fix(.asf.yaml): discussions notification target + real check names in branch protection by deacon-mp · Pull Request #3404 · apache/caldera

deacon-mp · 2026-07-24T00:16:58Z

Summary

Fixes the ASF Infra processing error emitted since #3400 merged:

An error occurred while processing the github feature in .asf.yaml: GitHub discussions can only be enabled if a mailing list target exists for it.

Changes

notifications.discussions: dev@caldera.apache.org — per the asf.yaml spec, github.features.discussions: true requires a discussions notification target. Routed to dev@ alongside issues and pullrequests traffic.
protected_branches contexts corrected to real check-run names. The previous contexts named workflows (Code Quality, Security Checks); GitHub required status checks match check-run (job) names, so those contexts would never be reported and — combined with strict: true — would have wedged every merge the moment the block applied. Replaced with the six job names, verified byte-exact against the check runs recorded on master's head commit (46af343a): the four build (3.x, ...coverage-ci) legs plus build (3.13, safety) and build (3.13, bandit). sonar_fork_pr is deliberately excluded (only materializes on fork PRs).

Effect when this lands

The discussions error has been aborting the entire github: block, so none of it is currently applied. Once this merges and Infra processes it, the full block takes effect, including branch protection on master: 1 approving review required (stale reviews dismissed), the six CI contexts required, branches must be up to date, conversations must be resolved. This is a deliberate policy activation — from then on, PRs (including Dependabot's, whose six required contexts all still report) need a review before merge.

…ames in branch protection ASF Infra rejects the github feature block with 'GitHub discussions can only be enabled if a mailing list target exists for it' — features.discussions requires a notifications.discussions target. Route it to dev@, alongside issues and pullrequests. Because that error aborted the whole github block, protected_branches has never actually applied. Its required_status_checks contexts named workflows (Code Quality, Security Checks) rather than check runs, which would never be reported and would wedge every merge once active. Replace them with the six real job names as recorded on GitHub check runs. Review requirement (1 approving review, stale-review dismissal) and strict up-to-date checks now take effect deliberately.

Copilot

Pull request overview

This PR updates the repository’s Apache Infra self-service configuration (.asf.yaml) to (1) satisfy ASF’s requirement for enabling GitHub Discussions and (2) correctly enforce branch protection on master using real GitHub Actions check-run (job) names so merges aren’t inadvertently blocked.

Changes:

Add a notifications.discussions email target required for github.features.discussions: true.
Replace branch protection required-status-check contexts from workflow names to the concrete job/check-run names emitted by GitHub Actions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Branch protection contexts match check-run names, so the generated "build (<python>, <toxenv>)" legs are renamed by any matrix edit. A required context that stops reporting blocks every merge and can only be cleared by Infra by hand -- which is the state master is in now, since the previously configured "Code Quality"/"Security Checks" contexts were workflow names that no check run ever reports. Add a hand-named aggregate job to each workflow that passes only when every matrix leg succeeded, and require those two contexts instead. The python matrix can then change without touching .asf.yaml.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.asf.yaml:67

PR description says this fixes ASF Infra by setting notifications.discussions to dev@caldera.apache.org, but the current .asf.yaml still routes discussions (and issues/PRs) to notifications@caldera.apache.org. If notifications@ is not an actual ASF list (as the header comment implies), Infra will likely continue to reject github.features.discussions: true and ignore the whole github: block. Also, the PR description mentions requiring six CI contexts, but the config now requires only the two aggregate jobs (ci-required, security-required). Please align the .asf.yaml notifications + the PR description with the intended policy so Infra applies the config as expected.

         contexts:
           - ci-required        # .github/workflows/quality.yml  — gates the 4 python legs
           - security-required  # .github/workflows/security.yml — gates safety + bandit

Comment punctuation only. No configuration or job behaviour changes.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

.asf.yaml:67

PR description says master branch protection will require six CI contexts (the individual build matrix legs plus safety/bandit), but .asf.yaml now requires only the two aggregate jobs (ci-required, security-required). Please confirm the intended policy and update either the config or the PR description so they match.

         contexts:
           - ci-required        # .github/workflows/quality.yml,  gates the 4 python legs
           - security-required  # .github/workflows/security.yml, gates safety + bandit

.asf.yaml:4

The notifications block still routes issues/pullrequests/jobs/discussions to notifications@caldera.apache.org, but the file’s own header comment and the PR description indicate those should go to dev@ (and notifications@ may not exist). This may not resolve the ASF Infra processing error for discussions, and the discussions line currently has trailing whitespace.

