From 58d1bddf98a7fc0b1946f2abf340cedf9201bea7 Mon Sep 17 00:00:00 2001 From: deacon-mp Date: Thu, 23 Jul 2026 20:16:34 -0400 Subject: [PATCH] fix(.asf.yaml): add discussions notification target; use real check names in branch protection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ASF Infra rejects the github feature block with 'GitHub discussions can only be enabled if a mailing list target exists for it' — features.discussions requires a notifications.discussions target. Route it to dev@, alongside issues and pullrequests. Because that error aborted the whole github block, protected_branches has never actually applied. Its required_status_checks contexts named workflows (Code Quality, Security Checks) rather than check runs, which would never be reported and would wedge every merge once active. Replace them with the six real job names as recorded on GitHub check runs. Review requirement (1 approving review, stale-review dismissal) and strict up-to-date checks now take effect deliberately. --- .asf.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index fe7b58788..1d35a6ed3 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -12,6 +12,7 @@ notifications: commits: commits@caldera.apache.org issues: dev@caldera.apache.org pullrequests: dev@caldera.apache.org + discussions: dev@caldera.apache.org # required for github.features.discussions to be enabled # jobs: dev@caldera.apache.org # GitHub Actions build status — enable if the project wants CI failures on-list # jira_options: link label comment # only if Caldera adopts ASF Jira; it uses GitHub Issues, so omitted @@ -49,7 +50,7 @@ github: dependabot_alerts: true dependabot_updates: false - # --- OPTIONAL self-serve branch protection (enable once the project agrees on required checks) ---- + # --- Branch protection: 1 approving review + green CI required to merge to master ----------------- protected_branches: master: required_pull_request_reviews: @@ -57,9 +58,14 @@ github: dismiss_stale_reviews: true required_status_checks: strict: true + # Contexts must be check-run (job) names as reported to GitHub, not workflow names. contexts: - - Code Quality - - Security Checks + - "build (3.10.9, py310,style,coverage-ci)" + - "build (3.11, py311,style,coverage-ci)" + - "build (3.12, py312,style,coverage-ci)" + - "build (3.13, py313,style,coverage-ci)" + - "build (3.13, safety)" + - "build (3.13, bandit)" required_conversation_resolution: true # # required_signatures: true # only if all committers sign commits — can block merges otherwise copilot_code_review: