From 2359b673ae70db90f3e4e452072300061bb71d83 Mon Sep 17 00:00:00 2001 From: Evan Rusackas Date: Tue, 22 Sep 2026 12:43:49 -0700 Subject: [PATCH 1/5] ci: require babel-extract to pass before merging master babel-extract runs check_pot_drift.py, added in #44467 to fail a PR that adds or renames a translatable string without regenerating messages.pot. It is not currently in .asf.yaml's required contexts, so it can be red (or, on a PR whose branch predates the script's own existence, error outright) without blocking merge. That gap let #44465 land 18 minutes after #44467 regenerated the template, reintroducing drift immediately: #44465's branch was cut before #44467 merged, so check_pot_drift.py did not exist on it yet, and nothing required babel-extract to be green (or even present) on the up-to-date branch before allowing the merge. #44509 cleaned up the resulting drift. babel-extract is also the only translation-drift check gated on both Python and frontend changes (unit-tests-required, which independently covers check_pot_drift.py via check_pot_drift_test.py, only runs when a PR touches Python), so it is the one that has to be required for a frontend-only string addition to be caught at all. This does not by itself close the race that let #44465 through -- that needs required_status_checks.strict: true, a separate, repo-wide decision left for a follow-up PR stacked on this one. This PR only makes the existing check_pot_drift.py gate binding on the PR's own branch. Co-Authored-By: Evan Rusackas Co-Authored-By: Claude Sonnet 5 --- .asf.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.asf.yaml b/.asf.yaml index b9d8d8093a6a..b5bacfca1fed 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -77,6 +77,7 @@ github: # combination here. contexts: - lint-check + - babel-extract - dependency-review - enforce-single-migration-head - frontend-build From 3e913f2bc68329933bc11b2adff0ce1ddfa5f47c Mon Sep 17 00:00:00 2001 From: Evan Rusackas Date: Tue, 22 Sep 2026 15:37:37 -0700 Subject: [PATCH 2/5] ci: require branches to be up to date before merging master (#44544) Co-authored-by: Claude Sonnet 5 --- .asf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.asf.yaml b/.asf.yaml index b5bacfca1fed..cb3a5bf49733 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -71,7 +71,7 @@ github: master: required_status_checks: # strict means "Require branches to be up to date before merging". - strict: false + strict: true # contexts are the names of checks that must pass # unfortunately AFAICT for `matrix:` jobs, we have to itemize every # combination here. From a136d28544538ef7d558ad1755e000bab08bdc99 Mon Sep 17 00:00:00 2001 From: Evan Rusackas Date: Wed, 23 Sep 2026 15:25:10 -0700 Subject: [PATCH 3/5] ci: drop strict:true, keep babel-extract as a required check strict:true (require branches up to date before merging) creates real manual-rebase churn without a merge queue underneath it to absorb the up-to-date requirement automatically, and #44538 (which would add that) is on hold over its own CI-cost tradeoff. Requiring babel-extract on its own still closes the common failure mode (the check never ran, or ran and failed) for every current and future PR. What strict additionally closed was the narrower gap of an old PR whose head predates check_pot_drift.py's existence carrying a stale-but-passing status with the same context name, a population that shrinks over time as those branches get touched for other reasons. Revisit strict once #44538 lands, if it's still wanted at that point. Co-Authored-By: Evan Rusackas Co-Authored-By: Claude Sonnet 5 --- .asf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.asf.yaml b/.asf.yaml index cb3a5bf49733..b5bacfca1fed 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -71,7 +71,7 @@ github: master: required_status_checks: # strict means "Require branches to be up to date before merging". - strict: true + strict: false # contexts are the names of checks that must pass # unfortunately AFAICT for `matrix:` jobs, we have to itemize every # combination here. From cb3d788a7225d780abf49e655b9bc70781fbd27a Mon Sep 17 00:00:00 2001 From: Evan Rusackas Date: Sat, 26 Sep 2026 20:22:36 -0700 Subject: [PATCH 4/5] ci: note babel-extract job id is a required check Per review, mark the babel-extract job id so a future rename does not silently break branch protection. Co-Authored-By: Evan Rusackas Co-Authored-By: Claude Sonnet 5 --- .asf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.asf.yaml b/.asf.yaml index b5bacfca1fed..51ca38f85ec8 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -77,7 +77,7 @@ github: # combination here. contexts: - lint-check - - babel-extract + - babel-extract # required in .asf.yaml; renaming this job id breaks branch protection for every PR - dependency-review - enforce-single-migration-head - frontend-build From aa1ed79ce97fbb8dda695ab8acf5851e695b953e Mon Sep 17 00:00:00 2001 From: Evan Rusackas Date: Thu, 1 Oct 2026 20:07:03 -0700 Subject: [PATCH 5/5] ci: move the required-check comment to babel-extract's own definition Elizabeth's PR reviewer agent noted that "required in .asf.yaml" is a little circular sitting on the .asf.yaml entry itself, since that's the file already in view; someone renaming the job id would be looking at the workflow file, not here. Moves the warning there instead, matching how enforce-single-migration-head.yml already documents the same kind of constraint at its own job definition rather than in .asf.yaml's required-checks list. Co-Authored-By: Evan Rusackas Co-Authored-By: Claude Sonnet 5 --- .asf.yaml | 2 +- .github/workflows/superset-translations.yml | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.asf.yaml b/.asf.yaml index 51ca38f85ec8..b5bacfca1fed 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -77,7 +77,7 @@ github: # combination here. contexts: - lint-check - - babel-extract # required in .asf.yaml; renaming this job id breaks branch protection for every PR + - babel-extract - dependency-review - enforce-single-migration-head - frontend-build diff --git a/.github/workflows/superset-translations.yml b/.github/workflows/superset-translations.yml index c135ad2396de..a613bc2cd161 100644 --- a/.github/workflows/superset-translations.yml +++ b/.github/workflows/superset-translations.yml @@ -60,6 +60,8 @@ jobs: run: | npm run build-translation + # This job id is a required status check in .asf.yaml; renaming it breaks + # branch protection for every PR until .asf.yaml is updated to match. babel-extract: runs-on: ubuntu-26.04 permissions: