Well we could remove all push rights to master repos and let the ci bot do the merge.You mean a CI bot that would merge on developer request? If so I don't get how it's better than leaving the developer push directly.
Usually, Gerrit UI simply hides the "Submit" button on a contribution if it doesn't conform to project requirements (fast-forward, Verified+1, Code-Review+2, no -1). AFAIK, there is no way to add such logic on GitHub UI and the Merge button is always there, even when no-one likes it.Then it's as prevented as gerrit.