[aaronpowell]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Maintainers currently cannot authorize waiting fork workflows from the Open PR Board, and ACTION_REQUIRED checks can look like content-test failures. Add a dedicated Approve and run checks action in the Checks tab without conflating workflow execution with PR review approval or required-check bypass.

• Discover eligible current-head public-fork runs separately from check rollups, including runs with empty PR associations. Show action-required checks as needing attention, while preserving genuine failure and pending states.
• Confirm the exact workflow, run, attempt and commit before using GitHub's supported workflow approval API. Recheck repository write access, current PR head and run eligibility, and share the existing per-PR action lock.
• Record execution approval in separate history, preserve triage/review state and staged feedback, and refresh after success. Surface discovery, API and partial-success errors without automatic retries.
• Document supported states and keep AI review instructions strictly read-only.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Validation:

• node --experimental-vm-modules --test eng\open-pr-board-workflow-approval.test.mjs eng\open-pr-board.test.mjs eng\board-preview.test.mjs eng\board-periodic-refresh.test.mjs eng\board-bulk-actions.test.mjs eng\board-column-order.test.mjs eng\open-pr-board-drag.test.mjs eng\board-state-storage.test.mjs - passed, 179 tests, zero failures or skips. Covers detection, rendered controls, confirmation/cancellation, permissions and stale-state guards, route wiring, locking, persistence, refresh and failures with injected GitHub writes.
• npm start - passed; generated README and marketplace outputs remain unchanged. Existing external-plugin license warnings were emitted. The initial npm run build was blocked by missing js-yaml; npm ci --quiet restored dependencies before the successful build.
• bash eng/fix-line-endings.sh - passed.
• git --no-pager diff --check - passed.
• node --check - passed individually for .github\extensions\open-pr-board\extension.mjs, lib\github.mjs, lib\decisions.mjs, lib\state.mjs, lib\review-prompt.mjs, and public\app.js under that extension.

No remote workflow was approved or run during development. Real GitHub requests were read-only metadata checks; all write paths use test doubles. Live end-to-end execution in the Copilot canvas has not been exercised, so that checklist item remains unchecked. Paid-service submission guidance is not applicable; this updates an existing extension rather than adding a resource.

GitHub's fork workflow approval endpoint has no atomic SHA/attempt precondition. Final live checks reduce but cannot eliminate that race; GitHub enforces final eligibility and token permissions. Deployment/environment approvals, private forks, same-repository runs, queued/running checks and arbitrary action-required gates are not authorized by this action.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• .github/extensions/open-pr-board/README.md is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/extensions/open-pr-board/extension.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/extensions/open-pr-board/lib/decisions.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/extensions/open-pr-board/lib/github.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/extensions/open-pr-board/lib/review-prompt.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/extensions/open-pr-board/lib/state.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/extensions/open-pr-board/public/app.js is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/extensions/open-pr-board/public/styles.css is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• eng/board-periodic-refresh.test.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• eng/board-preview.test.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• eng/open-pr-board-prompt-security.test.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• eng/open-pr-board-workflow-approval.test.mjs is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for aa9df43 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Copilot]

🟡 Changes recommended

Workflow-run selection can hide approval actions for waiting workflows, while workflow-execution approvals displace genuine review decisions in the history used to calibrate review strictness.

2 open issues

• Exclude runs for different pull requests before selecting latest · New
• Exclude workflow execution events from review calibration history · New

What changed in this PR

Adds maintainer-confirmed execution approval for waiting public-fork workflows in the Open PR Board, distinct from PR review approval and required-check bypass.

Changes:

• Discover eligible workflow runs and distinguish action-required checks from failures.
• Add confirmation, permission and stale-state guards, shared locking, history recording, and refresh handling.
• Document supported states, reinforce read-only AI review instructions, and add focused tests.

File	Description
eng/​open-pr-board-workflow-approval.test.mjs	Tests discovery, approval guards, history, locking, and errors.
eng/​board-preview.test.mjs	Tests confirmation, rendered controls, and preview preservation.
eng/​board-periodic-refresh.test.mjs	Tests approval-route integration and refreshed board state.
.github/​extensions/​open-pr-board/​README.md	Documents approval behavior, limitations, and validation commands.
.github/​extensions/​open-pr-board/​public/​styles.css	Gives action-required checks a caution indicator.
.github/​extensions/​open-pr-board/​public/​app.js	Adds approval controls, confirmation, and attention indicators.
.github/​extensions/​open-pr-board/​lib/​state.mjs	Synchronizes approval metadata and records execution events.
.github/​extensions/​open-pr-board/​lib/​review-prompt.mjs	Describes attention states and prohibits AI workflow authorization.
.github/​extensions/​open-pr-board/​lib/​github.mjs	Implements run discovery, eligibility checks, and approval requests.
.github/​extensions/​open-pr-board/​lib/​decisions.mjs	Coordinates approval locking, history, refresh, and warnings.
.github/​extensions/​open-pr-board/​extension.mjs	Exposes approval metadata and wires the approval route.

_{Review effort: Max (auto)}

[aaronpowell]

In response to the submission status: accepted as a merge requirement, not a request for a code change; this batch does not bypass the submission gate or provide the required maintainer review. The fixes are pushed in aa9df43, and the final focused suite passed all 184 tests, along with npm start, markdown normalization, syntax checks and diff checks.

[aaronpowell]

In response to the contributor reputation check: accepted as a maintainer review advisory, with no code change needed. This batch does not alter contributor-risk policy, dismiss the signal or substitute for the requested human review.

[Copilot]

🔵 Needs a closer look

Overlapping refreshes can leave approved runs offered for approval, confirmation disrupts modal focus and progress feedback, and the guard test can pass even if the run/attempt check is removed.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Wait for in-flight refresh before fetching post-approval data

.github/​extensions/​open-pr-board/​extension.mjs:239

If a manual or scheduled refresh is already running, this callback can reuse data fetched before the workflow approval and report success while still offering the approved run. Wait for any existing refresh to finish, then request a fresh snapshot after the write; add a regression for this overlap.

Preserve modal focus and show progress on the existing buttons

.github/​extensions/​open-pr-board/​public/​app.js:761

After confirmation, renderDrawerBody() removes the focused approval button, so keyboard focus falls outside the still-open modal; run() also changes the label on that detached node instead of showing progress. Move focus to the stable Checks tab and disable the existing body buttons in place before calling run(), then rebuild the body on completion.

Assert the guard blocks writes without relying on a thrown error

eng/​open-pr-board-workflow-approval.test.mjs:195

The fake writer throws inside assert.rejects, so reaching it counts as a successful rejection rather than a failed guard test. Removing the run/attempt check can therefore leave this test green. Use a nonthrowing write counter, require an expected notice, and assert that no write occurred.

2 resolved since last review

• Exclude workflow execution events from review calibration history
• Exclude runs for different pull requests before selecting latest

_{Review effort: Max (auto)}