James and Isome years ago made it so that V+2 is allowed but Submit is not because lots of people didn't know the difference and pressed Submit by accident.
Because whenever the test pipeline is completed, you get a nice shiny blue "Submit" button which then merges it bypassing Zuul, and without even having run the gate pipeline. This is because our 'test' pipeline uses V+2, it should probably use V+1 instead (cc hashar).
Make the test pipelines to vote verified +1, and thus verified +2 would only be applied by the gate / submitting pipelines.
Watchout for repositories which currently do not use gate:
- operations/debs/* or operations/software/* which do not have any gate-and-submit when the debian glue job is non voting
https://gerrit.wikimedia.org/r/#/c/integration/config/+/594507/ has a test failing for repositories lacking the gate-and-submit pipeline.