From 335383fa432165a432575f1aa895c516ce92c8ab Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sat, 22 Aug 2026 09:54:39 -0700 Subject: [PATCH 1/4] Infra: Require CI checks before auto-merge --- .asf.yaml | 20 ++++++++++++++++++++ .github/workflows/check-md-link.yml | 3 --- .github/workflows/python-ci.yml | 13 ------------- .github/workflows/python-integration.yml | 7 ------- 4 files changed, 20 insertions(+), 23 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 4ba611817a..0072474c37 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -38,6 +38,26 @@ github: required_status_checks: # strict means "Require branches to be up to date before merging". strict: true + contexts: + - Analyze Actions + - CodeQL + - Run zizmor 🌈 + - asf-allowlist-check + - cibw-dev-env-smoke-test + - docs + - integration-coverage-report + - integration-test + - integration-test-adls + - integration-test-gcs + - integration-test-s3 + - lint-and-unit-test (3.10) + - lint-and-unit-test (3.11) + - lint-and-unit-test (3.12) + - lint-and-unit-test (3.13) + - lint-and-unit-test (3.14) + - markdown-link-check + - rat + - windows-unit-test (3.12) required_pull_request_reviews: required_approving_review_count: 1 diff --git a/.github/workflows/check-md-link.yml b/.github/workflows/check-md-link.yml index 6ea7eaa3b6..ebb87b4d56 100644 --- a/.github/workflows/check-md-link.yml +++ b/.github/workflows/check-md-link.yml @@ -27,9 +27,6 @@ on: branches: - 'main' pull_request: - paths: - - '.github/workflows/check-md-link.yml' - - 'mkdocs/**' workflow_dispatch: permissions: diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index 8ab526097f..cbbff18cfe 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -24,19 +24,6 @@ on: branches: - 'main' pull_request: - paths: - - '**' # Include all files and directories in the repository by default. - - '!.github/workflows/**' # Exclude all workflow files - - '.github/workflows/python-ci.yml' # except the current file. - - '!.github/ISSUE_TEMPLATE/**' # Exclude files and directories that don't impact tests or code like templates, metadata, and documentation. - - '!.gitignore' - - '!.asf.yml' - - '!mkdocs/**' - - '!.gitattributes' - - '!README.md' - - '!CONTRIBUTING.md' - - '!LICENSE' - - '!NOTICE' permissions: contents: read diff --git a/.github/workflows/python-integration.yml b/.github/workflows/python-integration.yml index 8c7337d1d3..a63ff81e3f 100644 --- a/.github/workflows/python-integration.yml +++ b/.github/workflows/python-integration.yml @@ -24,13 +24,6 @@ on: branches: - 'main' pull_request: - paths: # Only run integration tests when Python (or the code they exercise) changes. - - '**/*.py' - - 'pyproject.toml' - - 'uv.lock' - - 'Makefile' - - 'dev/**' # docker-compose files and fixtures used by the integration suites. - - '.github/workflows/python-integration.yml' # this file itself. permissions: contents: read From 13c9aab5cca9fdd5fc4c9bc248dda38d910256d7 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sat, 22 Aug 2026 10:07:49 -0700 Subject: [PATCH 2/4] Infra: Group required CI contexts --- .asf.yaml | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 0072474c37..bb5deda3bf 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -39,26 +39,33 @@ github: # strict means "Require branches to be up to date before merging". strict: true contexts: + # Repository policy and security checks. - Analyze Actions - CodeQL - Run zizmor 🌈 - asf-allowlist-check - - cibw-dev-env-smoke-test + - rat + + # Documentation checks. - docs - - integration-coverage-report - - integration-test - - integration-test-adls - - integration-test-gcs - - integration-test-s3 + - markdown-link-check + + # Python CI checks. + - cibw-dev-env-smoke-test - lint-and-unit-test (3.10) - lint-and-unit-test (3.11) - lint-and-unit-test (3.12) - lint-and-unit-test (3.13) - lint-and-unit-test (3.14) - - markdown-link-check - - rat - windows-unit-test (3.12) + # Python integration checks. + - integration-coverage-report + - integration-test + - integration-test-adls + - integration-test-gcs + - integration-test-s3 + required_pull_request_reviews: required_approving_review_count: 1 From 2d89d15f0628cc6052182d99f378fbaf21bf832e Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sat, 22 Aug 2026 10:22:03 -0700 Subject: [PATCH 3/4] Infra: Add stable required CI gates --- .asf.yaml | 18 +++--------------- .github/workflows/asf-allowlist-check.yml | 1 + .github/workflows/check-md-link.