From d6ad041852aaec7e9dbc8b7d0ddfcde6df53610a Mon Sep 17 00:00:00 2001 From: "Daniel A. Wozniak" Date: Mon, 2 Nov 2026 13:05:18 -0700 Subject: [PATCH] Require an approving review before auto-merging release PRs The ``Auto-Merge Automated PRs`` workflow merged any PR labeled ``automated-update`` as soon as CI finished green. That means the release PR auto-generated by ``auto-update-versions.yml`` could ship a bundled upstream bump (CPython point releases, OpenSSL/sqlite/expat/etc.) without any human having looked at the diff -- which is the whole reason the PR exists in the first place. Gate the ``gh pr merge`` call on at least one ``APPROVED`` review (via ``gh pr view --json reviews``). If no approvals are present, log and exit 0 so a later approval + CI re-run will merge normally. Approvals submitted on an older commit still count here; configure branch protection with ``Dismiss stale pull request approvals when new commits are pushed`` if a re-approval per push is desired. --- .github/workflows/auto-merge.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index 1ed67750..0dac1b0f 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -41,5 +41,21 @@ jobs: echo "No open automated-update PR matches commit ${HEAD_SHA}; nothing to merge." exit 0 fi - echo "Merging PR #${pr_number} (head ${HEAD_SHA})." + # Require at least one approving review before merging. Without this + # gate, release PRs would merge on green CI alone -- the whole point + # of these PRs is to get human eyes on the bundled upstream bumps + # before they ship. Approvals submitted on an older commit still + # count here; configure branch protection with + # "Dismiss stale pull request approvals when new commits are pushed" + # if a re-approval per push is desired. + approved="$( + gh pr view "${pr_number}" \ + --json reviews \ + --jq '[.reviews[] | select(.state == "APPROVED")] | length' + )" + if [ "${approved}" -eq 0 ]; then + echo "PR #${pr_number} has no approving reviews; skipping auto-merge." + exit 0 + fi + echo "Merging PR #${pr_number} (head ${HEAD_SHA}, ${approved} approval(s))." gh pr merge "${pr_number}" --squash --delete-branch