Explicit workflow approval is being required for innocent PRs

Open

#31 opened on May 16, 2025 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: github-actions
Domain: ci-cd

Research direction

Review ci.yml and the approval behavior reported for PR #30, then compare the repository setting with GitHub's linked documentation on fork workflow approvals. Done means innocent pull requests can run tests without approval while pull requests touching CI configuration still require the intended protection.

Written by the indexing model from the issue text.

Description

AFAIK, this GitHub warning is intended for protecting repositories from attackers executing arbitrary code on CI. Normal PRs should be able to run tests without approval. If my understanding is correct, this behavior is likely occurring due to CI misconfiguration.

(Noticed on #30.)

Expected behavior:

Such approval should be only required on PRs that explicitly touch GHA configuration (ci.yml).

Current behavior:

Seemingly innocent PR such as #30 leads to warning message demanding explicit approval from maintainers to run the workflows.

Solution

As per the documentation suggests, someone with access to the "Approval for running fork pull request workflows from contributors" setting need to take a look into this. (I don't have the privilege right now)

Dominant language: C++
Stars: 21
Forks: 48
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Bug] NULL pointer dereference in llm_running_callback (NGZA-AX-LLM #3) Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

AXERA-TECH/ax-llm#77 · Opened Sep 22, 2026
resume() sends a second HTTP response (400) after a successful resume Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

games-on-whales/wolf#509 · Opened Sep 21, 2026
pn7160: reader goes permanently deaf — post-read IRQ-low check fails reads that succeeded Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

esphome/esphome#19452 · Opened Sep 21, 2026
Eval bug: Ministral-3 tool-calls during reasoning are not processed Open

bug-unconfirmed

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

ggml-org/llama.cpp#29248 · Opened Sep 21, 2026
run_tests.py fails on windows, but running tests individually works Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

NVIDIA/cuda-samples#453 · Opened Sep 21, 2026

More C++ issues