ci(release): block release approval by the authors of the released PRs

[feliperalmeida]

Problem

The NPM Release environment has "Prevent self-review" turned on, which stops the run's triggering actor from approving the release. Before the merge queue, that actor was the person who merged the PR. Now the push to main comes from github-merge-queue[bot], so nobody is excluded and a PR author can approve their own release (example run).

Changes

• Add the shared release-approval-guard action (PostHog/.github#79) as the first real step of version-bump.
  • It finds the PRs in the push that triggered the run (a merge-queue push can contain up to 5).
  • It fails the job if an NPM Release approver authored one of them or added it to the queue (merged_by).
  • It runs before the Slack "approved" message and before the release app token is created. A blocked run publishes nothing.
• Give version-bump actions: read (to read the run's approvals) and pull-requests: read (to read the PRs).

On workflow_dispatch runs the guard does nothing, because GitHub's own check already excludes whoever started the run.

If a release is blocked: start the workflow again with "Run workflow", and have a different maintainer approve it. A re-run of the blocked run may fail again, because GitHub's approvals API doesn't separate run attempts.

Like the setting it replaces, it only covers the PRs in the triggering push. If a release also publishes earlier unreleased changes, their authors aren't excluded.

Release info Sub-libraries affected

Libraries affected

None. This changes CI only.

Checklist

• Tests for new code: the action has unit tests in PostHog/.github. This workflow only runs on pushes to main, so the first release after merge is the first real run.
• Accounted for the impact of any changes across different platforms
• Accounted for backwards compatibility of any changes (no breaking changes!)
• Took care not to unnecessarily increase the bundle size

If releasing new changes

• Ran pnpm changeset to generate a changeset file: not needed, nothing to release.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

• Written with Claude Code, directed by @feliperalmeida.
• We first tried excluding everyone whose changesets were in the release. We switched to copying the old "Prevent self-review" behavior, the author or merger of the PRs in the triggering push, because it fixes exactly what the merge queue broke with less complexity.
• The action was checked against past runs from the real API: fix(browser): preserve debounced session persistence #5167's run, approved by its author, would have been blocked; other runs pass. It hasn't run inside this workflow yet.

[github-actions]

📝 No Changeset Found

This PR doesn't include a changeset. A changeset is required to release a new version.

How to add a changeset

Run this command and follow the prompts:

pnpm changeset

Remember: Never use major version bumps for posthog-js as it's autoloaded by clients.

[greptile-apps]

[Critical impact] The workflow changes appear safe to merge; no blocking issue was established.

_{Reviews (1) · Last reviewed commit: f657253 · Reviewed by Greptile}