chore(Robot): add auto approve action - #1021
Merged
Merged
Conversation
Reviewer's GuideAdds a GitHub Actions workflow that automatically approves non-draft pull requests from a specific trusted bot/user using a GitHub App token and the GitHub CLI. Sequence diagram for auto-approve GitHub Action workflowsequenceDiagram
participant PR as PullRequest
participant GH as GitHubActions
participant App as GitHubApp(actions/create-github-app-token)
participant CLI as GitHubCLI(gh)
PR->>GH: pull_request opened/reopened/synchronize/ready_for_review
GH->>GH: Check branches master/main
GH->>GH: [pull_request.draft == false]
GH->>GH: [user.login in [ArgoZhang]]
GH->>App: actions/create-github-app-token
App-->>GH: bb-auto token
GH->>CLI: gh pr review --approve
CLI-->>PR: Approval with body Auto approved by bb-auto
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![bb-auto[bot]](https://avatars.githubusercontent.com/in/287253?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- The trusted author list is hard-coded in the workflow; consider moving it to a reusable input (e.g., a JSON org/repo variable or secret) so additional maintainers can be added without changing the workflow file.
- The workflow currently triggers on all PRs to master/main that meet the conditions; if you only want to auto-approve specific types of changes (e.g., label-based or path-based), consider adding an extra condition (such as a required label) to make the auto-approval criteria more explicit and safer.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The trusted author list is hard-coded in the workflow; consider moving it to a reusable input (e.g., a JSON org/repo variable or secret) so additional maintainers can be added without changing the workflow file.
- The workflow currently triggers on all PRs to master/main that meet the conditions; if you only want to auto-approve specific types of changes (e.g., label-based or path-based), consider adding an extra condition (such as a required label) to make the auto-approval criteria more explicit and safer.
## Individual Comments
### Comment 1
<location path=".github/workflows/auto-approve.yml" line_range="11-14" />
<code_context>
+ - synchronize
+ - ready_for_review
+
+jobs:
+ auto_approve:
+ name: auto approve
+ runs-on: ubuntu-latest
+ # Only auto-approve PRs from trusted authors; add accounts to the list as needed
+ if: |
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Lock down workflow permissions explicitly instead of relying on defaults.
Please add an explicit `permissions` block (either at the workflow or job level) to restrict the default `GITHUB_TOKEN` to the minimum required scopes, e.g. `permissions: contents: read`. This limits the blast radius if future steps are added or changed.
```suggestion
- synchronize
- ready_for_review
permissions:
contents: read
pull-requests: write
jobs:
```
</issue_to_address>
### Comment 2
<location path=".github/workflows/auto-approve.yml" line_range="24-26" />
<code_context>
+ contains(fromJSON('["ArgoZhang"]'), github.event.pull_request.user.login)
+
+ steps:
+ - name: Generate bb-auto token
+ id: app-token
+ uses: actions/create-github-app-token@v2
+ with:
+ app-id: ${{ secrets.BB_AUTO_APP_ID }}
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Pin the GitHub Action to a specific commit SHA instead of a floating major tag.
`@v2` will automatically pick up new v2 releases, which can change behavior unexpectedly and increases supply‑chain risk. Please pin this action to a specific commit SHA (optionally with a comment noting the version) so changes are explicit and reviewable.
Suggested implementation:
```
- name: Generate bb-auto token
id: app-token
# Pin to a specific commit SHA to avoid floating tags (update SHA as needed)
uses: actions/create-github-app-token@<COMMIT-SHA> # v2.x.x
with:
```
1. Replace `<COMMIT-SHA>` with the actual commit SHA from the `actions/create-github-app-token` repository corresponding to the desired v2 release.
2. Optionally update `# v2.x.x` to the actual version (e.g. `# v2.0.0`) to make it clear which release you pinned to.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+11
to
+14
| - synchronize | ||
| - ready_for_review | ||
|
|
||
| jobs: |
There was a problem hiding this comment.
🚨 suggestion (security): Lock down workflow permissions explicitly instead of relying on defaults.
Please add an explicit permissions block (either at the workflow or job level) to restrict the default GITHUB_TOKEN to the minimum required scopes, e.g. permissions: contents: read. This limits the blast radius if future steps are added or changed.
Suggested change
| - synchronize | |
| - ready_for_review | |
| jobs: | |
| - synchronize | |
| - ready_for_review | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: |
Comment on lines
+24
to
+26
| - name: Generate bb-auto token | ||
| id: app-token | ||
| uses: actions/create-github-app-token@v2 |
There was a problem hiding this comment.
🚨 suggestion (security): Pin the GitHub Action to a specific commit SHA instead of a floating major tag.
@v2 will automatically pick up new v2 releases, which can change behavior unexpectedly and increases supply‑chain risk. Please pin this action to a specific commit SHA (optionally with a comment noting the version) so changes are explicit and reviewable.
Suggested implementation:
- name: Generate bb-auto token
id: app-token
# Pin to a specific commit SHA to avoid floating tags (update SHA as needed)
uses: actions/create-github-app-token@<COMMIT-SHA> # v2.x.x
with:
- Replace
<COMMIT-SHA>with the actual commit SHA from theactions/create-github-app-tokenrepository corresponding to the desired v2 release. - Optionally update
# v2.x.xto the actual version (e.g.# v2.0.0) to make it clear which release you pinned to.
There was a problem hiding this comment.
Pull request overview
This PR adds a GitHub Actions workflow to automatically approve certain non-draft pull requests from a trusted author, aligning with the “Robot” automation goal described in issue #1020.
Changes:
- Introduces a new
auto-approve.ymlworkflow triggered on pull request events tomaster/main. - Generates a GitHub App installation token and uses
gh pr review --approveto submit an approval.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+18
to
+21
| # Only auto-approve PRs from trusted authors; add accounts to the list as needed | ||
| if: | | ||
| github.event.pull_request.draft == false && | ||
| contains(fromJSON('["ArgoZhang"]'), github.event.pull_request.user.login) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Link issues
fixes #1020
Summary By Copilot
Regression?
Risk
Verification
Packaging changes reviewed?
☑️ Self Check before Merge
Summary by Sourcery
CI: