Pulling from upstream as a downstream committer

[axeluhl]

Our downstream main branch is protected by a number of rules. For example, PRs for it need committer approval, but you cannot approve your own PRs. Furthermore, even as a committer you cannot push straight to main.

So, if you want to pull from upstream into downstream main, you either need an approval from a committer who is different from yourself, or you need a PR author who is different from yourself.

Any other Github account filing a PR against downstream main will do. It could be a second account you have, or it may be our upstream eclipse-sailing-analytics-bot account, for which upstream committers can request an access token.

If you create a git "remote" for a fork of this repository owned by that Github account, you can then work with the merge-upstream-to-downstream.sh script to automate the creation of a PR with that secondary Github account.

The creation of the PR will trigger a compile-only workflow, without secrets, like for any PR coming from a fork. If you have made sure the changes suggested by the PR are not malicious, especially regarding build job secrets, you can use the approve-pr-for-build script to set and push a tag prXXXX-reviewed-for-build tag which will then trigger a full build for the PR with secrets.

If this build succeeds, a success commit status will be posted to the build-gate context which fulfills the required branch protection rule.

With this, you can then approve the PR and merge it if you cannot or don't want to wait for another committer's approval.

Comment:

This feels a bit like a workaround for overly restrictive and asymmetric branch protection rules that currently disallow committers to pull content from upstream, while we do allow committers to approve and merge external PRs from forks without approval by other committers. Let's see how this evolves. The procedure explained above at least allows our small team to pull the progress made upstream (probably by ourselves) into our downstream repo swiftly.

More comments welcome.