Skip to content

feat: add low-risk PR self-approval workflows#245

Merged
rogeriochaves merged 3 commits intomainfrom
feat/low-risk-pr-workflows
Mar 4, 2026
Merged

feat: add low-risk PR self-approval workflows#245
rogeriochaves merged 3 commits intomainfrom
feat/low-risk-pr-workflows

Conversation

@rogeriochaves
Copy link
Contributor

@rogeriochaves rogeriochaves commented Mar 3, 2026

Summary

  • Add approval-or-hotfix.yml — enforces PRs need either 1 approval or a hotfix/low-risk-change label
  • Add low-risk-evaluation.yml — AI-powered (GPT-5-mini) evaluation of PR diffs against the low-risk policy, auto-labels qualifying PRs
  • Add low-risk-label-reset.yml — removes the low-risk-change label when new commits are pushed, requiring re-evaluation
  • Add docs/LOW_RISK_PULL_REQUESTS.md — documents the low-risk change policy criteria

Ported from langwatch/langwatch with minor adjustments (restricted paths adapted for this repo, added "test configuration" as an explicit low-risk category).

How it works

  1. Author creates a PR and runs the "Low-Risk PR Evaluation" workflow manually with the PR number
  2. The workflow fetches the diff, checks size limits and restricted paths, then asks GPT to evaluate against the policy
  3. If it qualifies, the low-risk-change label is applied and a comment explains the assessment
  4. The approval-or-hotfix check passes, allowing merge without manual approval
  5. If new commits are pushed, the label is automatically removed and re-evaluation is needed

Test plan

  • Workflows are syntactically valid YAML
  • Policy doc covers the same criteria as langwatch/langwatch
  • Requires OPENAI_API_KEY secret to be configured in the repo for the evaluation workflow
  • The low-risk-change label needs to be created in the repo's label settings

Add three GitHub Actions workflows and a policy document to enable
self-approval of low-risk PRs (e.g. test config, docs, formatting):

- approval-or-hotfix.yml: enforces that PRs need either 1 approval
  or a "hotfix"/"low-risk-change" label
- low-risk-evaluation.yml: AI-powered evaluation of PR diffs against
  the low-risk policy, auto-labels qualifying PRs
- low-risk-label-reset.yml: removes the label when new commits are
  pushed, requiring re-evaluation
- docs/LOW_RISK_PULL_REQUESTS.md: documents the policy criteria

Ported from langwatch/langwatch with minor adjustments for this repo.
Add opened, reopened, and synchronize to the pull_request trigger
types so the check re-runs after rebases and new commits instead of
going stale and blocking merge.
- Trigger evaluation automatically on PR open/reopen/synchronize
  instead of requiring manual workflow_dispatch
- Fold label reset into the evaluation workflow (remove stale label
  first, then re-evaluate fresh) — deletes separate label-reset workflow
- Use LOW_RISK_OPENAI_API_KEY secret for cost tracking
- Keep workflow_dispatch as fallback for manual runs
- Use gpt-4.1-mini instead of gpt-5-mini
@github-actions
Copy link
Contributor

github-actions bot commented Mar 4, 2026

Automated low-risk assessment

This PR was evaluated against the repository's Low-Risk Pull Requests procedure and does not qualify as low risk.

This PR modifies files in restricted directories that require manual review per policy.

This PR requires a manual review before merging.

@rogeriochaves rogeriochaves merged commit 0a8ddcd into main Mar 4, 2026
5 of 6 checks passed
@rogeriochaves rogeriochaves deleted the feat/low-risk-pr-workflows branch March 4, 2026 10:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants