I think there’s a way to have a merge bot without security issues, i described this here: More granular commit access control via merge bot - #8 by Infinisil
@RaitoBezarius The migration to pkgs/by-name was in the RFC, I didn’t plan to hold off of it originally.