mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-08-03 09:48:31 +08:00
846d5d8993
* Add agent-approval-check composite action Require N human approvals on PRs that contain agent-authored commits. Posts an agent-approval-check commit status that repos mark as a required check on protected branches. This is a sanitized port of the check Anthropic runs internally on every agent-authored PR — same detection rules, /approve <sha> comment flow, sibling-PR-same-SHA guard, and fail-closed semantics, with the Anthropic-specific path exemptions and kill-switch removed and config moved to action inputs. Co-Authored-By: Claude <noreply@anthropic.com> * Drop stray internal acronym from comment * agent-approval-check: require write-access approvers, pin deps, pagination + doc fixes 🏠 Remote-Dev: homespace * agent-approval-check: prettier 🏠 Remote-Dev: homespace * agent-approval-check: verify approver write permission via REST; commits(last:100); docstring 🏠 Remote-Dev: homespace * agent-approval-check: use headRefOid; drop pull_request_review trigger and correct threat-model docs 🏠 Remote-Dev: homespace * agent-approval-check: stale-notification wording, no-retry-on-4xx, docstring API-call count 🏠 Remote-Dev: homespace * agent-approval-check: fail-closed sibling guard on commits-ordering edge; drop stale 'reviewed' from README 🏠 Remote-Dev: homespace * agent-approval-check: drop hardcoded API-call counts from logs; clarify author write-access requirement in README 🏠 Remote-Dev: homespace * agent-approval-check: count all agent-email commits (close-reopen bypass); validate REQUIRED_APPROVALS>=1; exempt_head_branches warning 🏠 Remote-Dev: homespace --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Octavian Guzu <oct@anthropic.com>
40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
# Require human approvals on PRs that contain agent-authored commits.
|
|
#
|
|
# Both triggers run the workflow file from the BASE/DEFAULT branch, so a PR
|
|
# cannot edit this check to approve itself. (`pull_request_review` is not
|
|
# used because it runs from the merge ref, not the default branch; native
|
|
# Approve reviews are picked up on the next synchronize or `/approve`
|
|
# comment.)
|
|
#
|
|
# After adding this workflow, mark `agent-approval-check` as a required
|
|
# status check on your protected branches.
|
|
|
|
name: agent-approval-check
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
issue_comment:
|
|
types: [created]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
statuses: write
|
|
|
|
jobs:
|
|
check:
|
|
# issue_comment also fires on plain issues; skip those early.
|
|
if: github.event_name != 'issue_comment' || github.event.issue.pull_request
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: anthropics/claude-code-action/agent-approval-check@main
|
|
with:
|
|
required_approvals: 2
|
|
agent_emails: noreply@anthropic.com
|
|
agent_logins: claude[bot],claude-code[bot]
|
|
# Uncomment to tune:
|
|
# excluded_approvers: dependabot[bot]
|
|
# exempt_path_prefixes: docs/
|
|
# protected_bases: main,release
|