Skip to content

Surface approval-gated Copilot workflows on PRs - #74914

Merged
pelikhan merged 3 commits into
mainfrom
copilot/copilot-opt-reduce-action-required
Nov 4, 2026
Merged

pelikhan merged 3 commits into
mainfrom
copilot/copilot-opt-reduce-action-required

Conversation

Copilot AI commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

40% of sampled Copilot-branch runs stopped at action_required, leaving PRs without CI feedback and requiring maintainer intervention.

  • PR visibility: Add pending approval statuses linked to blocked CGO, CJS, CWI, docs, Agentic Commands, and Squad runs. Reconcile on completion events and hourly; clear notices after recovery without replacing CI results.
  • Security boundary: Restrict reporting to same-repository Copilot PRs and current commits. Execute no PR code and grant no approval or dispatch permissions.
  • Automatic-run configuration: Document the administrator-controlled Copilot approval policy and its privilege implications. This change exposes blocked runs; reducing approval gates still requires that policy decision.

…run policy

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Copilot AI changed the title [WIP] Auto-approve Copilot-branch workflow runs for CI Surface approval-gated Copilot workflows on PRs Nov 4, 2026
Copilot AI requested a review from gh-aw-bot November 4, 2026 18:40
@pelikhan

pelikhan commented Nov 4, 2026

Copy link
Copy Markdown
Collaborator

@copilot Keep the docs, remove the workflow

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI commented Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Keep the docs, remove the workflow

Removed the approval-reporting workflow and its test/wiring while keeping the approval-policy guidance. Commit: 51ed6ddd.

Copilot AI requested a review from pelikhan November 4, 2026 18:59
@pelikhan
pelikhan marked this pull request as ready for review November 4, 2026 20:02
Copilot AI auto review requested due to automatic review settings November 4, 2026 20:02
@pelikhan
pelikhan merged commit 1291c9c into main Nov 4, 2026
4 of 5 checks passed
@pelikhan
pelikhan deleted the copilot/copilot-opt-reduce-action-required branch November 4, 2026 20:02
@github-actions

github-actions Bot commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · routed: gpt56 max · ~2 AIC · ⌖ ~1 AIC · ⊞ 6.3K · ◷

🧪 Test quality analysis by Test Quality Sentinel

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The documentation-only diff omits the promised PR status reporting and reconciliation, so Fixes #72153 would close the issue without implementing the requested functionality.

2 open issues
What changed in this PR

This documentation-only change explains how to resolve approval-gated Copilot workflow runs in gh-aw repositories.

Changes:

  • Describes action_required runs and manual approval steps.
  • Documents the administrator-controlled automatic-run policy and its security implications.
File Description
docs/​src/​content/​docs/​troubleshooting/​common-issues.md Adds Copilot workflow approval troubleshooting, policy guidance, and a security warning.

Review effort: Max (auto)

> [!NOTE]
> Organization policies override repository settings. Contact admins if settings are grayed out.

### Copilot Pull Request Workflows Require Approval

**Solution:** Review the proposed changes, especially workflow changes, then select **Approve and run workflows** in the pull request's merge box. Changing a job's `if:` condition, adding `trusted-users`, or granting token permissions cannot bypass this pre-execution gate.

To reduce repeated approvals, a repository administrator can disable **Require approval for workflow runs** under **Settings → Copilot → Cloud agent → Policies**. This is a repository setting, not gh-aw frontmatter or an actor allowlist. See [configuring automatic workflow runs](https://docs.github.com/en/copilot/how-tos/use-copilot-agents/cloud-agent/configuring-agent-settings#allowing-github-actions-workflows-to-run-automatically-when-copilot-pushes).
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v1.2.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[copilot-opt] Reduce Copilot-branch workflow runs stuck in action_required

4 participants