CI failures on-list # jira_options: link label comment # only if Caldera adopts ASF Jira; it uses GitHub Issues, so omitted @@ -49,7 +50,7 @@ github: dependabot_alerts: true dependabot_updates: false - # --- OPTIONAL self-serve branch protection (enable once the project agrees on required checks) ---- + # --- Branch protection: 1 approving review + green CI required to merge to master ----------------- protected_branches: master: required_pull_request_reviews: @@ -57,9 +58,14 @@ github: dismiss_stale_reviews: true required_status_checks: strict: true + # Contexts must be check-run (job) names as reported to GitHub, not workflow names. contexts: - - Code Quality - - Security Checks + - "build (3.10.9, py310,style,coverage-ci)" + - "build (3.11, py311,style,coverage-ci)" + - "build (3.12, py312,style,coverage-ci)" + - "build (3.13, py313,style,coverage-ci)" + - "build (3.13, safety)" + - "build (3.13, bandit)" required_conversation_resolution: true # # required_signatures: true # only if all committers sign commits — can block merges otherwise copilot_code_review: From 4fdcf736c1f00deb71781fc896bbc088695f537a Mon Sep 17 00:00:00 2001 From: HackedRico Date: Wed, 26 Aug 2026 21:14:54 -0400 Subject: [PATCH 2/3] ci: require stable aggregate contexts instead of matrix job names Branch protection contexts match check-run names, so the generated "build (, )" legs are renamed by any matrix edit. A required context that stops reporting blocks every merge and can only be cleared by Infra by hand -- which is the state master is in now, since the previously configured "Code Quality"/"Security Checks" contexts were workflow names that no check run ever reports. Add a hand-named aggregate job to each workflow that passes only when every matrix leg succeeded, and require those two contexts instead. The python matrix can then change without touching .asf.yaml. --- .asf.yaml | 14 +++++++------- .github/workflows/quality.yml | 17 +++++++++++++++++ .github/workflows/security.yml | 15 +++++++++++++++ 3 files changed, 39 insertions(+), 7 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 4ccfc2b1c..03ca21e1b 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -57,14 +57,14 @@ github: dismiss_stale_reviews: true required_status_checks: strict: true - # Contexts must be check-run (job) names as reported to GitHub, not workflow names. + # Contexts are check-run (job) names as reported to GitHub, not workflow + # names. Require the hand-named aggregate job in each workflow rather than + # the generated "build (, )" legs: those are renamed by any + # matrix edit, and a required context that stops reporting blocks every + # merge until Infra removes it by hand. contexts: - - "build (3.10.9, py310,style,coverage-ci)" - - "build (3.11, py311,style,coverage-ci)" - - "build (3.12, py312,style,coverage-ci)" - - "build (3.13, py313,style,coverage-ci)" - - "build (3.13, safety)" - - "build (3.13, bandit)" + - ci-required # .github/workflows/quality.yml — gates the 4 python legs + - security-required # .github/workflows/security.yml — gates safety + bandit required_conversation_resolution: true # # required_signatures: true # only if all committers sign commits — can block merges otherwise copilot_code_review: diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index d88c31a01..98fbf3c9b 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -116,3 +116,20 @@ jobs: path: sonar-fork-pr-artifact/ retention-days: 3 if-no-files-found: warn + + # Stable aggregate context for the .asf.yaml branch protection on master. + # Required status checks match check-run names, and the matrix legs report as + # "build (, )" — so every matrix edit renames them and the old + # name then silently never reports, wedging all merges until Infra intervenes. + # This job's name is hand-written, so it survives matrix changes. + ci-required: + # always() so a failed matrix still runs this job: a skipped job counts as a + # satisfied required check, which would quietly disable the protection. + if: always() + needs: build + runs-on: ubuntu-latest + steps: + - name: Verify every matrix leg passed + run: | + echo "build result: ${{ needs.build.result }}" + [ "${{ needs.build.result }}" = "success" ] diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 6141102e9..486021a0a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -36,3 +36,18 @@ jobs: env: TOXENV: ${{ matrix.toxenv }} run: tox + + # Stable aggregate context for the .asf.yaml branch protection on master. + # See the matching ci-required job in quality.yml for why the generated + # "build (, )" names must not be required directly. + security-required: + # always() so a failed matrix still runs this job: a skipped job counts as a + # satisfied required check, which would quietly disable the protection. + if: always() + needs: build + runs-on: ubuntu-latest + steps: + - name: Verify every matrix leg passed + run: | + echo "build result: ${{ needs.build.result }}" + [ "${{ needs.build.result }}" = "success" ] From d8de7d856d575289bd5fcb9675f5e9c479f359c9 Mon Sep 17 00:00:00 2001 From: HackedRico Date: Wed, 26 Aug 2026 21:29:54 -0400 Subject: [PATCH 3/3] refactor: drop em dashes from .asf.yaml and CI workflow comments Comment punctuation only. No configuration or job behaviour changes. --- .asf.yaml | 10 +++++----- .github/workflows/quality.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 03ca21e1b..aebcc7b97 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -1,4 +1,4 @@ -# .asf.yaml — Apache Infra self-service config for github.com/apache/caldera +# .asf.yaml: Apache Infra self-service config for github.com/apache/caldera # Reference: https://github.com/apache/infrastructure-asfyaml · https://infra.apache.org/asf-yaml.html # This file lives at the repo ROOT and its `notifications:` block ONLY takes effect on the # DEFAULT branch (master). Repo metadata/features (github:) are not branch-specific. @@ -19,7 +19,7 @@ notifications: github: description: "Automated Adversary Emulation Platform" homepage: https://caldera.apache.org/ # update from the old caldera.mitre.org - # NOTE: `labels:` REPLACES the repo's GitHub topics wholesale — keep the list intentional. + # NOTE: `labels:` REPLACES the repo's GitHub topics wholesale, so keep the list intentional. labels: - adversary-emulation - security-automation @@ -63,10 +63,10 @@ github: # matrix edit, and a required context that stops reporting blocks every # merge until Infra removes it by hand. contexts: - - ci-required # .github/workflows/quality.yml — gates the 4 python legs - - security-required # .github/workflows/security.yml — gates safety + bandit + - ci-required # .github/workflows/quality.yml, gates the 4 python legs + - security-required # .github/workflows/security.yml, gates safety + bandit required_conversation_resolution: true - # # required_signatures: true # only if all committers sign commits — can block merges otherwise + # # required_signatures: true # only if all committers sign commits; can block merges otherwise copilot_code_review: enabled: true review_drafts: false diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 98fbf3c9b..ed2bd1a18 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -119,7 +119,7 @@ jobs: # Stable aggregate context for the .asf.yaml branch protection on master. # Required status checks match check-run names, and the matrix legs report as - # "build (, )" — so every matrix edit renames them and the old + # "build (, )", so every matrix edit renames them and the old # name then silently never reports, wedging all merges until Infra intervenes. # This job's name is hand-written, so it survives matrix changes. ci-required: