A merge bot to compliance-trestle.

[butler54]

Issue description / feature objectives

• What groups need to approval
• Do we need codeowners for approval?
• Two approvers?
• Which merge bot (tool)

Caveats / Assumptions

• Documentation required.

Completion Criteria

• Add CODEOWNERS
• Setup teams
• Require two approvers
• Integrate a merge bot tools

[jpower432]

I think this tiered contributor approach may be relevant here -> oscal-compass/community#70

[jpower432]

@butler54 Since this ties into a community proposal, I am willing to work on this issue.

[jpower432]

Documenting the "why" for this issue as discussed in today's community meeting. @vikas-agarwal76 @mrgadgil Please let me know if you see any inaccuracies per the discussion today.

As it stands today, the typical workflow for pull request merging in compliance-trestle includes one approving review from a person with write permissions and the author must merge their own PRs. Due to this process, PRs from forks or PRs from dependabot are not getting merged right away once requirements are met. With the addition of automatic merging, we require updates to what requirements must be met for approval to ensure the right reviewers are looking at the changes.

[jpower432]

Updates have been made to require two approvals for PRs.

[jpower432]

Reopening issue as the last item was not completed.

[jpower432]

Exploring using the GH cli. You could simply add a step when PRs are opened or synchronized to set auto merge - gh pr merge --squash --auto "1". We could do this based on issue labels to make sure only certain pull request types are merged.