That may be dangerous. What if the patch works, passes all tests by contains non-obviously malicious (or simply non-obviously buggy, which no current test catch

That may be dangerous. What if the patch works, passes all tests by contains non-obviously malicious (or simply non-obviously buggy, which no current test catches) code? I prefer maintainers taking a bit more time to review it instead of doing one-click merges. Of course, there's a world between one-click merge and total unresponsiveness, but still.