Issue Approval Authorization (/approve Command)#

Overview#

The /approve command lets core maintainers approve GitHub issues, transitioning them from Awaiting Approval to Approved Issue so contributors know the issue is ready to work on. The workflow is defined in .github/workflows/issue-approve-command.yml.

The command fires on any new issue comment and is ignored for PRs and closed issues 1.

How Authorization Works#

When a comment containing /approve is posted, the workflow:

1. Checks out only the CODEOWNERS file via sparse checkout 2.
2. Finds the catch-all * line — the single line that starts with * and is not a comment 3.
3. Extracts @handles from that line and strips any usernames containing "bot" 4.
4. Checks if github.actor is in the resulting list 5. If not, a rejection comment is posted and the job exits without making any changes.

If authorized, the workflow removes the Awaiting Approval label, adds Approved Issue, and posts a contribution-guide comment crediting the approver 6.

Who Can Approve (Current State)#

The catch-all * line in CODEOWNERS is:

* @derberg @magicmatatjahu @jonaslagoni @Adi-204 @asyncapi-bot-eve

After the bot-filter step, the effective approver list is: derberg, magicmatatjahu, jonaslagoni, Adi-204 7 4.

Known Limitation: CODEOWNERS Path-Specific Entries Are Ignored#

The authorization check reads only the catch-all line. CODEOWNERS also defines path-specific ownership:

@Adi-204 (Templates Champion) is a core maintainer on the catch-all line and can use /approve. @Florence-Njeri (Docs Champion) is listed as owner of specific paths but cannot use /approve because the workflow only parses the catch-all line.

This is a deliberate design choice — the workflow comment explicitly scopes authorization to "core maintainers (listed on the catch-all * line)" 12 — but it means path-specific owners have no approval capability regardless of their CODEOWNERS role.

Implications for Contributors and Maintainers#

• If your /approve attempt is rejected, check whether your GitHub username is on the * line in CODEOWNERS. Being on any other line is not sufficient.
• To grant approval rights to a new maintainer, add them to the catch-all * line in CODEOWNERS, not just to a path-specific entry.
• Bot accounts are automatically excluded from the approver list by the filter(name => !name.includes('bot')) logic 13, so adding @asyncapi-bot-eve to the catch-all does not confer approval rights.
• The workflow uses secrets.GH_TOKEN 14, so that secret must be configured for the command to perform label mutations.

Key Files#