Mandate signed commits and signed reviews. If someone wants to merge a bot PR or any other PR by an untrusted third party, they will have to "adopt" the bot co

Mandate signed commits and signed reviews. If someone wants to merge a bot PR or any other PR by an untrusted third party, they will have to "adopt" the bot commit as their own, sign the commit locally, and then wait for a second human reviewer to do a signed merge. Not signing code means it could be tampered with all sorts of ways. Get a Nitrokey and setup git to sign with it and have your team do the same.