From 5b423bf3b0bd220c14c7e0d1fd09a918c42675da Mon Sep 17 00:00:00 2001 From: json cheng Date: Sat, 18 Apr 2026 00:45:53 +0800 Subject: [PATCH] [repo] fix : remove branch policy workflow --- .claude/learnings.md | 2 +- .github/scripts/validate_branch_policy.py | 62 ----------------------- .github/workflows/branch_policy.yml | 27 ---------- docs/development/github_branch_policy.md | 13 ++--- 4 files changed, 4 insertions(+), 100 deletions(-) delete mode 100644 .github/scripts/validate_branch_policy.py delete mode 100644 .github/workflows/branch_policy.yml diff --git a/.claude/learnings.md b/.claude/learnings.md index f24dcc7220ee..d39e7e5a707d 100644 --- a/.claude/learnings.md +++ b/.claude/learnings.md @@ -37,4 +37,4 @@ - If `graph` grammar generation must stay on `ANTLR` `4.13.2`, prefer downloading the exact complete jar into `/usr/local/lib` instead of relying on Ubuntu's older `antlr4` package. - For `ClickHouse` devcontainers on macOS, keep the source tree bind-mounted but move the build directory onto a Docker named volume or another container-local path to avoid Docker Desktop bind-mount I/O bottlenecks. - On macOS devcontainers, the cleanest compromise is often mounting the Docker volume directly at `/workspace/ClickHouse/build`, so editors keep the familiar path while build I/O stays off the host bind mount. -- GitHub rulesets can require PRs and block direct pushes on target branches, but they do not natively express "base branch X only accepts head branches matching Y"; enforce that part with a required `pull_request` workflow. +- GitHub rulesets can require PRs and block direct pushes on target branches, but they do not natively express "base branch X only accepts head branches matching Y"; if we choose not to add a repository workflow for that, the source-branch flow remains a convention only. diff --git a/.github/scripts/validate_branch_policy.py b/.github/scripts/validate_branch_policy.py deleted file mode 100644 index 4a88b0c046d0..000000000000 --- a/.github/scripts/validate_branch_policy.py +++ /dev/null @@ -1,62 +0,0 @@ -#!/usr/bin/env python3 - -import os -import re -import sys - - -BRANCH_PATTERN = re.compile(r"^(?P[^/]+)/(?Pdev|main)-(?P[A-Za-z0-9._-]+)$") - - -def fail(message: str) -> int: - print(message, file=sys.stderr) - return 1 - - -def parse_branch(name: str): - match = BRANCH_PATTERN.fullmatch(name) - return match.groupdict() if match else None - - -def main() -> int: - base = os.environ.get("BASE_REF", "").strip() - head = os.environ.get("HEAD_REF", "").strip() - - if not base or not head: - return fail("Missing `BASE_REF` or `HEAD_REF` environment variable.") - - if base == "master": - head_branch = parse_branch(head) - if not head_branch or head_branch["kind"] != "main": - return fail( - f"`master` only accepts pull requests from `/main-*` branches. " - f"Received head branch `{head}`." - ) - - print(f"`master` <- `{head}` is allowed.") - return 0 - - base_branch = parse_branch(base) - if not base_branch or base_branch["kind"] != "main": - print(f"No branch policy applies to base branch `{base}`.") - return 0 - - head_branch = parse_branch(head) - if not head_branch or head_branch["kind"] != "dev": - return fail( - f"`{base}` only accepts pull requests from `{base_branch['module']}/dev-*` branches. " - f"Received head branch `{head}`." - ) - - if head_branch["module"] != base_branch["module"]: - return fail( - f"`{base}` only accepts pull requests from the same module namespace. " - f"Expected `{base_branch['module']}/dev-*`, received `{head}`." - ) - - print(f"`{base}` <- `{head}` is allowed.") - return 0 - - -if __name__ == "__main__": - sys.exit(main()) diff --git a/.github/workflows/branch_policy.yml b/.github/workflows/branch_policy.yml deleted file mode 100644 index 01c173aac40e..000000000000 --- a/.github/workflows/branch_policy.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: branch policy - -on: - pull_request: - types: - - opened - - reopened - - synchronize - - edited - - ready_for_review - branches: - - master - - "*/main-*" - -jobs: - validate: - name: validate - runs-on: ubuntu-latest - steps: - - name: Check out repository - uses: actions/checkout@v4 - - - name: Validate source and target branch policy - env: - BASE_REF: ${{ github.base_ref }} - HEAD_REF: ${{ github.head_ref }} - run: python3 .github/scripts/validate_branch_policy.py diff --git a/docs/development/github_branch_policy.md b/docs/development/github_branch_policy.md index 05a83b4b2e1d..d994eab7da9e 100644 --- a/docs/development/github_branch_policy.md +++ b/docs/development/github_branch_policy.md @@ -1,9 +1,6 @@ # GitHub Branch Policy -This repository uses two layers of enforcement for branch flow: - -1. GitHub rulesets protect the target branches. -2. The `branch policy / validate` workflow checks whether the pull request source branch is allowed for the target branch. +This repository uses GitHub rulesets to protect target branches. Branch naming and source-to-target flow stay as project conventions. ## Branch naming @@ -28,23 +25,19 @@ Examples: ## Required GitHub rulesets -GitHub rulesets can require pull requests and block direct pushes on protected targets, but the head-branch restriction is enforced by the workflow because GitHub does not provide a native rule for "base branch X only accepts head branches matching Y". +GitHub rulesets can require pull requests and block direct pushes on protected targets. They do not natively enforce "base branch X only accepts head branches matching Y", so the source-branch flow above is currently a repository convention rather than a hard check. -After merging this file and the workflow, configure these repository rulesets in GitHub: +Configure these repository rulesets in GitHub: 1. Ruleset for `master` - Target branches: `master` - Require a pull request before merging - Restrict updates - - Require status checks to pass before merging - - Required check: `branch policy / validate` 2. Ruleset for module main branches - Target branches: `*/main-*` - Require a pull request before merging - Restrict updates - - Require status checks to pass before merging - - Required check: `branch policy / validate` Optional hardening: