From d85fb087eed7ac37e31ee9bb895c236f1dda4814 Mon Sep 17 00:00:00 2001
From: The Apache Software Foundation <root-asf-gitbox-commits@apache.org>
Date: Fri, 15 May 2026 16:52:29 -0500
Subject: [PATCH 1/3] Set up default protection ruleset for default and release
 branches

---
 .asf.yaml | 36 +++++++++++++++---------------------
 1 file changed, 15 insertions(+), 21 deletions(-)

diff --git a/.asf.yaml b/.asf.yaml
index 90b9dad8b9c..08cafcddd3d 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -1,22 +1,3 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-# https://cwiki.apache.org/confluence/display/INFRA/.asf.yaml+features+for+git+repositories
----
 
 notifications:
   commits: commits@hop.apache.org
@@ -74,7 +55,20 @@ github:
     delete_comment_discussion: "Re: [D] {title} ({repository})"
 
   #remove ~ when enabling the protection
-  protected_branches: ~
+  protected_branches:
 #    master:
 #      required_pull_request_reviews:
-#        required_approving_review_count: 1
\ No newline at end of file
+#        required_approving_review_count: 1
+  rulesets:
+    - name: "Default Branch Protection"
+      type: branch
+      branches:
+        includes:
+          - "~DEFAULT_BRANCH"
+          - "release/*"
+          - "rel/*"
+        excludes: []
+      bypass_teams:
+        - root
+      restrict_deletion: true
+      restrict_force_push: true

From e4df1349dab0415f9eee2f1b55e44c48e6409069 Mon Sep 17 00:00:00 2001
From: Hans Van Akelyen <hans.van.akelyen@gmail.com>
Date: Mon, 18 May 2026 14:37:31 +0200
Subject: [PATCH 2/3] add RAT exclusion and small github action fix

---
 .github/workflows/pr_tagger.yml | 2 +-
 pom.xml                         | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr_tagger.yml b/.github/workflows/pr_tagger.yml
index b4de2a06f0d..9be1e4dc50c 100644
--- a/.github/workflows/pr_tagger.yml
+++ b/.github/workflows/pr_tagger.yml
@@ -18,7 +18,7 @@
 
 name: LabelPrs
 on: [pull_request_target]
-permissions: read-all
+permissions: read
 jobs:
   label:
     runs-on: ubuntu-latest
diff --git a/pom.xml b/pom.xml
index 3fbbaaf6027..cf53a7bc727 100644
--- a/pom.xml
+++ b/pom.xml
@@ -472,6 +472,7 @@
                         <exclude>DISCLAIMER</exclude>
                         <exclude>LICENSE</exclude>
                         <exclude>NOTICE</exclude>
+                        <exclude>.asf.yaml</exclude>
                         <exclude>**/licenses/*</exclude>
                         <exclude>**/target/**</exclude>
                         <exclude>**/*.svg</exclude>

From 3514c5dfa0765ec7b383b895d229bd4d376d7998 Mon Sep 17 00:00:00 2001
From: Hans Van Akelyen <hans.van.akelyen@gmail.com>
Date: Mon, 18 May 2026 14:43:36 +0200
Subject: [PATCH 3/3] fix issue

---
 .asf.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.asf.yaml b/.asf.yaml
index 08cafcddd3d..b6ffba0ce69 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -55,10 +55,11 @@ github:
     delete_comment_discussion: "Re: [D] {title} ({repository})"
 
   #remove ~ when enabling the protection
-  protected_branches:
+  protected_branches: ~
 #    master:
 #      required_pull_request_reviews:
 #        required_approving_review_count: 1
+
   rulesets:
     - name: "Default Branch Protection"
       type: branch