[Debian-salsa-ci] Two person approval rules on Salsa(-CI)

[Otto Kekäläinen]

Hi Santiago and others!

I just merged the rather trivial doc update MR
https://salsa.debian.org/salsa-ci-team/pipeline/-/merge_requests/502.
It was submitted by Ahmed, and approved by me, so a two-person-rule
took place to protect quality.

However, I was thinking, should we have a rule that every MR needs to
have *two* approvals?

Current status is that our branch protection prevents anybody from
pushing directly
(https://salsa.debian.org/salsa-ci-team/pipeline/-/settings/repository),
all new code must be in a Merge Request. However, any maintainer can
merge and there is no requirement for CI to pass or for there to be
any specific number of approvals
(https://salsa.debian.org/salsa-ci-team/pipeline/-/settings/merge_requests).

In fact, requiring a certain number of approvals seems to be a Premium
tier feature (https://docs.gitlab.com/ee/user/project/merge_requests/approvals/rules.html).
I filed a tracking issue in Salsa about this
(https://salsa.debian.org/salsa/support/-/issues/390), but I don't
expect us to have it any time soon. We could however have a "social
contract" on what is required for a MR to be merged.

What are your thoughts?