There's more to it than that. Bitcoin has many eyes watching the commits so a commit from a bad actor wouldn't get very far.

Secondly the devs come to some form of consensus and Gitian build is created and signed. https://gitian.org/.

Thirdly, the miners decide whether to build the blockchain based on the newer version of the software.

Do you know how Bitcoin insures the code reviews are done and there's not bias in the review process?

In theory they only do merges and everything has to go through a pull request.

Probably with this required status checks feature: https://help.github.com/articles/enabling-required-status-ch...

The miners aren't forced to run the code that anyone commits.