0

I manage an open source project with my team in Github that has a decent amount of community contributions. One such contributor is "Dev X," who has submitted successful pull requests and been a good community member, but does not have special access via the "Manage Access" settings nor any Github "Team" membership.

The other day, I submitted a PR and requested a review from a member of my team (not Dev X) as I normally would. But before my team member got to it, I got a notification that Dev X has reviewed and approved the PR -- green check mark and everything.

My question: How did Dev X review this PR? I've dug through the settings and can't see any way to allow or prevent a developer who doesn't appear in the "Manage Access" section from reviewing PRs. Github has a lot of documentation about how to manage PRs, how to set contribution guidelines, etc., but I don't see anything about this.

To be clear, I'm not so worried about Dev X specifically. They've shown to be a good community member so far. I'm more concerned that we have a blind spot that others could slide into.

1 Answer 1

1

As far as I can tell, anyone can review and approve changes on GitHub, but I haven't yet tested that with setups where a review is required.

The "approve" is just there because it's the general word for "user likes that change". It's not an "approve" in the sense of "user approved this for merging into the repository".

3
  • Are you sure? I don't seem to be able to review PRs in other open source projects. Maybe it was through some GUI or CLI that gives more direct access to reviewing?
    – alexbea
    Jul 20, 2020 at 16:01
  • It seems like there is a setting that allows to limit reviews to users that are collaborators on that repository. However, I have not yet found that setting. The Pull Request documentation implies that everyone with read access can review a pull request by default, and I was able to confirm that on a few smaller repositories. On the other hand, torvalds/linux managed to somehow lock PR reviews to collaborators. Jul 20, 2020 at 16:25
  • Yeah, there's something that these larger ones are doing to disable that. Maybe it's a size thing. Very confusing.
    – alexbea
    Jul 21, 2020 at 22:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .