Github project settings regarding code reviews

[tonygermano]

I was looking at the way github PR reviews work and the options that can be set. I believe anyone can review and count towards one of the reviewers. There is another option that says "Require review from Code Owners" that we should probably turn on. This requires that at least one of the required number of reviews comes from someone who is a member of the team.

The code owners are specified in a file in the repo as described in the following link, and it does accept organizational teams as owners.
https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners

I'm proposing that for OpenIntegrationEngine/governance we make the Steering Committee the code owner, and we create a new "Engine Maintainers" team to be the code owner of OpenIntegrationEngine/engine.

I think if we require a minimum number of reviews by team members that will need to be verified by the person performing the merge if other community members have contributed their own reviews (or potentially there is another github app that can be configured to do this additional check, but I have not looked for one yet.)

[PBRichardson]

Thanks for having a think about this @tonygermano . I'm scanning all the governance issues from the perspective of avoid the introduction of vulnerabilities and clinical safety issues and I think it's crucial that a member of the SC has an essential vote (or a veto if such a thing is possible). There was a really powerful vulnerability introduced to WebMin by a rogue contributor, and we need to ensure our 'supply chain' monitoring is rigourous.