Use a merge bot for merging PRs

[thomaseizinger]

Description

It is a bit tedious to manually babysit PRs and update + merge them one at a time. GitHub has merge queues in beta but it is not a public beta yet.

In the meantime, we could use https://mergify.com. It is free for open-source projects. It even has cool features like defining the commit message ahead of time in the PR description: https://docs.mergify.com/actions/merge/#commit-message-template

Open to other suggestions.

Motivation

Spend less time babysitting PRs.

Current Implementation

Are you planning to do it yourself in a pull request?

Yes.

[thomaseizinger]

Other things mergify could do for us:

• Close stale PRs: https://docs.mergify.com/configuration/#id7
• Request author to resolve conflicts: https://docs.mergify.com/actions/comment/#request-for-action
• If we end up using conventional commits (see *: Automate various parts of the release process #2902): Enforcing PR titles: https://docs.mergify.com/actions/post_check/#enforcing-conventional-commits

[galargh]

GitHub has merge queues in beta but it is not a public beta yet.

Btw, I've been trying to get us into that beta for the better part of this year but no luck so far.

[jxs]

Thanks Thomas, I think it's a great idea, I think this paired with #2948 will improve a lot the merge and conflict resolution rate in the repo!

Request author to resolve conflicts: https://docs.mergify.com/actions/comment/#request-for-action

yeah if mergify has this feature (and it seems better cause it can tag the author of the PR) we should probably close #2958 and just use mergify

[thomaseizinger]

I'll draft up an integration and then people can have a look!

[thomaseizinger]

I requested permission for integration. Not sure who can grant this? @galargh @BigLep @mxinden?

[mxinden]

I would assume @galargh is the best one to help here. Please ping me if that is not the case.

[galargh]

I do have permissions to accept the installation - I'll see it through. They do have some high-visibility customers which makes it seem quite trustworthy.

@BigLep, just to double-check, we do not have any specific process in place for vetting 3rd party integrations, right? Beyond the ask here, but I think it might be nice to have a clear checklist of what needs to happen to get a new app installed.

[BigLep]

@galargh : Yeah, I'm not familiar with any. If you want to develop one, I'd ask @andyschwab may have had one he was mentally following in the past. Thanks for seeing it through.

[andyschwab]

Pinging @galargh directly 👍

[galargh]

I and Andy are on it. Current status: we reached out to Mergify security team with a couple of questions. I'll keep you posted on the progress. FYI, a more formal process for things like this is in the works too.

[thomaseizinger]

I and Andy are on it. Current status: we reached out to Mergify security team with a couple of questions. I'll keep you posted on the progress. FYI, a more formal process for things like this is in the works too.

Any update on this? :)

[galargh]

I and Andy are on it. Current status: we reached out to Mergify security team with a couple of questions. I'll keep you posted on the progress. FYI, a more formal process for things like this is in the works too.

Any update on this? :)

Mergify got back to us and it looks reasonable from the security standpoint. I just installed it for libp2p org (scoped to rust-libp2p repo - at least for now). We don't have any repo secrets currently set up here, so we don't have to prepare secret breach mitigation plan. However, if we ever add sensitive secrets here, we should revisit this.