JuliaRegistries / JuliaRegistries/General
Have a mechanism to manually run automerge checks for PRs opened by non-authorised users/bots
- Dominant language
- Julia
- Stars
- 732
- Forks
- 605
- Avg merge
- 1h 51m
- Merged PRs (30d)
- 929
Description
Currently Automerge checks are run only for PRs opened by a limited list of authorised bots. There are some users who host their code on services different from github.com and gitlab.com for whom using JuliaRegistrator or the JuliaHub services isn't an option, however this means that
1. they need to manually open PRs to this repository (presumably they're using [`LocalRegistry.jl`](https://github.com/GunnarFarneback/LocalRegistry.jl) which at least makes this process simpler)
2. when they open the PR to General, Automerge doesn't run. While this is reasonable because Automerge is meant to be run only for PRs proposing new versions or new packages, arbitrary PRs shouldn't trigger automerge checks, this makes life for the registry maintainers harder
I think we should be able to have a mechanism (comment-based? adding a label?) to let the repo maintainers trigger Automerge checks for PRs that they evaluate are safe candidates for Automerge checks. One challenge is that the result of the automerge check should be invalidated if the PR is later modified (e.g. by pushing a new commit), to prevent malicious action.
Contributor guide
Research direction
Start by inspecting how Automerge checks currently identify authorised bots and how PR modifications invalidate existing checks. Compare a comment-based or label-based maintainer trigger, using the issue's requirement that later commits invalidate the result as the completion criterion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, julia
- Domain
- ci-cd
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100