review agent approved its own pull request: self-approval loop
Fixes review agents approving their own PRs by requiring human approval and blocking self-approval. Use when an agent's approval counted toward its own PR. Not for human self-approval issues.
TL;DR
The agent opened the PR and then approved it, satisfying the approval gate with no human involved. Require at least one human approver in branch protection and configure the agent to never approve PRs it authored.
Error
PR #513 approved by review-agent[bot] - the same identity that opened the PR.Steps
- Confirm the timeline: the PR author and the approver are the same bot identity. Expected: the self-approval is visible.
- Enable 'require approval from someone other than the author' - GitHub enforces this for human authors; extend the policy to bot authors via required reviewers or a CI check. Expected: self-approvals no longer satisfy the gate.
- Configure the agent: its review step must skip PRs it authored and request human review instead. Expected: the agent never approves its own work.
- Dismiss the self-approval and get a human review. Expected: the PR has a genuine independent approval.
When to use
- A bot opened a PR and its own approval counted toward the gate.
- The org lets agents author PRs.
When not to use
- A human approved their own PR - GitHub already blocks counting that; check branch protection.
- The agent only commented, not approved; comments do not satisfy approval gates.
Tool compatibility
- GitHub branch protection + bot-authored PRs.
- Any review-agent setup.
Variant phrasings
Agent approved via a different bot identity
Treat shared bot identities as one author; gate on human approval explicitly.
Agent needs to merge trivial PRs autonomously
Use a narrow auto-merge policy for bot PRs with passing checks, not self-approval.
Why it happens
Approval gates exist to get a second, independent pair of eyes. A self-approval provides zero independence - it is the author signing their own work - so it must not satisfy the gate.
Edge cases
- Some teams exempt bots from human review for mechanical PRs (dependency bumps); make that exemption explicit and narrow.
- Audit past bot PRs for self-approvals when you discover the loophole - the gate may have been bypassed before.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstuw8QFWXPmyZtECq3biLIw