From f1d8015fbc597c69ba30d073f22c672f8bcedc15 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Thu, 10 Sep 2026 08:18:01 -0700 Subject: [PATCH] ci: enable GitHub merge queue with required CI gates Closes #3140. Mirror apache/iceberg-python#3832: define the required checks in .asf.yaml, add an ASF-managed Merge Queue ruleset (one-at-a-time squash merges on main), enable auto-merge, and make every required workflow run on merge_group without pull_request path or branch filters so its check always reports. CI and Bindings Python CI gain an always-run aggregate job (ci-required, bindings-python-ci-required) so matrix job names do not have to be enumerated as required contexts. Co-Authored-By: Claude Fable 5.1 --- .asf.yaml | 40 +++++++++++++++++++++-- .github/workflows/asf-allowlist-check.yml | 1 + .github/workflows/bindings_python_ci.yml | 28 ++++++++-------- .github/workflows/ci.yml | 28 ++++++++-------- .github/workflows/codeql.yml | 2 +- .github/workflows/public-api.yml | 3 +- .github/workflows/zizmor.yml | 2 +- 7 files changed, 72 insertions(+), 32 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 1b32ea0132..974c6b512d 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -36,15 +36,51 @@ github: protected_branches: main: required_status_checks: - # strict means "Require branches to be up to date before merging". - strict: true + # Check context names (job names, not workflow files) that Merge Queue + # waits for. Every producer workflow must run on both `pull_request` + # and `merge_group`, without path filters, so each context always + # reports. `strict` is omitted: Merge Queue validates every entry + # against an up-to-date main, and ASF defaults it to false. + contexts: + # Repository policy and security checks. + - Analyze Actions + - Run zizmor 🌈 + - asf-allowlist-check + + # Rust workflow gates. + - ci-required + - check-public-api + + # Python bindings workflow gates. + - bindings-python-ci-required required_pull_request_reviews: required_approving_review_count: 1 dismiss_stale_reviews: false required_linear_history: true + rulesets: + - name: Merge Queue + target: branch + enforcement: active + conditions: + ref_name: + include: + - "~DEFAULT_BRANCH" + exclude: [] + rules: + - type: merge_queue + parameters: + check_response_timeout_minutes: 90 + grouping_strategy: ALLGREEN + max_entries_to_build: 1 + max_entries_to_merge: 1 + merge_method: SQUASH + min_entries_to_merge: 1 + min_entries_to_merge_wait_minutes: 0 pull_requests: + # allow pull requests to merge automatically once all requirements are met + allow_auto_merge: true # auto-delete head branches after being merged del_branch_on_merge: true features: diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 5380bcfd17..446a247cd1 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -25,6 +25,7 @@ name: "ASF Allowlist Check" on: pull_request: + merge_group: push: branches: - main diff --git a/.github/workflows/bindings_python_ci.yml b/.github/workflows/bindings_python_ci.yml index 375521d0f2..24ba728d62 100644 --- a/.github/workflows/bindings_python_ci.yml +++ b/.github/workflows/bindings_python_ci.yml @@ -22,19 +22,7 @@ on: branches: - main pull_request: - paths: - - '**' # Include all files and directories in the repository by default. - - '!.github/ISSUE_TEMPLATE/**' # Exclude files and directories that don't impact tests or code like templates, metadata, and documentation. - - '!dev/release/**' - - '!website/**' - - '!.asf.yml' - - '!.gitattributes' - - '!.gitignore' - - '!CONTRIBUTING.md' - - '!CHANGELOG.md' - - '!LICENSE' - - '!NOTICE' - - '!README.md' + merge_group: concurrency: group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} @@ -121,3 +109,17 @@ jobs: HF_DATASET: ${{ secrets.HF_DATASET }} run: | make test + + bindings-python-ci-required: + if: ${{ always() }} + needs: [check-python, test] + runs-on: ubuntu-slim + steps: + - name: Verify Bindings Python CI jobs succeeded + env: + RESULTS: ${{ join(needs.*.result, ' ') }} + run: | + read -ra results <<< "$RESULTS" + for result in "${results[@]}"; do + test "$result" = "success" + done diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dc380ab18c..a095d4c634 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,19 +22,7 @@ on: branches: - main pull_request: - paths: - # Artifacts that must be included in releases, such as LICENSE and NOTICE, are deliberately not excluded so we can verify they will be bundled. - # Include all files and directories, then filter out files and directories that don't impact code, tests, or release artifacts. - - '**' - - '!.github/ISSUE_TEMPLATE/**' - - '!dev/release/**' - - '!website/**' - - '!.asf.yml' - - '!.gitattributes' - - '!.gitignore' - - '!CONTRIBUTING.md' - - '!CHANGELOG.md' - - '!README.md' + merge_group: concurrency: group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} @@ -258,3 +246,17 @@ jobs: uses: $/.github/actions/setup-builder - name: Check MSRV run: make check-msrv + + ci-required: + if: ${{ always() }} + needs: [lint, clippy, build, check_standalone, build_with_no_default_features, tests, msrv] + runs-on: ubuntu-slim + steps: + - name: Verify CI jobs succeeded + env: + RESULTS: ${{ join(needs.*.result, ' ') }} + run: | + read -ra results <<< "$RESULTS" + for result in "${results[@]}"; do + test "$result" = "success" + done diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7cea64aea3..efd720e534 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ on: push: branches: [ "main" ] pull_request: - branches: [ "main" ] + merge_group: schedule: - cron: '16 4 * * 1' diff --git a/.github/workflows/public-api.yml b/.github/workflows/public-api.yml index a3af719a40..3603247594 100644 --- a/.github/workflows/public-api.yml +++ b/.github/workflows/public-api.yml @@ -22,8 +22,7 @@ on: branches: - main pull_request: - paths: - - 'crates/**' + merge_group: concurrency: group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index cd4865d9e5..bbc35f71f9 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -23,7 +23,7 @@ on: push: branches: ["main"] pull_request: - branches: ["**"] + merge_group: permissions: {}