Using update_bot_account to avoid "random user" error

[MattSturgeon]

I recently ran into this deprecation error when trying to rebase-queue a PR from a third-party contributor. https://github.com/nix-community/nixvim/pull/1785/checks?check_run_id=26906365350

I noticed in the deprecation notice that setting update_bot_account to a user in our org who has logged into Mergify Dashboard is recommended.

I have a few questions regarding how the update account is used:

• Who is marked as the "committer" when rebasing?
• Who is attributed to actions like:
  • pushing the updated commits
  • merging into the base branch
  • closing the PR
  • closing related issues
  • etc?
• Is it possible to set update_bot_account to the user who triggered the queue command, or is that not possible because it wouldn't work with the automated queue action?
• If I set update_bot_account to {{author}}, will I run into the same error (unable to update with a user that hasn't logged into mergify)?
• If I set update_bot_account to myself, will I always appear as the one who merges queued PRs?

Some of those questions are essentially asking the same thing in different ways, so apologies if I'm struggling to get my point across.

For reference, I'm tracking the issue as nix-community/nixvim#1793

[jd]

Hi @MattSturgeon !

I'll do my best to answer your questions.

• Nobody new is marked as committer in a rebase, git does not change the committer.
• That depends on where you use the bot account. If you use the bot account to rebase, the bot account is only responsible for the push.
• That could be possible, though it's not the case by default because when autoqueue (using pull request rules) is used, there's no user trigger 😢
• Yes, you'll get the same author since the default is actually {{author}} 😉
• No, you will appear at the one that rebase the PR and push it back to GH, not as the one that merges it (that'd be mergify[bot]).

update_bot_account is only for merge/rebase for updating the PR, no merging it.

Let me know if you need more clarification.

[jd]

I wrote:

Nobody new is marked as committer in a rebase, git does not change the committer.

That seems to be wrong indeed!

This is kinda frustrating, as it means any PR we queue for merge that can't be fast-forward merged ends up being rebased by the bot account we've selected.

You can use {{author}} as the bot account value though to have the PR author be used as the bot account. Would that solve your issue?

[MattSturgeon]

You can use {{author}} as the bot account value though to have the PR author be used as the bot account. Would that solve your issue?

Thanks for responding so promptly! Unfortunately using author leads to #5075 when the author is not a user that has logged into mergify.

I proposed earlier having a way to use author if the user is "known" to mergify. Better yet, if we could filter a list of users and take the first user that is known to mergify. e.g. including author, triggering-user, approving-users, and a maintainer.

But I don't think this is currently possible?

[MattSturgeon]

Alternatively if mergify didn't change the committer, that'd be a reasonable workaround.

If you use the git CLI internally (instead of e.g. libgit) you could do this by exporting the GIT_COMMITTER_NAME & GIT_COMMITTER_EMAIL env variables.

Of course, this will show as unverified for any users that expect their commits to be GPG signed, but that's already the case for the update_bot_account anyway.

[jd]

But I don't think this is currently possible?

No indeed.

Alternatively if mergify didn't change the committer, that'd be a reasonable workaround.

That does not sound like a good idea. As far as I can tell, lying would be for no good reason (or do I assume wrongly that your issue is only aesthetic?) and would be a problem in terms of traceability.

If you want Mergify to act on behalf of a user (e.g., a PR author), you have to get their consent and make them log into Mergify (that's enough).

Why don't you use a dedicated GitHub account (not Gaetan, one that you know is just a bot account and not a human 😁 ) and use it for everyone?

[MattSturgeon]

I agree. Lying about the committer is not ideal, especially if they haven't consented. It would only be a cosmetic solution (workaround) to the real issue.

To a lesser extent, claiming Gaétan committed all updated PRs is also lying. The difference being he has explicitly consented to this by approving the mergify config file and logging into the mergify dashboard.

I think you're right, setting up a bot account is probably the correct solution here. I was just being lazy and avoiding doing infrastructure chores 😅

I'll ask the nix-community org admins if this is something we can do org-wide.