From b9a351f53d4bffbea053abd6e37c3b42445aac45 Mon Sep 17 00:00:00 2001 From: "privilegedescalation-engineer[bot]" <269729446+privilegedescalation-engineer[bot]@users.noreply.github.com> Date: Sat, 21 Mar 2026 23:55:52 +0000 Subject: [PATCH] ci: add dual-approval caller workflow Calls the shared privilegedescalation/.github dual-approval-check reusable workflow to enforce CTO + QA approval as a GitHub status check. Once privilegedescalation/.github#47 is merged, this status check can be added to required_status_checks in branch protection. Co-Authored-By: Paperclip --- .github/workflows/dual-approval.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/dual-approval.yaml diff --git a/.github/workflows/dual-approval.yaml b/.github/workflows/dual-approval.yaml new file mode 100644 index 0000000..a2de07c --- /dev/null +++ b/.github/workflows/dual-approval.yaml @@ -0,0 +1,18 @@ +name: Dual Approval (CTO + QA) + +# Calls the shared dual-approval-check workflow. +# Passes when both privilegedescalation-cto and privilegedescalation-qa +# have approved the PR. Add "Dual Approval (CTO + QA)" to required_status_checks +# in branch protection to enforce this gate. + +on: + pull_request_review: + types: [submitted, dismissed] + pull_request: + branches: [main] + types: [opened, reopened, synchronize] + +jobs: + dual-approval: + uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main + secrets: inherit