Enforce pull requests and approvals for all repository updates

[kylebarron]

I was looking through the recent commit history because I noticed that CI was broken (#214 (comment)) and I noticed that there were two recent commits that were pushed directly to the main branch without a pull request.

In the spirit of openness, I propose that we require a pull request before pushing to main.

I see that in the repository settings we intend to require a pull request before merging

but because the

box is not checked, this does not apply to people with commit access.

I propose that we enable this box to force all, even administrators, to have at least one approval on a PR.

[cholmes]

Thanks for flagging this. I think it's important that every change made to the repo/spec is discussed and approved - it's weird to me to have PR's listed in 'closed' that are merged but not approved. I think we should go further than just requiring this in the future, but should revert these changes and have them go through the process. I'd argue that this process has been a 'community norm', and we shouldn't make an exception for these changes. It should be hard to take them through our process.

[jorisvandenbossche]

I have ticked the "Do not allow bypassing the above settings" box

[kylebarron]

I have ticked the "Do not allow bypassing the above settings" box

With that, we can probably close this issue? Or should we leave it open for any more visibility?

[cholmes]

+1 to just close the issue.