[INFRA] Set up default rulesets for default and release branches

[asf-gitbox-commits]

This Pull Request enables the repository to conform with the "sane default security settings" of the Apache Software Foundation by configuring a default branch ruleset that protects the default branch and any release branches.

Note that ~DEFAULT_BRANCH is a GitHub symbolic link to the current default branch (HEAD) of the repository and does not need changing.
If the managing project does not wish to set up these defaults, please close this Pull Request. Alternatively, the project may merge this Pull Request to apply the changes immediately.

If no action is taken, this Pull Request will be automatically merged by the Apache Infrastructure team on 2026-06-14 (30 days from now).

For any further information, please reach us on Slack or at: users@infra.apache.org

[caicancai]

cc @zabetak

[rubenada]

Please do not merge this PR for the moment, there's an ongoing discussion within Calcite PMC about this.

[xiedeyantu]

We are awaiting the conclusion of the PMC's discussions.

[zabetak]

I am mostly OK with the changes but let's wait for the conclusion of the discussion in the private@ list.

FYI: I raised some questions about the bypass_teams option under apache/infrastructure-asfyaml#98

[xiedeyantu]

Infra replied. It looks like we can implement a whitelist using  bypass_teams . So, what's the conclusion?

[zabetak]

Personally, I am fine to keep the PR as is since we can always reach out to INFRA to rectify a problem. If it turns out to be complicated we can revisit the bypass_teams in the future.

[xiedeyantu]

I don't actually have much of a preference. The real issue is the efficiency of handling problems. If some people in the Calcite community (such as the PMC Chairs or others) had the authority to respond to problems, would they be able to do so faster? If INFRA's response speed is also fast, then there is really no difference between the two.