ci: let committers bypass the Merge Queue ruleset for urgent fixes (#3458)

Give apache/iceberg-public a pull_request-only bypass on the Merge Queue
ruleset so an approved urgent fix can skip the queue and required
checks. Direct pushes stay blocked, and the approval in classic
protection still applies. The team holds committers who opted in via
Boxer; the regular committers team is secret and cannot be a bypass
actor. apache/root can always bypass.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: kevinjqliu

.asf.yaml

@@ -44,6 +44,16 @@ github:
     - name: Merge Queue
       target: branch
       enforcement: active
+      bypass_actors:
+        # apache/root (ASF Infra).
+        - actor_id: 118420
+          actor_type: Team
+          bypass_mode: always
+        # apache/iceberg-public. Iceberg committers can opt into this team via
+        # https://gitbox.apache.org/boxer/.
+        - actor_id: 20107235
+          actor_type: Team
+          bypass_mode: pull_request
       conditions:
         ref_name:
           include:

CONTRIBUTING.md

@@ -66,6 +66,16 @@ All pull requests are squash merged. We generally discourage large pull requests
 
 When a pull request is under review, please avoid using force push as it makes it difficult for reviewer to track changes. If you need to keep the branch up to date with the main branch, consider using `git merge` instead. 
 
+#### Merging an urgent PR
+
+Committers can merge an urgent, approved pull request (for example, a security fix while CI is stuck) without waiting for the merge queue or required checks. Use this only when necessary; otherwise, let the merge queue and required checks run.
+
+1. Join the [`apache/iceberg-public`](https://github.com/orgs/apache/teams/iceberg-public) team via [Boxer](https://gitbox.apache.org/boxer/) (one-time; membership syncs in about 15 minutes).
+2. Get the pull request approved by a committer.
+3. Merge without waiting for the queue or required checks:
+   - CLI: `gh pr merge <number> --squash --admin`
+   - Web UI: check "Merge without waiting for requirements to be met" ([docs](https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/merging-a-pull-request-with-a-merge-queue#adding-a-pull-request-to-a-merge-queue))
+
 ### CI
 
 Currently, iceberg-rust uses GitHub Actions to run tests. The workflows are defined in `.github/workflows`.