mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-08-03 01:38:30 +08:00
846d5d8993
* Add agent-approval-check composite action Require N human approvals on PRs that contain agent-authored commits. Posts an agent-approval-check commit status that repos mark as a required check on protected branches. This is a sanitized port of the check Anthropic runs internally on every agent-authored PR — same detection rules, /approve <sha> comment flow, sibling-PR-same-SHA guard, and fail-closed semantics, with the Anthropic-specific path exemptions and kill-switch removed and config moved to action inputs. Co-Authored-By: Claude <noreply@anthropic.com> * Drop stray internal acronym from comment * agent-approval-check: require write-access approvers, pin deps, pagination + doc fixes 🏠 Remote-Dev: homespace * agent-approval-check: prettier 🏠 Remote-Dev: homespace * agent-approval-check: verify approver write permission via REST; commits(last:100); docstring 🏠 Remote-Dev: homespace * agent-approval-check: use headRefOid; drop pull_request_review trigger and correct threat-model docs 🏠 Remote-Dev: homespace * agent-approval-check: stale-notification wording, no-retry-on-4xx, docstring API-call count 🏠 Remote-Dev: homespace * agent-approval-check: fail-closed sibling guard on commits-ordering edge; drop stale 'reviewed' from README 🏠 Remote-Dev: homespace * agent-approval-check: drop hardcoded API-call counts from logs; clarify author write-access requirement in README 🏠 Remote-Dev: homespace * agent-approval-check: count all agent-email commits (close-reopen bypass); validate REQUIRED_APPROVALS>=1; exempt_head_branches warning 🏠 Remote-Dev: homespace --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Octavian Guzu <oct@anthropic.com>
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
---
|
|
# Optional config-file form of the agent-approval-check inputs.
|
|
# Pass via `with: { config_file: .github/agent-identities.yaml }` instead of
|
|
# the inline `agent_emails` / `agent_logins` / … inputs.
|
|
|
|
# Committer emails that mark a commit as agent-authored.
|
|
agent_emails:
|
|
- noreply@anthropic.com
|
|
|
|
# GitHub logins treated as agents — a PR opened by, or an APPROVED review
|
|
# from, one of these triggers the check.
|
|
agent_app_logins:
|
|
- claude[bot]
|
|
- claude-code[bot]
|
|
|
|
# Logins whose approvals never count toward the required total.
|
|
excluded_approver_logins: []
|
|
|
|
# Head-branch glob patterns that auto-pass. Leave empty: branch names are
|
|
# attacker-controlled, so this is not a safe place to encode trust.
|
|
exempt_head_branches: []
|
|
|
|
# Per-repo path prefixes whose PRs auto-pass when ONLY those paths change.
|
|
exempt_path_prefixes:
|
|
owner/repo:
|
|
- docs/
|
|
|
|
# Per-repo base branches this check gates. A repo with no entry defaults to
|
|
# its default branch only. Listing a repo here REPLACES that default.
|
|
protected_bases:
|
|
owner/repo:
|
|
exact: [main]
|
|
prefixes: [release/]
|