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/license_check.yml | 1 + .github/workflows/python-ci-docs.yml | 1 + .github/workflows/python-ci.yml | 15 +++++++++++++++ .github/workflows/python-integration.yml | 15 +++++++++++++++ .github/workflows/zizmor.yml | 1 + 9 files changed, 39 insertions(+), 15 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index bb5deda3bf..6ae7725be7 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -50,21 +50,9 @@ github: - docs - markdown-link-check - # Python CI checks. - - cibw-dev-env-smoke-test - - lint-and-unit-test (3.10) - - lint-and-unit-test (3.11) - - lint-and-unit-test (3.12) - - lint-and-unit-test (3.13) - - lint-and-unit-test (3.14) - - windows-unit-test (3.12) - - # Python integration checks. - - integration-coverage-report - - integration-test - - integration-test-adls - - integration-test-gcs - - integration-test-s3 + # Python workflow gates. + - python-ci-required + - python-integration-required required_pull_request_reviews: required_approving_review_count: 1 diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 3844789995..0f690fcfba 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -24,6 +24,7 @@ name: "ASF Allowlist Check" on: + # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: push: branches: diff --git a/.github/workflows/check-md-link.yml b/.github/workflows/check-md-link.yml index ebb87b4d56..93fac4c808 100644 --- a/.github/workflows/check-md-link.yml +++ b/.github/workflows/check-md-link.yml @@ -26,6 +26,7 @@ on: - 'mkdocs/**' branches: - 'main' + # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: workflow_dispatch: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b113d4bed8..24b91b19e0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -22,6 +22,7 @@ name: "CodeQL" on: push: branches: [ "main" ] + # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: branches: [ "main" ] schedule: diff --git a/.github/workflows/license_check.yml b/.github/workflows/license_check.yml index 3082656c7e..62e9d0f15b 100644 --- a/.github/workflows/license_check.yml +++ b/.github/workflows/license_check.yml @@ -18,6 +18,7 @@ # name: "Run License Check" +# Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. on: pull_request permissions: diff --git a/.github/workflows/python-ci-docs.yml b/.github/workflows/python-ci-docs.yml index 83f97135e3..38bb8ca8d5 100644 --- a/.github/workflows/python-ci-docs.yml +++ b/.github/workflows/python-ci-docs.yml @@ -23,6 +23,7 @@ on: push: branches: - 'main' + # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: permissions: diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index cbbff18cfe..c7f10b9206 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -23,6 +23,7 @@ on: push: branches: - 'main' + # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: permissions: @@ -114,3 +115,17 @@ jobs: run: uv sync --directory . --only-group dev --no-install-project - name: Mirror wheel CIBW_TEST_COMMAND run: uv run --directory . pytest tests/avro/test_decoder.py + + python-ci-required: + if: ${{ always() }} + needs: [lint-and-unit-test, windows-unit-test, cibw-dev-env-smoke-test] + runs-on: ubuntu-latest + steps: + - name: Verify Python CI jobs succeeded + env: + RESULTS: ${{ join(needs.