#github-actions (2024-10)

cc: @Igor Rodionov

@Igor Rodionov bumping this up

@Jeremy White (Cloud Posse) is this related to the issue you faced with a customer recently?

anyway @Igor Rodionov

@Igor Rodionov @Yonatan Koren

Can we get reviews on this?

@Ben Smith (Cloud Posse) @Igor Rodionov

The new way of handling this is using repo/org rulesets

Then configuring an app bypass

Using required approvers is the old way of doing this, and yes, only works with PATs (aka real github accounts)

The app can then be configured to bypass the ruleset.

We do similar things in our org.

Aha ! I’m not sure how workflows can be protected by rulesets, but I will look into it. Thanks !

If I’m reading this correctly:
But as it is, Github Actions wants review whenever any stupid job is run within an environment with Required Approvers, so I created a “auto-approve” action and want to authenticate with my GitHub App The “an environment with Required Approvers” can be bypassed with a ruleset. But you need to replace your old branch protections with new rulesets.

Are you referring to approval of merge requests, or workflow runs ? I don’t see how rulesets can make a app bypass a workflow approval? Forgive me if I’m too slow to understand

to clarify: In environment “prod” I have a deployment protection rule, requiring 1 review to approve workflow run.

I have two workflows: plan.yaml and apply.yaml :

plan.yaml requires access to “prod” environment secrets, but should be able to run without approval, while apply.yaml should require approval.

Thanks for your help !

So here’s an example of how we use rulesets. First we make them small, and specialized. Rulesets are additive, so all rulesets that apply will be required.

Then we allow apps like mergify to bypass the rule

but the rules are required for all humans

And then we deleted all branch protections

Now, I see github has renamed those to “classic branch protections”

In environment “prod” I have a deployment protection rule, requiring 1 review to approve workflow run.

I have two workflows: plan.yaml and apply.yaml :

plan.yaml requires access to “prod” environment secrets, but should be able to run without approval, while apply.yaml should require approval. Sorry, I was solving how to do it with Pull Requests, not environment protection rules.

Have you seen this? https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-deployments/creating-custom-deployment-protection-rules

Yes, I saw that, but it seems to me that I would need a external service to interact with the hook and approve the workflow, which is a bit too much I don’t see how this usecase can work, without creating a GitHub user called “auto-approve” and create a personal access token for these approvals.

But thankyou for guidance !

Understood - I was under the impression it could be any GitHub action, but you are right it seems it must be a an app.

Out of curiosity, what is the approval logic you seek to implement?

Simplest possible approval: (at least I thought :)

• trunk based terraform repo

• GitHub environments test/prod

• matrix workflow for multiple root modules

• Reusable workflows are triggered:

• - when test tag is added to pr, tofu plan/apply runs automatically on test env (if all jobs succeed)

• - when prod tag is added to pr, tofu plan runs, adds plan output (tfcmt) to pr, and stores plan artifact to S3 - then if all jobs is succes’s, run apply in prod but wait for human workflow approval - when approved, tofu apply runs, changelog is written to github wiki, and pr is automerged.