Make ghstack land work with protected master branch about ghstack

[ezyang]

Another idea is we can create a bot integration that knows how to land ghstack PRs, and then let people install it to their repos.

[ailzhang]

For anyone who're interested in using ghstack in an open source project, you may find @feisuzhu's land bot command which limits landing from repo writers helpful. It also performs a few additional checks before landing, e.g.

• all github action jobs must pass
• PRs(including all PRs below) must be approved

This allows us to use ghstack project wide without granting everyone admin access, cheers!

[ezyang]

Nope, no new ideas. Do you have mandatory checks? If you don't, opening a new PR and immediately merging it should work pretty good.

[ailzhang]

Another idea is we can create a bot integration that knows how to land ghstack PRs, and then let people install it to their repos.

+1 on this! Opening up force pushes to everyone is kinda risky so delegating that to a bot account seems much more reasonable.
(In fact I did allow force pushes from myself so that I was the only one who can land ghstack PRs in taichi team but that made me effectively a landing bot haha :P

[ailzhang]

Hey Ed! What's the latest workaround for this issue? Is opening up master branch still the only way to do it? :P

[ezyang]

My new idea is you can enable force pushes on the protected branch

and I am going to make ghstack land force push

[aspiers]

Totally agree - opening up force pushes for everyone is absolutely not going to work for very many projects who need tighter security than that. Also creating a separate PR just for merging would create an unholy mess of duplicate / overlapping PRs, so I don't think that's a good option either.

I would suggest finding one or more great existing mergebots (i.e. ones which support flexible policies around what is required in terms of approvals, CI passing etc. in order to allow a merge) and integrate the landing process with those.