Back to Checks
github

Organization prevents GitHub Actions from approving pull requests

organization_actions_pull_request_approval_disabled
Service: organizationSeverity: medium
OfficialBuilt-inVerified
Categories:ci-cdsoftware-supply-chain
Resource Type:NotDefined

GitHub Actions organization settings define whether workflows are allowed to create and approve pull requests.

The evaluation determines whether that permission is disabled, so that approving a pull request always requires a human reviewer.

Prowler logoProwlerprowler-provider-github

Risk

When workflows can approve pull requests, automation can satisfy the review requirement it was meant to be checked by, leading to:

  • Required reviews being cleared without any human inspecting the change
  • Self-approving pull requests opened by a workflow
  • Merge gates that appear enforced while providing no real oversight

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks organization_actions_pull_request_approval_disabled

Recommendation

Disable Allow GitHub Actions to create and approve pull requests so that pull request approvals always come from a human reviewer.

Where automation genuinely needs to open pull requests, let it create them without granting approval rights, and keep the approval step with a reviewer who is not the author.

Remediation

CLI

gh api --method PUT /orgs/<organization>/actions/permissions/workflow -F can_approve_pull_request_reviews=false

Other

1Sign in to GitHub as an organization owner
2Go to your organization > Settings
3In the left sidebar, click Actions > General
4Under Workflow permissions, clear Allow GitHub Actions to create and approve pull requests
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.organization.organization_client import (
    organization_client,
)


class organization_actions_pull_request_approval_disabled(Check):
    """Check if GitHub Actions workflows are prevented from approving pull requests.

    This class verifies whether each organization disallows workflows from creating and
    approving pull requests, so that required reviews cannot be satisfied by automation.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Organization Actions Pull Request Approval Disabled check.

        Iterates over all organizations and checks whether GitHub Actions workflows are
        allowed to approve pull requests.

        Returns:
            List[CheckReportGithub]: A list of reports for each organization
        """
        findings = []
        for org in organization_client.organizations.values():
            if org.can_approve_pull_request_reviews is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=org)
                report.status = "PASS"
                report.status_extended = f"Organization {org.name} does not allow GitHub Actions to approve pull requests."

                if org.can_approve_pull_request_reviews:
                    report.status = "FAIL"
                    report.status_extended = f"Organization {org.name} allows GitHub Actions to approve pull requests."

                findings.append(report)

        return findings

References