X-post to python-committers, python-dev, and core-workflow mailing list
I have just deployed a change to bedevere-bot to address the security
concern related to automerging.(
Previously, if core dev has approved the PR and applied the "automerge"
label, the PR will be automatically merged as soon as all the required CI
checks passed. If the PR author added another commit after the PR has been
approved but before the automerge happened, the additional commit will get
merged in without additional review.
Now, if there is a new commit after the PR has been approved, it will not
be automerged until the the core dev re-reviews it. bedevere will remove
the "awaiting merge" label and apply the "awaiting core review" label.
Hope this all makes sense. And if you see any of the bot misbehaving,
please open a ticket either in core-workflow repo or in the bot's own repo.