GitHub App for workflow approval

[sndepp5]

Select Topic Area

Question

Body

Hello all,

I am trying to automate the workflow approvals for scheduled jobs that use GitHub environment secrets.
I have tested using the GitHub App, but it failed to approve.
ERROR - Failed to approve run 13414299838: 403 {"message":"This workflow run is not waiting for approval","documentation_url":"https://docs.github.com/rest/actions/workflow-runs#approve-a-workflow-run-for-a-fork-pull-request","status":"403"}
Is this achievable using the GitHub App?

FYI: I am not using any webhooks

import os
import requests
import jwt
import time
import logging

logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')

APP_ID = os.getenv("APP_ID")
PRIVATE_KEY_PATH = os.getenv("APP_PRIVATE_KEY")
REPO =  os.getenv("GITHUB_REPOSITORY")

def generate_jwt():
    try:
        logging.info("Generating JWT token for authentication.")
        with open(PRIVATE_KEY_PATH, "rb") as f:
            private_key_content = f.read()
        
        payload = {
            "iat": int(time.time()),
            "exp": int(time.time()) + 600,
            "iss": int(APP_ID)
        }
        jwt_token = jwt.encode(payload, private_key_content, algorithm="RS256")
        logging.info("JWT token generated successfully.")
        return jwt_token
    except Exception as e:
        logging.error(f"Failed to generate JWT: {e}")
        raise

def get_installation_token(jwt_token):
    try:
        logging.info("Fetching GitHub App installation ID.")
        headers = {"Authorization": f"Bearer {jwt_token}", "Accept": "application/vnd.github.v3+json"}
        response = requests.get("https://api.github.com/app/installations", headers=headers)
        response.raise_for_status()
        
        installation_id = response.json()[0]["id"]
        logging.info(f"Installation ID: {installation_id}")
        
        logging.info("Requesting installation access token.")
        token_response = requests.post(
            f"https://api.github.com/app/installations/{installation_id}/access_tokens", headers=headers
        )
        token_response.raise_for_status()
        token = token_response.json()["token"]
        logging.info("Installation access token retrieved successfully.")
        return token
    except Exception as e:
        logging.error(f"Failed to retrieve installation token: {e}")
        raise

def approve_pending_workflows(token):
    try:
        logging.info("Fetching pending workflow runs.")
        headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github.v3+json"}
        
        pending_runs = requests.get(
            f"https://api.github.com/repos/{REPO}/actions/runs?status=waiting",
            headers=headers
        )
        pending_runs.raise_for_status()
        workflow_runs = pending_runs.json().get("workflow_runs", [])
        
        if not workflow_runs:
            logging.info("No pending workflows found.")
            return
        
        for run in workflow_runs:
            run_id = run["id"]
            approval_url = f"https://api.github.com/repos/{REPO}/actions/runs/{run_id}/approve"
            approval_response = requests.post(approval_url, headers=headers)
            if approval_response.status_code == 204:
                logging.info(f"Approved run {run_id} (Environment: {run.get('environment')})")
            else:
                logging.error(f"Failed to approve run {run_id}: {approval_response.status_code} {approval_response.text}")
    except Exception as e:
        logging.error(f"Error during workflow approval: {e}")
        raise

if __name__ == "__main__":
    try:
        logging.info("Starting GitHub workflow approval script.")
        jwt_token = generate_jwt()
        installation_token = get_installation_token(jwt_token)
        approve_pending_workflows(installation_token)
        logging.info("Script execution completed successfully.")
    except Exception as e:
        logging.error("Script execution failed.")

[ebndev]

Hi @sndepp5, thanks for being a part of the GitHub Community!

GitHub does not currently allow automatic approval of scheduled workflows that use environment secrets. It looks like some users have found a workaround to automate environment deployment approval. If that's not what you're looking for, perhaps you can find more answers in this discussion.