[v3-4-test] Enable auto-merge, gated on a dedicated CI passed check (#75142) - #75550

…75142)

* Enable auto-merge, gated on a dedicated CI passed check

Committers wait on CI for every approved PR only to click merge. Auto-merge was tried in 2025 and turned off because a required check left no way to merge past CI that was red for unrelated reasons; rulesets now let committers bypass the required check, which restores that escape hatch. The existing Finalize tests job cannot be the required check: it is skipped when tests fail, and GitHub counts a skipped required check as passed, so a dedicated gate job reports a real result on every PR.

Generated-by: Claude Opus 5

* Do not report CI passed when project CI did not run

With the fork CI gate (AIP-120), a gated pull request skips build-info and every job after it, which the CI passed job would count as success and let the pull request merge on no CI. The job now reports under another name when build-info is skipped; the fork CI reconciler posts CI passed from the fork run instead.

Generated-by: Claude Opus 5

* Require CI passed on release branches too

allow_auto_merge is repository-wide, but only main required CI, so auto-merge on a pull request to a release branch would merge on approval alone, before CI finished or despite failures.

Generated-by: Claude Opus 5

* Address auto-merge review: clarify ARM gate and fork CI dependency

The README no longer asks for an immediate backport, and says that Tests (ARM) has the same CI passed job for its push and scheduled runs. The CI passed job comment notes that the project-CI-not-run name only appears once the AIP-120 gate adds a condition to build-info.

Generated-by: Claude Opus 5

* Add check-run-needed to the CI passed gate

Rebased onto main, which added the check-run-needed job in #75420. Without it in the gate's needs, a failure of that job would not stop auto-merge, and check-ci-gate-needs failed in Scripts tests.

Generated-by: Claude Opus 5

* Set PYTHONPYCACHEPREFIX for the CI passed gate hook

main now requires every prek hook to write bytecode outside the source tree (check-prek-hooks-pycache-prefix).

Generated-by: Claude Opus 5

* Let the Write role bypass the CI rulesets instead of the secret committers team

GitHub refuses secret teams as ruleset bypass actors, so airflow-committers cannot be one. The Write repository role is held only by committers on this repository, and the asfyaml convenience syntax only names teams, so both CI rulesets move to the raw payload syntax. That syntax cannot pin the required checks to the GitHub Actions app, because asfyaml sends integration_id to the API as a string.
(cherry picked from commit a5af91d)

Co-authored-by: Jarek Potiuk <[email protected]>
Generated-by: Claude Opus 5