Discussion: Requirement for a Dedicated Committer in Each Subproject/Service

[scherersebastian]

I've observed that PRs are often approved just based on TRGs compliance. While TRGs are crucial, solely relying on them overlooks code logic nuances and poses a security risk.

Proposal

1. Every subproject/service must have at least one dedicated committer. This individual should be deeply familiar with that area and be the primary reviewer for relevant PRs.

2. PRs shouldn't be merged without this committer's sign-off. This ensures thorough code review beyond just TRGs.

3. Update our PR checklist to emphasize the importance of the committer's review (introduce a new TRG).

Request for Comments

Feedback and suggestions are welcome.

[DnlZF]

Workshop discussion and results:

• The responsibility is with the product teams.
• Only the committer can see the security advisory -> every team needs a committer

-> We agree with the proposal

[scherersebastian]

@Essenbreis can you please discuss this with the central compliance enforcement unit - not to be taken entirely seriously?
FYI @Siegfriedk

[scherersebastian]

because someone told me you are not proud or happy with your compliance role, I take that back about the compliance enforcement unit :)