Avoid "workflows awaiting approval" when copilot agent create PRs

[ajthinking]

Select Topic Area

Question

Copilot Feature Area

Copilot Agent Mode

Body

When creating an issue and assigning github copilot, it is not allowed to run the actions (tests etc).
So for each iteration I need to press "approve" which slows down the flow quite a bit.

My settings: settings/actions/Approval for running fork pull request workflows from contributors is set to:
"Require approval for first-time contributors
Only users who have never had a commit or pull request merged into this repository will require approval to run workflows."

So, I made a first PR with copilot. Merged it.
Made a second. Still, it needs my approval.

Question: where is the setting to allow copilot to run actions without me babysitting it?

[neeraj2019041078]

Hello Aj ,

To allow Copilot PRs to run actions without manual approval, you can:

Go to Settings → Actions → General

Under “Fork pull request workflows”, set to:

🔓 “Require approval for all outside collaborators” → Off

Or enable “Run workflows from fork pull requests without approval” (not always recommended for security)

Alternatively, convert Copilot-generated PRs into PRs from a trusted internal branch (instead of a fork), where workflows run normally.

[Harshhdhankhar]

1. Check Repository Settings

First, verify your current workflow permissions:

1. Go to your repository's Settings → Actions → General
2. Under "Workflow permissions", ensure:
   • "Read and write permissions" is selected
   • "Allow GitHub Actions to create and approve pull requests" is checked

2. Modify Fork PR Workflow Settings

For your specific issue with fork PRs:

1. In Settings → Actions → General
2. Under "Fork pull request workflows":
   • Try selecting "Require approval for first-time contributors who are new to GitHub" (more restrictive)
   • Or "Don't require approval for any contributors" (least restrictive)

3. Create a Personal Access Token (PAT) for Copilot

1. Generate a PAT with repo and workflow scopes:
   • Go to GitHub Settings → Developer settings → Personal access tokens
   • Create new token with these permissions
2. Configure this token in your workflow file:

   env:
     GITHUB_TOKEN: ${{ secrets.PAT_FOR_COPILOT }}

4. Alternative Solution: Use GitHub Actions Approvals API

You can automate approvals programmatically:

- name: Auto-approve workflow runs
  if: github.actor == 'github-copilot[bot]'
  run: |
    curl -X POST \
    -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
    -H "Accept: application/vnd.github.v3+json" \
    https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/approve

5. Check Organization-Level Settings (If Applicable)

If this is an organization repository:

1. Go to Organization Settings → Actions → General
2. Verify there are no organization-wide restrictions overriding your repository settings

Important Notes

1. GitHub Copilot is technically considered an "outside collaborator" for security reasons, which may trigger additional approvals
2. GitHub's security model intentionally makes it difficult to fully automate actions from external entities
3. Consider creating a dedicated service account with appropriate permissions instead of using Copilot directly for workflows

Would you like me to provide more specific guidance about any of these solutions?

[ajthinking]

Would love a non LLM answer, the above replies makes no sense

[KnightNiwrem]

https://github.com/orgs/community/discussions/162826#discussioncomment-13535323

[MuhammadTanveerAbbas]

GitHub treats Copilot PRs as coming from an untrusted fork every time, so it always needs manual approval. There's no setting to bypass that. Even after merging one, it won’t remember it. Only fix is to stop using Copilot's forked PRs and push changes from a trusted branch instead.

[Unik69420]

GitHub Copilot’s workflow runs are treated as first-time contributors, so approval is needed each time. There’s no current setting to auto-approve its actions—only way is to relax fork workflow approval or keep approving manually.