{"id":15048085,"url":"https://github.com/github/privileged-requester","last_synced_at":"2025-10-19T22:32:46.337Z","repository":{"id":60861760,"uuid":"545542169","full_name":"github/privileged-requester","owner":"github","description":"Privileged Requester Action","archived":false,"fork":false,"pushed_at":"2025-01-21T23:56:50.000Z","size":5631,"stargazers_count":15,"open_issues_count":6,"forks_count":2,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-01-30T07:42:40.906Z","etag":null,"topics":["actions","automation","code-review"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/github.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-10-04T14:53:14.000Z","updated_at":"2025-01-09T19:59:31.000Z","dependencies_parsed_at":"2024-08-12T22:02:51.170Z","dependency_job_id":"e5321ee9-e4a6-4b1c-8389-da605605f50d","html_url":"https://github.com/github/privileged-requester","commit_stats":{"total_commits":116,"total_committers":4,"mean_commits":29.0,"dds":"0.35344827586206895","last_synced_commit":"84266cf193738e72b6d108c17bd38607d600e808"},"previous_names":[],"tags_count":12,"template":false,"template_full_name":"actions/javascript-action","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fprivileged-requester","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fprivileged-requester/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fprivileged-requester/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fprivileged-requester/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/github","download_url":"https://codeload.github.com/github/privileged-requester/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":237224879,"owners_count":19275102,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["actions","automation","code-review"],"created_at":"2024-09-24T21:08:00.858Z","updated_at":"2025-10-19T22:32:39.894Z","avatar_url":"https://github.com/github.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Privileged Requester\n\n[![CodeQL](https://github.com/github/privileged-requester/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/github/privileged-requester/actions/workflows/codeql-analysis.yml) [![package-check](https://github.com/github/privileged-requester/actions/workflows/package-check.yml/badge.svg)](https://github.com/github/privileged-requester/actions/workflows/package-check.yml) [![units-test](https://github.com/github/privileged-requester/actions/workflows/test.yml/badge.svg)](https://github.com/github/privileged-requester/actions/workflows/test.yml)\n\nThis GitHub Action will automatically approve pull requests based off of requester criteria defined in the target repository.\n\n## Use Case\n\nLet's say you have a repository with a lot of dependabot PRs that are safe to automatically merge because you have a super duper robust test suite. You can use this Action to automatically approve pull requests from the dependabot user (or any other user you want).\n\nHere are some bonus use cases:\n\n- Automatically approve pull requests that were created by some automation that your team wrote\n- Automatically approve pull requests that were created by a bot user that you have created\n- Automatically approve pull requests that were created by a bot user that you have created and that have a specific label\n- Automatically approve pull requests that were created by an admin/priviliged user for your project\n\n## Workflow Configuration\n\nHere is an example of how to use this Action in its simplest form:\n\n\u003e Where `vX.X.X` is the latest release version found on the releases page\n\n```yaml\nname: privileged-requester\non:\n  pull_request:\n    types: [opened, synchronize, reopened, labeled, unlabeled]\n\npermissions:\n  pull-requests: write\n  contents: read\n\njobs:\n  check:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: github/privileged-requester@vX.X.X\n        with:\n          path: config/privileged-requester.yaml # the path on the repo's default branch where the privileged requester config can be found\n          checkCommits: \"true\" # check to ensure all commits are made by the requester\n          checkDiff: \"true\" # check to ensure the diff is only removals (no additions) - set to \"false\" to disable\n          checkLabels: \"true\" # check to ensure the labels on the PR match those defined in the privileged requester config\n```\n\n\u003e Note: The `config/privileged-requester.yaml` file should be added to the default branch of the target repository before this workflow is run. Otherwise, the workflow will fail since it cannot find the configuration file.\n\nSee the example in [the workflow folder](.github/workflows/privileged-requester.yml)\n\n## Requester Configuration\n\nIn the target repo, the privileged requester functionality should be configured like so:\n\n```yaml\n---\nrequesters:\n  dependabot[bot]:\n    labels:\n      - dependencies\n      - github_actions\n```\n\nSee the example in the [config folder](config/privileged-requester.yaml).