On 10/04/2026 13:54, Rémi Denis-Courmont via ffmpeg-devel wrote:
Le jeudi 9 avril 2026, 04:56:41 heure d’été d’Europe de l’Est Michael
Niedermayer via ffmpeg-devel a écrit :
ive written a script to approve pull requests for which the following is
true: 1. no activity for one week
2. CI passes
3. no outstanding change requests
4. not marked as WIP
5. pull request is open
The goal is laudable, but in our times, this will not fly. Anyone could create
an account and sneak in bad or even purposedly harmful code by staying under
the proverbial radar. Unless this is restricted to a list of approved accounts
for the project, this is a non-starter. TBH. I suppose we could reuse the list
of Forgejo project maintainers (whatever the terminolgy is).
Unfortunately, this also means that the people most likely to struggle to find
reviewers will not benefit from such a contraption. And thus, it will work only
very partially to reduce friction. But this is not a technical problem, and I
don't think we can solve it with a technical approach.
AFAICT, the only solution is for people to review. In other words, we need
people to do triaging of everything to assign relevant reviewers and/or review
themselves. And we need the assignees to make/have time - by this, I more or
less mean that their current work situation allows for FFmpeg code reviews
(*unlike* like mine).
It still needs someone with actual push access to merge the PR.
It's not like a bot that will auto-merge any PR that's been missed for a
few weeks, that'd be slightly insane. It only approves it.
All it means is that established developers with push access have a
route to get a patch merged without reviews, which is how things worked
on the ML for ages.
If those people had malicious intentions, they could already just push
whatever they like.
Timo
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
