Add check for Reviewed-By: line to merge.sh

[sxa]

Identified after I used merge.sh myself and it didn't pick up the absence of the Reviewed-By: lines
This will stop it happening again.

[nodejs-github-bot]

Review requested:

• @nodejs/actions

[aduh95]

Really it should run core-validate-commit, there are many more things that could go wrong – maybe we can also document somewhere that humans are never ever supposed to write a PR-URL trailer manually

[sxa]

I'm not sufficiently familiar with core-validate-commit to make that change but if it can be called from here then that would probably make more sense.

[sxa]

I also considered adding an extra message to the error here (and on the PR-URL check) to say "Have you run 'git node land' first?" which would discourage an manual adding of the lines.

[sxa]

Added additional message. Let me know if you're happy with the wording.

[aduh95]

I'm not sufficiently familiar with core-validate-commit to make that change

With all due respect, if you can't figure that out, you probably shouldn't be using that script at all. Folks should be landing commits using the CQ, this script was added for power users to use when the edge cases that CQ won't handle – by "power user", what I mean is someone who knows what they're doing, and are able to fix their mistakes.
I'm not sure the use case of "the user amended the commit message" is covered by the added check, the mere presence of a Reviewed-by trailer says nothing about the validity of the commit message – but also, given that tool is meant for power users, do we actually want to try to outsmart the user? FWIW on GH we only enfore the PR-URL trailer as well, so if you had git pushed (or used the GH web UI) instead of using the script, you would have come to the same result. If we want to enforce Reviewed-by, that should happen at the GH level, not in this script IMO (and I'm not sure we need to enforce it, because it might have been the first time it has happened since we added the GH rule enforcing that PR-URL trailer is present)

[sxa]

With all due respect, if you can't figure that out, you probably shouldn't be using that script at all.

My statement was more about the fact I hadn't looked at it before rather than not being able to figure it out.

While it would certainly be possible to include that I'm not sure we'd want to add a dependency on that into the script though since I don't think it currently has any other dependency on node itself currently.

But if you don't think this additional check and notice is appropriate for any use case I'll close the PR.

[aduh95]

since I don't think it currently has any other dependency on node itself currently.

It doesn't have a dependency on node AFAICT, the dependencies are listed in

node/tools/actions/merge.sh

Line 3 in 116302d

# Requires [gh](https://cli.github.com/), [jq](https://jqlang.github.io), git, and grep. Also awk if you pass a URL.

I'm not sure we'd want to add a dependency on that into the script

Definitely agree on that, adding deps should not be done lightly.

But if you don't think this additional check and notice is appropriate for any use case

My point is that if we're adding a check, it shouldn't go on merge.sh – it should be set as a rule on GH so it covers git push and folks using the web UI.

I'll close the PR

Well I would still land the wording change reminding the user if they ran git node land