> we could easily just include the latest SHA in the form and check that

Please do! I've accidentally merged the wrong code on a few occasions.

While we're making feature requests:

* The order of commits on the "Commits" tab sometimes shuffle around, especially when a history contains a merge.

* Would be nice to let me annotate code (with comments) before "Send Pull Request". Sometimes I want to make some comments to guide a reviewer.

* Browser-push updates of comment threads!

* Let me comment on a file, not just a particular line, particularly empty ones.

* Discussions are often hard to follow via email because insufficient or misleading context is included.

* 100 other things I can't think of at the moment :-)

I love GitHub; it's critical to the way we work. Thanks!

Thanks for the clarification. I, for one, think that would be a great reliability/security measure.

That was my intention, I almost always merge from the command line, except for tiny & trivial pull requests, like documentation. Its hard to run the tests through the Github web UI.

So GitHub pull requests point to the current head of a branch and not a specific commit? Tying a pull request to a specific commit (implicitly, not necessarily with new UI) seems like it would solve the problem.

Specifying the latest SHA as part of the merge would solve the trust problem. As other people have mentioned, allowing a final "review and fixup this patch" step before merging would also be useful for some workflows; this is what happens when you merge on the command line.

That leaves another major problem for us (the XS developers) which is that we actively encourage all development discussion and code review to be done on the mailing list where everyone involved sees it.

With GH pull requests this discussion gets fragmented into separate threads on the various pull requests.

Further, in my workflow, pulling in new changes to be committed into a pull request makes that pull request a new (version of) the original. See for example how Linux patches are discussed; you post an initial version, it gets discussed, you rework it, post a v2, and so on. At each point in time it is clear what exactly is being discussed.

Personally I have some other philosophical issues with GH that might be fun to discuss, get in touch by email if you're interested.

For anyone that still cares, this has been tweaked. If you attempt to merge a pull request that has changed since you loaded the page, it'll require you to re-review the pull request.