You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This directory contains GitHub Actions workflows for the TruffleHog repository.
4
+
5
+
## PR Approval Check (`pr-approval-check.yml`)
6
+
7
+
This workflow enforces that at least one PR approver must be an **active** member of the `@trufflesecurity/product-eng` team or any of its child teams.
8
+
9
+
### How it works:
10
+
11
+
1.**Triggers**: The workflow runs on:
12
+
-`pull_request_review` events when a review is submitted (`submitted` type)
13
+
-`pull_request` events when a PR is opened, reopened, or synchronized (`opened`, `reopened`, `synchronize` types)
14
+
15
+
2.**Approval Check Process**: The workflow:
16
+
- Fetches all reviews for the PR using the GitHub API
17
+
- Filters for reviews with state `APPROVED`
18
+
- Gets all child teams of `@trufflesecurity/product-eng` using `listChildInOrg` API
19
+
- Checks if any approver is an **active** member (not pending) of either:
20
+
- The parent `@trufflesecurity/product-eng` team, OR
21
+
- Any of its child teams
22
+
- Sets a commit status accordingly
23
+
24
+
3.**Status Check**: Creates a commit status named `product-eng-approval` with:
25
+
- ✅ **Success**: When at least one approver is an active member of `@trufflesecurity/product-eng` or any child team
26
+
- ❌ **Failure**: When there are no approvals or there are approvals but none from active `@trufflesecurity/product-eng` members
27
+
28
+
### Error Handling
29
+
30
+
If there are errors listing reviews or checking team membership, the workflow reports a failure status and also fails itself.
31
+
32
+
### Branch Protection
33
+
34
+
To make this check required:
35
+
36
+
1. Go to Settings → Branches
37
+
2. Add or edit a branch protection rule for your main branch
38
+
3. Enable "Require status checks to pass before merging"
39
+
4. Add `pr-approval-check` to the required status checks
40
+
41
+
### Permissions
42
+
43
+
The workflow uses the default `GITHUB_TOKEN` which has sufficient permissions to:
44
+
- Read PR reviews
45
+
- List child teams and check team membership (for public teams)
46
+
- Create commit statuses
47
+
48
+
**Note**: If the `product-eng` team or its child teams are private, you may need to use a personal access token with appropriate permissions. The Github API returns 404 for non-members and for lack of permissions.
0 commit comments