From ade88e255fe214fb2740752e8362e39abe966f49 Mon Sep 17 00:00:00 2001 From: Hugh Hackman Date: Sun, 22 Mar 2026 05:23:52 +0000 Subject: [PATCH] ci: add dual-approval status check (CTO + QA) Adds the shared dual-approval caller workflow, mirroring all other plugin repos. Enforces the CTO + QA dual approval policy as a GitHub required status check. Resolves the gap identified in PRI backlog (dd33f62f). --- .github/workflows/dual-approval.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/dual-approval.yaml diff --git a/.github/workflows/dual-approval.yaml b/.github/workflows/dual-approval.yaml new file mode 100644 index 0000000..a2de07c --- /dev/null +++ b/.github/workflows/dual-approval.yaml @@ -0,0 +1,18 @@ +name: Dual Approval (CTO + QA) + +# Calls the shared dual-approval-check workflow. +# Passes when both privilegedescalation-cto and privilegedescalation-qa +# have approved the PR. Add "Dual Approval (CTO + QA)" to required_status_checks +# in branch protection to enforce this gate. + +on: + pull_request_review: + types: [submitted, dismissed] + pull_request: + branches: [main] + types: [opened, reopened, synchronize] + +jobs: + dual-approval: + uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main + secrets: inherit