2026

Apache Airflow

20 pull requests merged into apache/airflow (38,000+ stars), out of 42 submitted, through an autonomous agent pipeline I built to run the contribution cycle. Sharp bugfixes: scheduler, task-sdk, providers (Google, Oracle, Alibaba, SMTP, FAB), database migrations, including 2 security fixes.

github.com

GitHub list of YoannAbriel's pull requests merged into apache/airflow, 20 in total — The 20 PRs merged into apache/airflow, as GitHub lists them

20 PRsmerged into apache/airflow, through an agent pipeline

Overview

Rather than contributing to open source one PR at a time, I built an autonomous agent pipeline that runs the contribution cycle on apache/airflow: issue selection, bug reproduction, fix, tests, review follow-up. The result: 42 pull requests submitted, 20 merged into one of the largest Python open-source projects (38,000+ stars). These are not typo fixes: blocked path traversal through dag_id and run_id, fixed the JWT header for symmetric-key tokens, optimized a database migration to pure SQL, fixes across the Google (BigQuery, Dataproc), Oracle, Alibaba, SMTP and FAB providers, and in the task-sdk.

Agent pipeline

Rather than contributing one PR at a time, an autonomous agent pipeline built on Claude Code runs the whole cycle: issue selection, bug reproduction, fix, tests, review follow-up. The bug is reproduced before any fix, and every PR ships with its tests.

Security fixes

GitHub headers of two merged pull requests: blocking path traversal via dag_id and run_id, and always including kid in the JWT header, with the start of each problem statement — PRs 63296 and 62883 on GitHub, Merged badge and problem statement

Two security fixes merged: blocking path traversal through dag_id and run_id (PR 63296) and fixing the JWT header for symmetric-key tokens, which did not include the kid (PR 62883).

Migration in pure SQL

GitHub page of merged PR 63628: optimize migration 0094 to use SQL instead of Python deserialization, with the description and its five reviewers — PR 63628 on GitHub, merged into apache:main

Migration 0094 deserialized every row in Python. The fix (PR 63628) rewrites the transformation in pure SQL: on PostgreSQL, a single CTE replaces the Python loop.

Task-sdk and providers

GitHub headers of two merged pull requests: greenback fallback for Variable access in the triggerer (task-sdk) and the SmtpHook OAuth2 XOAUTH2 fix (SMTP provider) — PRs 63387 (task-sdk) and 62879 (SMTP provider) on GitHub

Fixes in the task-sdk (Variable access from the triggerer, PR 63387) and across the Google, Oracle, Alibaba, SMTP and FAB providers, here the SmtpHook OAuth2 XOAUTH2 authentication (PR 62879).

42 submitted, 20 merged

GitHub list of pull requests by author YoannAbriel in apache/airflow, 42 in total (0 open, 42 closed), mixing merged and closed PRs — All 42 submitted pull requests, merged or not, as GitHub lists them

All PRs are public and verifiable on GitHub: 42 submitted, 20 of them merged into apache/airflow, a project with 38,000+ stars.

Challenges

Understanding a very large codebase with strict contribution conventions
Getting fixes through review by demanding maintainers of an Apache project
Orchestrating reliable autonomous agents across the whole cycle: issue, fix, tests, review
Covering varied subsystems: scheduler, task-sdk, providers, migrations, security

Solutions

Autonomous agent pipeline built on Claude Code to run the contribution cycle
Systematic bug reproduction before any fix, tests added with every PR
Review follow-up and iteration until merge, following the project's conventions

Results

20 pull requests merged out of 42 submitted into apache/airflow
2 security fixes merged (path traversal via dag_id/run_id, JWT kid header)
Contributions across scheduler, task-sdk, migrations and 6+ providers (Google, Oracle, Alibaba, SMTP, FAB, standard)
All PRs public and verifiable on GitHub

Technologies

PythonApache AirflowAutonomous agentsClaude CodeOpen Sourcepytest

Next project