Delegate approvals

[heurtematte]

See original request from automotive.score: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/work_items/7579

Summary

.eclipsefdn/otterdog assume that PRs are approved by project leads. They need the ability to delegate this responsibility.

Details

Given a sufficient project size, this becomes rather impossible. Specifically in S-CORE we have ~5 project leads and will trigger re-/additional elections of (another) ~5. None of them are so technically involved to "review" changes to .eclipsefdn/otterdog config. They are elected to leads the project (see eclipse handbook ;-)), they are not elected to understand the intricacies of bypassing repository rules or setting up merge queues.

Impact

Our .eclipsefdn/otterdog config is a mess. Most repositories do not have proper branch protections, or merge queues. Every repositry has a different "solution" to the same problem. Average wait time to get anything approved feels like 4-6 weeks.

Solution Ideas

I assume "XXX-project-leads" is a hardcoded list of people who can approve PRs in .eclipsefdn/otterdog. Add a second special list "XXX-infrastructure-leads" (otterdog-leads, eclipsefdn-reviewers, whatever) which has the same ability. Therefore project leads can delegate that responsibility by approving ONE pull request in .eclipsefdn/otterdog.

[waynebeaton]

One challenge with making a separate team of "approvers" is that the team needs to be maintained, which requires additional infrastructure to designate the individuals and propagate a list to GitHub.

How about making the list of individuals who can approve an Otterdog be part of the Otterdog configuration? All project leads can approve a configuration change that includes additional approvers. Those approvers can then approve other approvers. Add a rule that the authority to approve also requires Maintainer level access to handle the case where the list of approvers lags behind committer retirement.

To generalise this to be meaningful outside of the Eclipse project context, consider making it possible to designate teams and individuals as approvers directly in the Otterdog configuration (contingent on having at least Maintainer level privileges).