[RFC 0128] Selective auto-merge on bot upgrades

rfcs/0128-selective-auto-merge-on-bot-upgrades.md

@@ -0,0 +1,55 @@
+---
+feature: Selective auto-merge on bot upgrades
+start-date: 2022-07-07
+author: superherointj
+co-authors: (find a buddy later to help out with the RFC)
+shepherd-team: (names, to be nominated and accepted by RFC steering committee)
+shepherd-leader: (name to be appointed by RFC steering committee)
+related-issues: (will contain links to implementation PRs)
+---
+
+# Summary
+[summary]: #summary
+
+Introduce a `meta.autoMerge` attribute to packages to allow committers to delegate merge rights to package maintainers for bot auto updates.
+
+# Motivation
+[motivation]: #motivation
+
+* Reduce pending PRs for review and merge in nixpkgs.
+* Save reviewers and commiters time.
+* Speed up package upgrades.
+
+# Detailed design
+[design]: #detailed-design
+
+Add a new `meta.autoMerge` package attribute with type `bool` defaulting to `false`. To be documented in Nixpkgs manual.
+
+OfBorg reads `meta.autoMerge` value and sets `13.auto-merge` label to PR.
+
+GitHub Actions will trigger a merge when the following 4 conditions are met:
+1) `@r-ryantm` is PR's author.
+2) Package `meta.autoMerge` attribute is enabled.
+3) All CI checks passed.
+4) Package maintainer has approved PR.
+
+Due maintainers being able to add labels in GitHub, labels are not to be trusted and are used only to trigger GitHub Actions.
+An extra check of the 4 conditions (without using labels) is necessary in GitHub Actions before merge can happen.
+
+The appropriateness of setting `meta.autoMerge` is left up to committers.
+
+# Drawbacks
+[drawbacks]: #drawbacks
+
+* Some possible security issue.
+* Reduced trustworthiness.
+
+# Alternatives
+[alternatives]: #alternatives
+
+* https://github.com/NixOS/rfcs/pull/50/
+
+# Unresolved questions
+[unresolved]: #unresolved-questions
+
+* Security risks.