mirror of https://github.com/trufflesecurity/trufflehog.git synced 2026-06-15 13:24:37 +00:00

Files

T

189cd9a683 Require product eng approval for PRs (#4478 )

* feat: Add PR approval check for product-eng team

Co-authored-by: dustin <dustin@trufflesec.com>

* Checkpoint before follow-up message

Co-authored-by: dustin <dustin@trufflesec.com>

* Refactor: Expand PR approval to include child teams

Co-authored-by: dustin <dustin@trufflesec.com>

* poke

* pr-approval-check: refactor, fix pagination, fix approval logic (#4519)

* Update README.md

* use secret

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Jeff W <233818084+j2fw@users.noreply.github.com>

2025-10-30 11:44:05 -07:00

2.1 KiB

Raw Permalink Blame History

GitHub Workflows

This directory contains GitHub Actions workflows for the TruffleHog repository.

PR Approval Check (`pr-approval-check.yml`)

This workflow enforces that at least one PR approver must be an active member of the @trufflesecurity/product-eng team or any of its child teams.

How it works:

Triggers: The workflow runs on:
- pull_request_review events when a review is submitted (submitted type)
- pull_request events when a PR is opened, reopened, or synchronized (opened, reopened, synchronize types)
Approval Check Process: The workflow:
- Fetches all reviews for the PR using the GitHub API
- Filters for reviews with state APPROVED
- Gets all child teams of @trufflesecurity/product-eng using listChildInOrg API
- Checks if any approver is an active member (not pending) of either:
  - The parent @trufflesecurity/product-eng team, OR
  - Any of its child teams
- Sets a commit status accordingly
Status Check: Creates a commit status named product-eng-approval with:
- ✅ Success: When at least one approver is an active member of @trufflesecurity/product-eng or any child team
- ❌ Failure: When there are no approvals or there are approvals but none from active @trufflesecurity/product-eng members

Error Handling

If there are errors listing reviews or checking team membership, the workflow reports a failure status and also fails itself.

Branch Protection

To make this check required:

Go to Settings → Branches
Add or edit a branch protection rule for your main branch
Enable "Require status checks to pass before merging"
Add pr-approval-check to the required status checks

Permissions

The workflow uses the default GITHUB_TOKEN which has sufficient permissions to:

Read PR reviews
List child teams and check team membership (for public teams)
Create commit statuses

Note: If the product-eng team or its child teams are private, you may need to use a personal access token with appropriate permissions. The Github API returns 404 for non-members and for lack of permissions.

2.1 KiB Raw Permalink Blame History