GHA bot review is not affecting merge requirements

[APErebus]

Select Topic Area

Question

Body

We are attempting to automate certain PR reviews & merging in https://github.com/OctopusDeploy/Calamari

We have a workflow that given a specific branch & creating user, the workflow auto-approves the PR.

We have branch protection rules that require at least one approving review.

However, the resulting review by the github-actions[bot] is not being counted towards the merge requirements. Example PR

We have the repository setting enabled that should give GHA bot permissions to approve PR's

What setting am I missing that makes this work?

[calilkhalil]

This is actually expected behavior, GitHub doesn't count github-actions[bot] approvals toward branch protection. It's a security thing to prevent workflows from approving and merging their own changes.

Your settings are fine, but that checkbox only lets the bot submit reviews, not satisfy branch protection rules.

Workarounds

Use a GitHub App or PAT instead of GITHUB_TOKEN. Reviews from a dedicated GitHub App or a machine user PAT will count toward merge requirements.

Bypass for specific actors, In branch protection settings you can allow certain actors to bypass required reviews, but this skips the requirement entirely rather than satisfying it.

Docs

• Managing a branch protection rule
• Automatic token authentication

[irfanrao-hub]

Hi! 👋

The reason the github-actions[bot] review isn’t counting toward your branch protection requirements is because GitHub does not currently count workflow-generated approvals as valid “approving reviews” for merge requirements. GitHub’s branch protection checks require a human review approval (from a real user account). Automated approvals from bots (including GitHub Actions bots) aren’t counted even if they appear as reviews in the UI.

This behavior is intentional — it avoids workflows automatically bypassing review policies that were put in place to ensure actual human review.

What this means

✔️ You can auto-approve via GitHub Actions
❌ But that approval won’t satisfy protected branch review requirements
— GitHub only counts real user “Approve” reviews toward merge requirements.

Workarounds / Options

Use a human reviewer
The simplest approach is to have a real human click “Approve” on the PR.

Use a GitHub App or bot that supports review API with user token
If your organization allows it, you can have a bot that uses a GitHub App installation token to create an approval review that does count as a real approval.

Adjust branch protection rules (if acceptable)
If automation is critical, you could consider relaxing the requirement specifically for certain branches or workflows. But be careful — this reduces the strict review enforcement.

Why this happens

GitHub’s protected branch rules are designed to prevent changes without oversight. Allowing automated approvals to satisfy those rules would defeat that purpose. This behavior has been confirmed in internal product announcements and discussions about “verified” and trusted answers and reviews in GitHub features.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