We should mirror git-infra to Github.
Forcing pushes to go through git-infra (at least for master) would enable us to enforce various things (like signed merges)

We should put gitolite.rc and repository hooks in the gitolite-admin repo, since:

1. The privilege escalation issue doesn't exist: code execution as git only gives you access to the gitolite container.
2. This gives a sane way to configure gitolite, which we cannot currently do (except for poking directly at the data container)
3. This means gitolite's config is versioned.

This would enable doing #3 and #4 :-)

We should enforce pushes to master to be:

• merge between the current master and one or more branches;
• signed by a trusted key;
• the commit's author is the key's owner.

On top of that, we can use git-notes to record a number of things, such as review and CI status.
(I would much rather not be in a situation where Github is the only place where that data exists)