Hello there, I want Github Actions to auto-approve "tofu plan" but require review for "tofu apply" and then auto-merge when all workflows are successful. But as it is, Github Actions wants review whenever any stupid job is run within an environment with Required Approvers, so I created a "auto-approve" action and want to authenticate with my GitHub App - but it seems the approval HAS to be a Personal Token (probably because the required approvers can only be users, not apps) https://stackoverflow.com/questions/79044626/cant-approve-deployment-via-cli-rest-api-even-when-there-are-pending-deploys Is anybody able to work around this issue ? Maybe with this new octo-sts https://www.chainguard.dev/unchained/the-end-of-github-pats-you-cant-leak-what-you-dont-have ? I know I could fix this by creating different environments for plan and apply, but my OCD wants to make this work without it... maybe I should see a doctor instead ?

The new way of handling this is using repo/org rulesets

Aha ! I'm not sure how workflows can be protected by rulesets, but I will look into it. Thanks !

If I'm reading this correctly:

But as it is, Github Actions wants review whenever any stupid job is run within an environment with Required Approvers, so I created a "auto-approve" action and want to authenticate with my GitHub App

The "an environment with Required Approvers" can be bypassed with a ruleset. But you need to replace your old branch protections with new rulesets.

Are you referring to approval of merge requests, or workflow runs ? I don't see how rulesets can make a app bypass a workflow approval? Forgive me if I'm too slow to understand 🙂 to clarify: In environment "prod" I have a deployment protection rule, requiring 1 review to approve workflow run. I have two workflows: plan.yaml and apply.yaml : plan.yaml requires access to "prod" environment secrets, but should be able to run without approval, while apply.yaml should require approval. Thanks for your help !

So here's an example of how we use rulesets. First we make them small, and specialized. Rulesets are additive, so all rulesets that apply will be required.

Yes, I saw that, but it seems to me that I would need a external service to interact with the hook and approve the workflow, which is a bit too much 😮 I don’t see how this usecase can work, without creating a GitHub user called “auto-approve” and create a personal access token for these approvals. But thankyou for guidance !

Understood - I was under the impression it could be any GitHub action, but you are right it seems it must be a an app.

Simplest possible approval: (at least I thought :) • trunk based terraform repo • GitHub environments test/prod • matrix workflow for multiple root modules • Reusable workflows are triggered: • - when test tag is added to pr, tofu plan/apply runs automatically on test env (if all jobs succeed) • - when prod tag is added to pr, tofu plan runs, adds plan output (tfcmt) to pr, and stores plan artifact to S3 - then if all jobs is succes’s, run apply in prod but wait for human workflow approval - when approved, tofu apply runs, changelog is written to github wiki, and pr is automerged.