From b7f51c6534b1c4397b1db7e2007fb39a3a6a64cf Mon Sep 17 00:00:00 2001 From: EtienneLescot Date: Sat, 7 Nov 2026 18:23:29 +0100 Subject: [PATCH] ci: read the approver app key from a main-only environment --- .github/workflows/auto-approve-linux.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/auto-approve-linux.yml b/.github/workflows/auto-approve-linux.yml index 3cb51f98c9..f4b4d58f0a 100644 --- a/.github/workflows/auto-approve-linux.yml +++ b/.github/workflows/auto-approve-linux.yml @@ -15,6 +15,11 @@ jobs: approve: if: github.event.pull_request.user.login == 'Beetix' && !github.event.pull_request.draft runs-on: ubuntu-latest + # The app key lives in the `approver` environment, which only `main` may use. + # pull_request_target is evaluated against the default branch, so this job + # passes. A workflow pushed on any other branch cannot read the key, and so + # cannot approve a pull request in the app's name. + environment: approver permissions: pull-requests: read steps: