Could nodejs-github-bot be impersonated?

[RafaelGSS]

Following up from last security-wg meeting. We are wondering if that's possible to impersonate a bot in a way that it can be easily overlooked by Node.js maintainers and approve a PR without looking clearly at it

[anonrig]

I see one potential way is to make sure nodejs-github-bot makes signed commits and we somehow validate it by a github workflow.