\n\nThe location of this file in the target repo should be the path used in the workflow configuration `path`\n\n## Reviewer\n\nThis Action runs, by default, with the built-in `GITHUB_TOKEN` and so approves the PRs as the `github-actions[bot]` user.\n\nHowever, you can configure the Action to run with a different repo scoped token - a bot user of your own - by defining the Workflow configuration option `github_token` pointing to the repo secret for that token.\n\n## Configuration\n\nHere are the configuration options for this Action:\n\n### Inputs 📥\n\n| Input     | Required? | Default                                     | Description |\n|-----------| --------- |---------------------------------------------| ----------- |\n| `github_token`   | yes | `${{ github.token }}`                         | The GitHub token used to create an authenticated client - Provided for you by default! - You can use the default provided token or you can provide a PAT as an alternative robot user token. Make sure this is a repository scoped token |\n| `handle` | yes | `'github-actions[bot]'` | When using the default `${{ github.token }}` (as seen above), the \"handle\" is fetched from this input since the token is repository scoped and it cannot even read its own handle. You should not need to change this input. |\n| `path`      | yes | `config/privileged-requester.yaml`            | Path where the privileged requester configuration can be found |\n| `prCreator` | yes | `${{ github.event.pull_request.user.login }}` | The creator of the PR for this pull request event |\n| `prNumber`  | yes | `${{ github.event.pull_request.number }}`     | The number of the PR for this pull request event |\n| `checkCommits` | yes | `\"true\"`                                       | An option to check that every commit in the PR is made from the privileged requester |\n| `checkDiff` | yes | `\"true\"`                                       | An option to check that the PR diff only has a removal diff, with no additions - This option defaults to `\"true\"` but it can be disabled by setting it to `\"false\"` |\n| `checkLabels` | yes | `\"true\"`                                       | An option to check that the labels on the PR match those defined in the privileged requester config |\n| `commitVerification` | yes | `\"false\"` | Whether or not to validate all commits have proper verification via GPG signed commits |\n| `fallback_to_commit_author` | no | `\"false\"` | Whether or not to fallback to the commit author value if the commit login value is missing |\n\n### Outputs 📤\n\n| Output | Description |\n| ------ | ----------- |\n| `approved` | The string `\"true\"` if the privileged-requester approved the pull request |\n| `commits_verified` | The string `\"true\"` if all commits in the PR are signed/verified |\n\n## First Time Setup\n\nIt should be noted that this Action looks at the `default` branch for its configuration file. This means that if you add this Action through a pull request, it will look at the default branch and _fail_ because it cannot find the config file that has not landed on `main` / `master` yet. After merging the pull request that adds this Action to your repository, it should work as expected.\n\n## GitHub App Permissions\n\nIf you are using a GitHub app with this Action, you will need to grant the following permissions:\n\n- Checks: `Read and write`\n- Contents: `Read and write`\n- Metadata: `Read-only`\n- Pull requests: `Read and write`\n\n### Subscribe to Events\n\nThis GitHub App will subscribe to the following events:\n\n- Check suite\n- Check run\n- Pull request\n\n## Known Issues\n\n### Duplicate Approvals\n\nThere is logic built into this Action to try and prevent duplicate approvals from taking place. However, if you subscribe to many `pull_request` events in your Actions workflow you may see duplicate approvals. Here is an example of the workflow configuration that could cause this and why:\n\n```yaml\non:\n  pull_request:\n    types: [opened, synchronize, reopened, labeled, unlabeled]\n```\n\nNow if you were to open a pull request and apply labels to it during the creation process, you would likely see two approvals from this workflow (assuming you pass the privileged requester criteria). This is because the `pull_request` event is triggered twice - once for the `opened` event and once for the `labeled` event. If you want to avoid this, you can remove the `labeled` event from the workflow configuration or the `opened` event.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fprivileged-requester","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgithub%2Fprivileged-requester","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fprivileged-requester/lists"}