Set up default protection ruleset for default and release branches - #222
Conversation
|
✅ Build complete for PR #222. 📦 Binary artifacts are available in the workflow run (expires on September 20, 2026).
|
No release/* or rel/* branches exist in this repo, and .asf.yaml already defaults branches to ~DEFAULT_BRANCH when the key is omitted, so the block only restated the default.
Copilot review credits are limited; reviewers can trigger a review by hand when one is wanted.
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Adds an ASF GitHub rulesets configuration intended to enforce branch protection, while also changing Copilot code review trigger settings.
Changes:
- Introduces a
rulesetsblock with “Default Branch Protection” settings (force-push/deletion restrictions with a bypass team). - Changes
copilot_code_review.review_draftsandcopilot_code_review.review_on_pushfromtruetofalse.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.
| rulesets: | ||
| - name: "Default Branch Protection" | ||
| type: branch | ||
| bypass_teams: | ||
| - root | ||
| restrict_deletion: true | ||
| restrict_force_push: true |
| review_drafts: false | ||
| review_on_push: false |
| copilot_code_review: | ||
| enabled: true | ||
| review_drafts: true | ||
| review_on_push: true | ||
| review_drafts: false | ||
| review_on_push: false |
Replaces #210, which cannot be merged as it stands.
Why #210 does not work
The ASF infrastructure bot opened #210 against an old
main, before.asf.yamlexisted in the repo (added by #218). That leaves two problems:.asf.yaml.rulesets:block. Merging it would drop everything the project already set —description,homepage,labels,features,protected_branchesandcopilot_code_review— and it has no ASF licence header, so the Apache RAT check fails.This PR
The bot's commit rebased onto current
main, with therulesets:block merged into the existing.asf.yamlinstead of replacing it. Authorship is kept on the ASF bot's commit.Result: 14 lines added, nothing removed. The licence header, all existing settings and
protected_branchesstay exactly as they are.Testing
.asf.yamlparses (yaml.safe_load)..asf.yamlis not flagged.Once this merges, #210 can be closed.