From 5b981b9521218e4ca7a86db91d4fc3f9fa5301d5 Mon Sep 17 00:00:00 2001
From: Ramanathan <ramanathanbscmca@gmail.com>
Date: Sun, 26 Jul 2026 13:37:48 +0530
Subject: [PATCH 1/2] Enforce milestone requirement for pull requests on the
 2.x branch

---
 .asf.yaml                               |  5 ++
 .github/workflows/require-milestone.yml | 63 +++++++++++++++++++++++++
 2 files changed, 68 insertions(+)
 create mode 100644 .github/workflows/require-milestone.yml

diff --git a/.asf.yaml b/.asf.yaml
index 1a37fb49233..86082eb3778 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -75,6 +75,8 @@ github:
   # Enforce Review-then-Commit
   protected_branches:
     2.x:
+      # Enforce rules for Committers and PMC members too
+      enforce_admins: true
       # All reviews must be addressed before merging
       required_conversation_resolution: true
       # Require checks to pass before merging
@@ -86,6 +88,9 @@ github:
           # The GitHub Advanced Security app: 57789
           - app_id: 57789
             context: "CodeQL"
+          # Require Milestone (GitHub Actions app: 15368)
+          - app_id: 15368
+            context: "Require Milestone"
       # At least one positive review must be present
       required_pull_request_reviews:
         required_approving_review_count: 1
diff --git a/.github/workflows/require-milestone.yml b/.github/workflows/require-milestone.yml
new file mode 100644
index 00000000000..4bbe49f0236
--- /dev/null
+++ b/.github/workflows/require-milestone.yml
@@ -0,0 +1,63 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+name: "Enforce PR Milestone"
+
+on:
+  pull_request_target:
+    branches:
+      - '2.x'
+    types: [opened, synchronize, reopened, milestoned, demilestoned]
+
+jobs:
+  validate-milestone:
+    name: Require Milestone
+    runs-on: ubuntu-latest
+    steps:
+      - name: Strictly Enforce Open 2.x Milestone
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_MILESTONE="${{ github.event.pull_request.milestone.title }}"
+
+          # 1. VIOLENTLY BLOCK if no milestone is attached to the PR
+          if [ -z "$PR_MILESTONE" ]; then
+            echo "❌ ERROR: No milestone is attached to this PR!"
+            echo "You cannot merge until a milestone is assigned."
+            exit 1
+          fi
+
+          # 2. VIOLENTLY BLOCK if they attached a 3.x or 1.x milestone on the 2.x branch
+          if [[ ! "$PR_MILESTONE" =~ ^2\. ]]; then
+            echo "❌ ERROR: You are merging into the '2.x' branch, but using milestone '$PR_MILESTONE'."
+            echo "Please use a 2.x milestone (e.g., 2.25.0)."
+            exit 1
+          fi
+
+          # 3. Fetch all currently OPEN milestones in the repository
+          OPEN_MILESTONES=$(gh api repos/${{ github.repository }}/milestones -f state=open -q '.[].title')
+
+          # 4. VIOLENTLY BLOCK if the milestone hasn't been created yet by a PMC member (or is closed)
+          if echo "$OPEN_MILESTONES" | grep -Fxq "$PR_MILESTONE"; then
+            echo "✅ SUCCESS: Milestone '$PR_MILESTONE' is attached and currently open."
+            exit 0
+          else
+            echo "❌ ERROR: The milestone '$PR_MILESTONE' DOES NOT EXIST or is CLOSED."
+            echo "Merge is blocked. A PMC member must create this milestone in GitHub before you can merge."
+            echo "Currently open milestones are:"
+            echo "$OPEN_MILESTONES"
+            exit 1
+          fi

From 42596a0d953514f78d21582c723a6ee4b7621fc5 Mon Sep 17 00:00:00 2001
From: Ramanathan <ramanathanbscmca@gmail.com>
Date: Sun, 26 Jul 2026 13:42:32 +0530
Subject: [PATCH 2/2] Refactor milestone validation job name and remove unused
 API entry

---
 .asf.yaml                               | 1 -
 .github/workflows/require-milestone.yml | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.asf.yaml b/.asf.yaml
index 86082eb3778..93cbeff1ab8 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -52,7 +52,6 @@ github:
     - log4j2
     - logging
     - logger
-    - api
     - syslog
 
   # Pull Request settings:
diff --git a/.github/workflows/require-milestone.yml b/.github/workflows/require-milestone.yml
index 4bbe49f0236..4440d57f0cf 100644
--- a/.github/workflows/require-milestone.yml
+++ b/.github/workflows/require-milestone.yml
@@ -23,7 +23,7 @@ on:
     types: [opened, synchronize, reopened, milestoned, demilestoned]
 
 jobs:
-  validate-milestone:
+  Require Milestone:
     name: Require Milestone
     runs-on: ubuntu-latest
     steps: