Disable "Allow edits by maintainers" by default on new PRs

[mruhlin]

Every developer in my organization has their own private fork of our repo, from which we make pull requests into the main parent repo. Those PRs have to be reviewed by another member of the team before being merged.

By default, PRs have the “Allow edits by maintainers” flag set, which allows any maintainer of the parent repo to push changes to the PR branch.

This presents opportunity for human error if the reviewer or another developer makes a faulty assumption and decides “oh, I’ll just make this one quick change, it’s totally safe” and changes something he doesn’t realize is dangerous.

If the developer who opened the PR is paying attention, he’ll hopefully notice the change and vet it before merging, but there’s a chance he’ll miss it.

I’d prefer to un-check “Allow edits by maintainers” on all PRs by default. That way, when a code reviewer has a suggestion, he has to provide direct feedback to the PR owner, who has to then accept the feedback and make the change himself.

I’ve looked everywhere in repository settings, but can’t find a way to change that by default (either in my fork or in the parent repo), so for now I have to manually un-check that and advise that teammates do the same. It would be nice if github added an option to control that.

[da2ce7]

It is also dangerous:

Warning: If your fork contains GitHub Actions workflows, the option is Allow edits and access to secrets by maintainers. Allowing edits on a fork's branch that contains GitHub Actions workflows also allows a maintainer to edit the forked repository's workflows, which can potentially reveal values of secrets and grant access to other branches.

[jasonm23]

Came across the docs for this today, but I'm actually trying to enable it (very useful for OSS collab)

However the documented option is not visible from the PR.

I agree it's not a good thing to be on by default, but was it taken out altogether?

[TokisanGames]

It seems the perspective of Op is that the PR producer is more knowledgeable about the project than the maintainers. This is not true for my projects or any I have contributed to. Off by default would mean I'd have to tell every PR producer to turn it on so I and other maintainers who usually know more about git, github, and our projects can rebase or massage the PR to get it ready for merging.

While I don't mind a per-repo setting, a system wide off by default change would be destructive.

It seems what Op really needs is more fine-grained permissions so reviewers and maintainers have different access. Maintainers should have access to everything. Reviewers only need read only and comment access.