Even if it was just not pull-request, highly unlikely that it would qualify. We can assume that only trusted maintainers can put code into the Ruby main branch

Even if it was just not pull-request, highly unlikely that it would qualify. We can assume that only trusted maintainers can put code into the Ruby main branch. Similarly, every build system depends on many many signed packages. It is not much different than that.