*.result, ' ') }} + run: | + read -ra results <<< "$RESULTS" + for result in "${results[@]}"; do + test "$result" = "success" + done diff --git a/.github/workflows/python-integration.yml b/.github/workflows/python-integration.yml index a63ff81e3f..1d92538433 100644 --- a/.github/workflows/python-integration.yml +++ b/.github/workflows/python-integration.yml @@ -23,6 +23,7 @@ on: push: branches: - 'main' + # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: permissions: @@ -176,3 +177,17 @@ jobs: merge-multiple: true - name: Generate coverage report (75%) # Coverage threshold should only increase over time — never decrease it! run: COVERAGE_FAIL_UNDER=75 make coverage-report + + python-integration-required: + if: ${{ always() }} + needs: [integration-test, integration-test-s3, integration-test-adls, integration-test-gcs, integration-coverage-report] + runs-on: ubuntu-latest + steps: + - name: Verify Python integration jobs succeeded + env: + RESULTS: ${{ join(needs.*.result, ' ') }} + run: | + read -ra results <<< "$RESULTS" + for result in "${results[@]}"; do + test "$result" = "success" + done diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index eea0bd0983..314ea88cf4 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -22,6 +22,7 @@ name: GitHub Actions Security Analysis with zizmor 🌈 on: push: branches: ["main"] + # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: branches: ["**"] From ddd2c47d040d51b41c8ee113612b2b1487601b98 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Sat, 22 Aug 2026 10:23:01 -0700 Subject: [PATCH 4/4] Infra: Remove repeated workflow comments --- .github/workflows/asf-allowlist-check.yml | 1 - .github/workflows/check-md-link.yml | 1 - .github/workflows/codeql.yml | 1 - .github/workflows/license_check.yml | 1 - .github/workflows/python-ci-docs.yml | 1 - .github/workflows/python-ci.yml | 1 - .github/workflows/python-integration.yml | 1 - .github/workflows/zizmor.yml | 1 - 8 files changed, 8 deletions(-) diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 0f690fcfba..3844789995 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -24,7 +24,6 @@ name: "ASF Allowlist Check" on: - # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: push: branches: diff --git a/.github/workflows/check-md-link.yml b/.github/workflows/check-md-link.yml index 93fac4c808..ebb87b4d56 100644 --- a/.github/workflows/check-md-link.yml +++ b/.github/workflows/check-md-link.yml @@ -26,7 +26,6 @@ on: - 'mkdocs/**' branches: - 'main' - # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: workflow_dispatch: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 24b91b19e0..b113d4bed8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -22,7 +22,6 @@ name: "CodeQL" on: push: branches: [ "main" ] - # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: branches: [ "main" ] schedule: diff --git a/.github/workflows/license_check.yml b/.github/workflows/license_check.yml index 62e9d0f15b..3082656c7e 100644 --- a/.github/workflows/license_check.yml +++ b/.github/workflows/license_check.yml @@ -18,7 +18,6 @@ # name: "Run License Check" -# Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. on: pull_request permissions: diff --git a/.github/workflows/python-ci-docs.yml b/.github/workflows/python-ci-docs.yml index 38bb8ca8d5..83f97135e3 100644 --- a/.github/workflows/python-ci-docs.yml +++ b/.github/workflows/python-ci-docs.yml @@ -23,7 +23,6 @@ on: push: branches: - 'main' - # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: permissions: diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index c7f10b9206..4c9f83dcd2 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -23,7 +23,6 @@ on: push: branches: - 'main' - # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: permissions: diff --git a/.github/workflows/python-integration.yml b/.github/workflows/python-integration.yml index 1d92538433..9b49ed2726 100644 --- a/.github/workflows/python-integration.yml +++ b/.github/workflows/python-integration.yml @@ -23,7 +23,6 @@ on: push: branches: - 'main' - # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: permissions: diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 314ea88cf4..eea0bd0983 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -22,7 +22,6 @@ name: GitHub Actions Security Analysis with zizmor 🌈 on: push: branches: ["main"] - # Do not add pull_request path filters: skipped workflows do not report required checks, which blocks auto-merge indefinitely. pull_request: branches: ["**"]