My repos.yml

# repos lists the config for specific repos.
repos:
  # id can either be an exact repo ID or a regex.
  # If using a regex, it must start and end with a slash.
  # Repo ID's are of the form {VCS hostname}/{org}/{repo name}, ex.
  # <http://github.com/runatlantis/atlantis|github.com/runatlantis/atlantis>.
  - id: /.*/
    # branch is an regex matching pull requests by base branch
    # (the branch the pull request is getting merged into).
    # By default, all branches are matched
    branch: /.*/

    # apply_requirements sets the Apply Requirements for all repos that match.
    apply_requirements: [approved]

    # workflow sets the workflow for all repos that match.
    # This workflow must be defined in the workflows section.

    # allowed_overrides specifies which keys can be overridden by this repo in
    # its atlantis.yaml file.
    allowed_overrides:
      [apply_requirements, workflow, delete_source_branch_on_merge]

    # allowed_workflows specifies which workflows the repos that match
    # are allowed to select.
    allowed_workflows: [terragrunt]

    # allow_custom_workflows defines whether this repo can define its own
    # workflows. If false (default), the repo can only use server-side defined
    # workflows.
    allow_custom_workflows: true

    # delete_source_branch_on_merge defines whether the source branch would be deleted on merge
    # If false (default), the source branch won't be deleted on merge
    delete_source_branch_on_merge: true

i just checked, it is atlantis that doesnt check correctly gitlab approvals. And for the 2nd part, i dont even think it was implemented. (MR being unable to merge unless atlantis apply run succesfully)