# .asf.yaml: Apache Infra self-service config for github.com/apache/caldera
# Reference: https://github.com/apache/infrastructure-asfyaml  ·  https://infra.apache.org/asf-yaml.html
# This file lives at the repo ROOT and its `notifications:` block ONLY takes effect on the
# DEFAULT branch (master). Repo metadata/features (github:) are not branch-specific.

HackedRico · 2026-08-27T01:35:28Z

@pjfanning master can't merge anything right now.

.asf.yaml requires checks named Code Quality and Security Checks, but those
are workflow names. The real check-run names are build (3.10.9, py310,...) etc,
so nothing ever reports and strict: true blocks every PR. It only bit now
because #3414 cleared the discussions error that had been aborting the block.

This PR fixes the names. But it's blocked by the same rule and no committer has
admin, so Infra has to clear those two checks by hand. Can you raise it, or want
me to file the INFRA ticket?

What's the best way to approach this fix?

pjfanning · 2026-08-27T07:47:34Z

         contexts:
-           - Code Quality
-           - Security Checks
+           - ci-required        # .github/workflows/quality.yml,  gates the 4 python legs


as far as I know, this has to match the 'name' in the workflow - https://github.com/apache/caldera/blob/master/.github/workflows/quality.yml#L1
ie the current setting, not your new setting

https://github.com/apache/infrastructure-asfyaml is the project to raise discussions/issues on

…nts" This reverts commit d8de7d8.

…ames" This reverts commit 4fdcf73.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

deacon-mp requested review from clenk and a lite review from Copilot July 24, 2026 15:22

Copilot started reviewing on behalf of deacon-mp July 24, 2026 15:28 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Comment thread .asf.yaml

Merge branch 'master' into fix/asf-yaml-discussions-and-protection

2161021

Copilot AI review requested due to automatic review settings August 27, 2026 00:47

Copilot started reviewing on behalf of HackedRico August 27, 2026 00:48 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Comment thread .asf.yaml

Copilot AI review requested due to automatic review settings August 27, 2026 01:15

Copilot started reviewing on behalf of HackedRico August 27, 2026 01:15 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

refactor: drop em dashes from .asf.yaml and CI workflow comments

d8de7d8

Comment punctuation only. No configuration or job behaviour changes.

Copilot AI review requested due to automatic review settings August 27, 2026 01:29

Copilot started reviewing on behalf of HackedRico August 27, 2026 01:30 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

HackedRico previously approved these changes Aug 27, 2026

View reviewed changes

pjfanning reviewed Aug 27, 2026

View reviewed changes

HackedRico added 2 commits August 27, 2026 09:55

Revert "refactor: drop em dashes from .asf.yaml and CI workflow comme…

fa08398

…nts" This reverts commit d8de7d8.

Revert "ci: require stable aggregate contexts instead of matrix job n…

090465d

…ames" This reverts commit 4fdcf73.

HackedRico dismissed their stale review via 090465d August 27, 2026 13:56

Copilot AI review requested due to automatic review settings August 27, 2026 13:56

Copilot AI reviewed Aug 27, 2026

revert to master contexts

3785606

Copilot AI review requested due to automatic review settings August 27, 2026 14:01

Copilot AI reviewed Aug 27, 2026

Navigation Menu

Uh oh!

fix(.asf.yaml): discussions notification target + real check names in branch protection - #3404

fix(.asf.yaml): discussions notification target + real check names in branch protection#3404
deacon-mp wants to merge 7 commits into
masterfrom
fix/asf-yaml-discussions-and-protection

deacon-mp commented Jul 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

HackedRico commented Aug 27, 2026 •

edited

Loading

Uh oh!

pjfanning Aug 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

deacon-mp commented Jul 24, 2026

Summary

Changes

Effect when this lands

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

HackedRico commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pjfanning Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

HackedRico commented Aug 27, 2026 •

edited

Loading