Auto-invite bot

[euri10]

While reviewing PR on 3.10 I went into digging previous commits on trustme by @graingert and one thing caugnt my eye : the trio-bot auto invite :

python-trio/trustme#328 (comment)

Would that be suited here or more generally on Encode projects ?

Personnaly I think this would be a good idea for various reasons, I can see also good arguments against but overall I feel the pros > cons !
What do you think ?

[euri10]

Found this https://probot.github.io/apps/invite-contributors/ which seems a good way to implement without too much hassle.
What do you think of this @tomchristie ?

[tomchristie]

As a policy, I'm kinda in favour of it.

I don't feel like I've got a good idea of how the bot actually works here - where it's running, how we can be confident that it wouldn't be a potential point of security exposure etc.

It might be that a good first pass is simply to definitively switch to this as a policy, and just human-workflow it to start with. I feel like that might give us better insight into making sure we really understand what permissions we're granting, where.

(My general take on issues like this will usually be "okay, let's to this as a human workflow first, and only consider automating it if we feel like it's working well.)