Bryan Beverly
e48f9039c8
Triggers on release publish events to run the release bot, which generates release notes using GitHub, Jira, and AI services. Adapted from the thog repo workflow with trufflehog-specific adjustments: repository argument set to trufflehog, environment requirement removed in favor of a repo-level secret, permissions restricted, and a fork guard added for consistency with other trufflehog workflows. Made-with: Cursor
GitHub Workflows
This directory contains GitHub Actions workflows for the TruffleHog repository.
PR Approval Check (pr-approval-check.yml)
This workflow enforces that at least one PR approver must be an active member of the @trufflesecurity/product-eng team or any of its child teams.
How it works:
-
Triggers: The workflow runs on:
pull_request_reviewevents when a review is submitted (submittedtype)pull_requestevents when a PR is opened, reopened, or synchronized (opened,reopened,synchronizetypes)
-
Approval Check Process: The workflow:
- Fetches all reviews for the PR using the GitHub API
- Filters for reviews with state
APPROVED - Gets all child teams of
@trufflesecurity/product-engusinglistChildInOrgAPI - Checks if any approver is an active member (not pending) of either:
- The parent
@trufflesecurity/product-engteam, OR - Any of its child teams
- The parent
- Sets a commit status accordingly
-
Status Check: Creates a commit status named
product-eng-approvalwith:- ✅ Success: When at least one approver is an active member of
@trufflesecurity/product-engor any child team - ❌ Failure: When there are no approvals or there are approvals but none from active
@trufflesecurity/product-engmembers
- ✅ Success: When at least one approver is an active member of
Error Handling
If there are errors listing reviews or checking team membership, the workflow reports a failure status and also fails itself.
Branch Protection
To make this check required:
- Go to Settings → Branches
- Add or edit a branch protection rule for your main branch
- Enable "Require status checks to pass before merging"
- Add
pr-approval-checkto the required status checks
Permissions
The workflow uses the default GITHUB_TOKEN which has sufficient permissions to:
- Read PR reviews
- List child teams and check team membership (for public teams)
- Create commit statuses
Note: If the product-eng team or its child teams are private, you may need to use a personal access token with appropriate permissions. The Github API returns 404 for non-members and for lack of permissions.