agent approved its own upgrade PR through auto-merge - the policy bot flagged the self-approval after the fact
Removes an agent's ability to self-approve its own upgrade PRs. Use it when a policy bot flags a self-approval after an auto-merge, or when setting up branch protection for bot-driven PRs. Key trigger: the approving identity and the PR author are the same bot user. Not for: a human approving their own PR, which is a people-policy problem, not a bot-config problem.
TL;DR
The agent approved its own PR, which satisfies the letter of required-reviews but not the intent. Fix branch protection so reviews must come from a different identity: require pull request reviews, enable code-owner review, and make sure the agent's bot user cannot count as a reviewer.
Error
agent approved its own upgrade PR through auto-merge - the policy bot flagged the self-approval after the factSteps
Check the merged PR: compare the author identity with the approving review identity. Expected output: Both are the same bot user, confirming the self-approval.
Open the branch protection rules for the target branch and enable Require a pull request before merging plus Require review from Code Owners. Expected output: The rules now demand at least one review from a designated owner team.
Verify the agent's bot account is not a member of any code-owner team and cannot dismiss its own reviews. Expected output: The bot user fails the code-owner check on its own PRs.
Enable Require approval from someone other than the author if your platform offers it; otherwise enforce it with a policy bot check. Expected output: A self-approved PR fails the merge gate.
Re-run the policy bot on recent bot-merged PRs to find other self-approvals. Expected output: You have a list of past self-approvals to review or revert.
When to use
- A bot approves its own dependency-upgrade PR through auto-merge
- You are writing the merge policy for an agent that opens PRs
- A compliance check flags self-approvals in the audit log
When not to use
- A human self-approving their own PR; fix that with team policy, not bot config
- Auto-merge of trivially safe bumps you have explicitly blessed in policy
- Review-staleness issues where a legitimate review was dismissed by a push
Variant phrasings
bot approved its own pull request and merged it
policy bot flagged self-approval on a dependency PR
require someone other than the PR author to approve
Why it happens
Required-reviews rules usually count any approving review, and many setups let the PR author approve their own PR unless the author-different-from-approver rule is turned on. An agent that both opens and reviews the PR satisfies the count, so auto-merge proceeds and only the audit trail reveals it.
Edge cases
- Some platforms exempt administrators from branch protection; an admin agent can bypass every rule you write, so do not run the agent as admin.
- Code-owner teams that include the bot reintroduce the loophole; audit team membership, not just the rules.
- Retroactively reverting self-approved bumps can break dependents; review before reverting.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_PxfSm8vw02l7QWc5GZ5vFA