chore(Robot): add auto approve action#8108
Merged
Merged
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Reviewer's GuideAdds a new GitHub Actions workflow that auto-approves trusted authors’ pull requests using the bb-auto GitHub App to satisfy required-approval branch protections. Sequence diagram for the new auto-approve CI workflowsequenceDiagram
actor PR_Author
participant GitHub as GitHub
participant Auto_Approve_Workflow as auto_approve_workflow
participant Create_GH_App_Token as actions_create_github_app_token
participant BB_Auto_App as bb_auto_app
participant GH_CLI as gh_cli
PR_Author->>GitHub: open/reopen/synchronize/ready_for_review PR
GitHub->>Auto_Approve_Workflow: trigger pull_request event
Auto_Approve_Workflow->>Auto_Approve_Workflow: [non_draft & trusted_author]
Auto_Approve_Workflow->>Create_GH_App_Token: actions/create-github-app-token
Create_GH_App_Token->>BB_Auto_App: generate installation token
BB_Auto_App-->>Create_GH_App_Token: installation token
Create_GH_App_Token-->>Auto_Approve_Workflow: token output
Auto_Approve_Workflow->>GH_CLI: gh pr review --approve
GH_CLI->>GitHub: submit review as bb-auto[bot]
GitHub-->>PR_Author: PR approved by bb-auto[bot]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![bb-auto[bot]](https://avatars.githubusercontent.com/in/287253?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Consider adding an explicit
permissionsblock to the workflow (e.g.pull-requests: write,contents: read) to follow the principle of least privilege instead of relying on the default token permissions. - If you intend this to work for PRs from forks, note that repository secrets are not exposed to
pull_requestevents from forks; if that’s a requirement, you may need to adjust the event type or approach for obtaining the GitHub App token.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider adding an explicit `permissions` block to the workflow (e.g. `pull-requests: write`, `contents: read`) to follow the principle of least privilege instead of relying on the default token permissions.
- If you intend this to work for PRs from forks, note that repository secrets are not exposed to `pull_request` events from forks; if that’s a requirement, you may need to adjust the event type or approach for obtaining the GitHub App token.
## Individual Comments
### Comment 1
<location path=".github/workflows/auto-approve.yml" line_range="15-18" />
<code_context>
+ - ready_for_review
+
+jobs:
+ auto_approve:
+ name: auto approve
+ runs-on: ubuntu-latest
+ # 仅对信任的作者自动审批，按需在列表中追加账号
+ if: |
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Explicitly declare required permissions for the workflow to reduce the default permission scope.
This job currently uses the runner’s default token scope. Since it only needs to approve PRs via an app token, you can likely restrict it to minimal permissions (e.g. `permissions: { contents: read }`, or even `permissions: {}` if `create-github-app-token` doesn’t need repo scopes). Tightening `permissions` improves safety and makes intent clearer.
```suggestion
auto_approve:
name: auto approve
runs-on: ubuntu-latest
# Restrict default GITHUB_TOKEN scope; job primarily uses app token for approvals
permissions:
contents: read
# 仅对信任的作者自动审批，按需在列表中追加账号
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
ArgoZhang
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to automatically approve pull requests authored by a trusted account using the bb-auto GitHub App, to satisfy branch protection requirements for approvals.
Changes:
- Introduced
.github/workflows/auto-approve.ymlto auto-approve non-draft PRs from a trusted author list on key PR events. - Uses
actions/create-github-app-token@v2to mint an installation token and approves viagh pr review --approveasbb-auto[bot].
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8108 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 766 766
Lines 34204 34204
Branches 4696 4696
=========================================
Hits 34204 34204
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues
close #8109
Summary
Add an auto-approve workflow that uses the
bb-autoGitHub App to automatically approve pull requests from trusted authors, satisfying the branch protection rule that requires PR approvals.opened/reopened/synchronize/ready_for_review(re-approves after new pushes in case stale approvals are dismissed)ArgoZhang)actions/create-github-app-tokenand approves withgh pr review --approve, so the approval comes from bb-auto[bot]Required configuration (already done)
bb-autoapp installed on this repository with Pull requests: Read and write permissionBB_AUTO_APP_ID,BB_AUTO_PRIVATE_KEY🤖 Generated with Claude Code
Summary by Sourcery
CI: