CI system for PR builds

[db]

On 7 Apr 2018, at 07:47, Mojca Miklavec <mojca at macports.org> wrote:
> No, because that would make the infrastructure that distributes binaries to all our users susceptible to malicious PRs.

How is reviewing a PR, then letting it build and, if it succeeds, uploading the binary, if not, reporting the results — different from the current setup, which it seems to me duplicates the process, instead of reusing the infrastructure?
If a PR fails for all or some systems, then the changes would never make it into the tree, respectively, sparing trac.
I'd like to understand what is current and what would be the ideal CI for MP and what's needed to get there.