> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Auto Approve PR

> Automatically approve pull requests using resolved comments or policy-aware AI evaluation

## Overview

When **Auto Approve PR** is enabled, CodeAnt AI can submit an `APPROVE` review after every CodeAnt review thread is resolved. You can keep this resolved-comments behavior or add a policy-aware approval agent that evaluates the pull request's risk, your dashboard criteria, and a repository policy file.

This closes the loop on the standard CodeAnt workflow:

1. CodeAnt reviews the PR and opens inline review threads on the issues it finds.
2. The author addresses each thread (commits a fix, replies with context, or marks it resolved).
3. Once all CodeAnt-opened threads are resolved, CodeAnt either approves immediately or runs the configured approval-agent checks.
4. If the agent cannot establish that the pull request is safe and policy-compliant, it requires human review instead of approving.

> [!NOTE]
>
> **Currently GitHub-only.** Auto Approve PR is supported on GitHub and GitHub Enterprise. GitLab, Bitbucket, and Azure DevOps support is on the roadmap.

## Approval modes

| Mode | Behaviour |
| - | - |
| **Off** | Never auto-approve. Human approval remains required. |
| **Resolved comments** | Approve when every CodeAnt-authored review thread is resolved. |
| **Policy agent** | After all CodeAnt-authored threads are resolved, evaluate the reviewed commit against the configured risk threshold, dashboard criteria, and `.codeant/approval.json`. |

The policy agent is currently available for GitHub and GitHub Enterprise repositories.

## How It Works

There are two paths that trigger the auto-approve check:

### 1. After every review

Right after CodeAnt finishes reviewing a PR, it schedules a delayed check 60 seconds later. If all CodeAnt review threads are already resolved at that point, CodeAnt approves.

The delay exists so that any in-flight pushes settle before the approve action fires. The reviewed head SHA is **pinned at scheduling time** - if you push a new commit during that 60-second window, CodeAnt will skip the approve rather than approve an unreviewed commit.

### 2. When a thread is resolved

GitHub fires a webhook every time someone resolves a review thread. CodeAnt listens for these events and re-checks: if the resolution made every CodeAnt thread resolved, it approves immediately.

### What gets approved

CodeAnt only counts threads it authored. Threads opened by humans on the PR don't block auto-approve — only the CodeAnt-authored ones matter.

If CodeAnt has already approved the current head commit, the approve is a no-op (it doesn't post duplicate reviews). If you push a new commit after an auto-approval, CodeAnt's approval is dismissed by GitHub the same way any reviewer's approval would be - and the cycle restarts.

## Configuring Auto Approve PR

[Open review settings](https://app.codeant.ai/x/settings/prconfsettings), or navigate to **Settings → AI Code Review** in the dashboard.

Find the **Auto Approve PR** row and choose an approval mode. When you select **Policy agent**, configure:

| Setting | Behaviour |
| - | - |
| **Execution** | Use **Shadow mode** to post or update one advisory PR comment without approving, or **Enforce decisions** to allow qualified approvals. Start with shadow mode when introducing a new policy. |
| **Maximum approval risk** | The highest model-classified risk that may be approved: `low`, `medium`, or `high`. Repository policy can only make this threshold stricter. |
| **Custom approval criteria** | Organization or repository guidance supplied to the approval agent. Maximum **8,000 characters**. The UI displays the live character count. |
| **Inherited from Org** *(repo-level only)* | Use the organization-level setting. Selecting this clears the repository override. |

The default is **Disable**. Opt-in per organization or per repository as needed.

### Org vs Repo

* **Organization scope** - sets the default for every repository in the org.
* **Repository scope** — overrides the org default for that one repo. Pick **Inherited from Org** to remove the override.

## Repository approval policy

Add `.codeant/approval.json` to the repository's base branch to version approval rules with the codebase. The approval agent always reads the policy from the base-branch commit, never from the pull request's proposed version.

```json .codeant/approval.json theme={"theme":"css-variables"}
{
  "version": 1,
  "max_auto_approve_risk": "low",
  "custom_criteria": "Documentation-only changes may be approved.",
  "rules": [
    {
      "id": "security-sensitive",
      "description": "Authentication, authorization, and secret-handling changes require a human.",
      "files": ["auth/**", "security/**", "**/*secret*"],
      "exclude_files": ["auth/generated/**"],
      "decision": "human_review"
    }
  ]
}
```

### Policy schema and limits

Unknown fields or values make the policy invalid and force human review.

| Field | Allowed value and limit |
| - | - |
| `version` | Must be `1`. |
| `max_auto_approve_risk` | Optional: `low`, `medium`, or `high`. |
| `custom_criteria` | Optional string, maximum **8,000 characters**. |
| `rules` | Optional array, maximum **100 rules**. |
| `rules[].id` | Required string, **1–100 characters**. |
| `rules[].description` | Required string, **1–4,000 characters**. |
| `rules[].files` | Required array of **1–100 glob patterns** matched against changed file paths. |
| `rules[].exclude_files` | Optional array of up to **100 glob patterns** removed from that rule's scope. Defaults to an empty array. |
| `rules[].decision` | `human_review` or `allow`; defaults to `human_review`. |

There are no word-count limits. Limits are measured in characters or array entries as shown above.

A rule applies when at least one changed file matches `files` without matching `exclude_files`. In a mixed pull request, an included, non-excluded file still activates the rule. If multiple rules apply, any `human_review` rule takes precedence; otherwise the approval agent evaluates every applicable `allow` condition.

> [!WARNING]
>
> A pull request that adds, edits, deletes, renames, or moves `.codeant/approval.json` is never auto-approved. It must receive human review, so a pull request cannot relax the rules used to approve itself.

## Policy-agent decision rules

The agent approves only when all of the following are true:

* Every CodeAnt-authored review thread is resolved.
* The reviewed head commit has not changed.
* The repository policy is valid and no matching rule requires human review.
* The model returns `approve`, reports no blockers, assigns a risk within the effective threshold, and has at least **80% confidence**.
* Complete review context is available.

CodeAnt fails closed when it cannot evaluate the entire change. Pull requests with more than **300 changed files**, more than **60,000 patch characters**, or a missing GitHub patch for any changed file require human review. Policy-loading or model failures defer approval instead of approving by default.

In shadow mode, CodeAnt posts the decision, reason, risk, confidence, evaluation summary, and reviewed commit in a PR comment. Later evaluations update the same comment instead of adding another one. The comment is advisory, and CodeAnt never approves the PR while shadow mode is enabled.

> [!NOTE]
>
> Policy-agent model calls currently use CodeAnt's managed AI provider and do not consume the organization's AI-credit balance.

## Required GitHub Permissions

The CodeAnt GitHub App needs the following permissions, which are part of the standard CodeAnt install:

* **Pull requests: Read & Write** - to submit the `APPROVE` review.
* **Webhook event: `pull_request_review_thread`** - to react when a thread is resolved.

If you installed CodeAnt before these permissions were required, GitHub will prompt you to accept the new permission set the next time you visit the install page.

## Interaction with Branch Protection

Auto-approval counts as a normal PR review for the purpose of branch protection rules. If you require **N** approving reviews to merge, CodeAnt's auto-approval contributes one of those approvals.

If your protection rules require approval from **CODEOWNERS** or specific users/teams, CodeAnt's approval **will not satisfy those rules** unless the CodeAnt installation user is explicitly listed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.