Switch to GitHub Rulesets (second attempt) - #477
Merged
Conversation
The first attempt (#456) had to be reverted in #471 because a bug in ASFYaml made the resulting rulesets impossible to modify or remove through `.asf.yaml`. We rolled back to the legacy `protected_branches` configuration. apache/infrastructure-asfyaml#93 has now landed and addresses the underlying issues (broken `app_slug` resolution, silent REST API failures, missing `refs/heads/` / `refs/tags/` prefixing), so we can move back to Rulesets. The benefits over `protected_branches` remain: - Tag references can also be protected (see the new `rel/*` ruleset). - A single ruleset can target a glob of refs (e.g. `gha/*`) instead of one branch at a time. - Rules are publicly visible at https://github.com/apache/logging-parent/rules, so we can verify that the effective rules are those configured and third parties can audit the project's protection policy too.
Contributor
There was a problem hiding this comment.
Pull request overview
Migrates this repository’s GitHub ref protection configuration in .asf.yaml from legacy protected_branches to GitHub Rulesets, leveraging the recent ASFYaml fixes mentioned in the PR description.
Changes:
- Enable the ASFYaml rulesets feature via
meta.environments. - Remove legacy
protected_branchesconfiguration. - Add rulesets targeting the default branch and
gha/*, plus a newrel/*tag-targeting ruleset.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
1 task
Member
Author
|
The @vy: can we merge it? |
vy
approved these changes
Aug 14, 2026
No longer needed since apache/infrastructure-asfyaml#121 was merged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first attempt (#456) had to be reverted in #471 because a bug in ASFYaml made the resulting rulesets impossible to modify or remove through
.asf.yaml. We rolled back to the legacyprotected_branchesconfiguration.apache/infrastructure-asfyaml#93 has now landed and addresses the underlying issues (broken
app_slugresolution, silent REST API failures, missingrefs/heads//refs/tags/prefixing), so we can move back to Rulesets.The benefits over
protected_branchesremain:rel/*ruleset).gha/*) instead of one branch at a time.