(discussion) direct pushing to master/release-20.09/...

[mohe2015]

I would like to know what the rules are for direct pushing to master. #20836 is discussing a broader range of security-related issues.
I found out that there are quite frequently direct pushes to master. The two most recent ones in the last 100 commits are these two (seem to be completely fine):
e6295fa
for which I couldn't find any pull request or issue reference (I don't want to blame the committer, this is just an example)

39acab6
which is #99129 where you can see that the target branch was the wrong one so they just merged it manually (and commented the commits). I also just saw that #104594 seems to try to find a better solution for cherry-picking/backporting.

Considering that it's really annoying to also check all commits and not only all pull requests I would like to know why protecting these branches from direct pushing has not been done? I think it's okay to have quite a few people who are allowed to merge pull requests as this is a pretty big project but I'm not sure if direct push access is really required.

[ajs124]

This has been discussed several times before at more or less length, e.g. here: NixOS/rfcs#79

[mohe2015]

Thanks for the link. I searched this repo but I totally forgot that there are RFCs. I will close this as there doesn't seem to be consensus and it already was discussed.