Auto Approve PR

Overview

When Auto Approve PR is enabled, CodeAnt AI can submit an APPROVE review after every CodeAnt review thread is resolved. You can keep this resolved-comments behavior or add a policy-aware approval agent that evaluates the pull request’s risk, your dashboard criteria, and a repository policy file. This closes the loop on the standard CodeAnt workflow:

CodeAnt reviews the PR and opens inline review threads on the issues it finds.
The author addresses each thread (commits a fix, replies with context, or marks it resolved).
Once all CodeAnt-opened threads are resolved, CodeAnt either approves immediately or runs the configured approval-agent checks.
If the agent cannot establish that the pull request is safe and policy-compliant, it requires human review instead of approving.

Currently GitHub-only. Auto Approve PR is supported on GitHub and GitHub Enterprise. GitLab, Bitbucket, and Azure DevOps support is on the roadmap.

Approval modes

Mode	Behaviour
Off	Never auto-approve. Human approval remains required.
Resolved comments	Approve when every CodeAnt-authored review thread is resolved.
Policy agent	After all CodeAnt-authored threads are resolved, evaluate the reviewed commit against the configured risk threshold, dashboard criteria, and `.codeant/approval.json`.

The policy agent is currently available for GitHub and GitHub Enterprise repositories.

How It Works

There are two paths that trigger the auto-approve check:

1. After every review

Right after CodeAnt finishes reviewing a PR, it schedules a delayed check 60 seconds later. If all CodeAnt review threads are already resolved at that point, CodeAnt approves. The delay exists so that any in-flight pushes settle before the approve action fires. The reviewed head SHA is pinned at scheduling time - if you push a new commit during that 60-second window, CodeAnt will skip the approve rather than approve an unreviewed commit.

2. When a thread is resolved

GitHub fires a webhook every time someone resolves a review thread. CodeAnt listens for these events and re-checks: if the resolution made every CodeAnt thread resolved, it approves immediately.

What gets approved

CodeAnt only counts threads it authored. Threads opened by humans on the PR don’t block auto-approve — only the CodeAnt-authored ones matter. If CodeAnt has already approved the current head commit, the approve is a no-op (it doesn’t post duplicate reviews). If you push a new commit after an auto-approval, CodeAnt’s approval is dismissed by GitHub the same way any reviewer’s approval would be - and the cycle restarts.

Configuring Auto Approve PR

Navigate to Settings → AI Code Review at app.codeant.ai/x/settings/prconfsettings. Find the Auto Approve PR row and choose an approval mode. When you select Policy agent, configure:

Setting	Behaviour
Execution	Use Shadow mode to post or update one advisory PR comment without approving, or Enforce decisions to allow qualified approvals. Start with shadow mode when introducing a new policy.
Maximum approval risk	The highest model-classified risk that may be approved: `low`, `medium`, `high`, or `critical`. Repository policy can only make this threshold stricter.
Custom approval criteria	Organization or repository guidance supplied to the approval agent. Maximum 8,000 characters. The UI displays the live character count.
Inherited from Org (repo-level only)	Use the organization-level setting. Selecting this clears the repository override.

The default is Disable. Opt-in per organization or per repository as needed.

Org vs Repo

Organization scope - sets the default for every repository in the org.
Repository scope — overrides the org default for that one repo. Pick Inherited from Org to remove the override.

Repository approval policy

Add .codeant/approval.json to the repository’s base branch to version approval rules with the codebase. The approval agent always reads the policy from the base-branch commit, never from the pull request’s proposed version.

{
  "version": 1,
  "max_auto_approve_risk": "low",
  "custom_criteria": "Documentation-only changes may be approved.",
  "rules": [
    {
      "id": "security-sensitive",
      "description": "Authentication, authorization, and secret-handling changes require a human.",
      "files": ["auth/**", "security/**", "**/*secret*"],
      "exclude_files": ["auth/generated/**"],
      "decision": "human_review"
    }
  ]
}

Policy schema and limits

Unknown fields or values make the policy invalid and force human review.

Field	Allowed value and limit
`version`	Must be `1`.
`max_auto_approve_risk`	Optional: `low`, `medium`, `high`, or `critical`.
`custom_criteria`	Optional string, maximum 8,000 characters.
`rules`	Optional array, maximum 100 rules.
`rules[].id`	Required string, 1–100 characters.
`rules[].description`	Required string, 1–4,000 characters.
`rules[].files`	Required array of 1–100 glob patterns matched against changed file paths.
`rules[].exclude_files`	Optional array of up to 100 glob patterns removed from that rule’s scope. Defaults to an empty array.
`rules[].decision`	`human_review` or `allow`; defaults to `human_review`.

There are no word-count limits. Limits are measured in characters or array entries as shown above. A rule applies when at least one changed file matches files without matching exclude_files. In a mixed pull request, an included, non-excluded file still activates the rule. If multiple rules apply, any human_review rule takes precedence; otherwise the approval agent evaluates every applicable allow condition.

A pull request that adds, edits, deletes, renames, or moves .codeant/approval.json is never auto-approved. It must receive human review, so a pull request cannot relax the rules used to approve itself.

Policy-agent decision rules

The agent approves only when all of the following are true:

Every CodeAnt-authored review thread is resolved.
The reviewed head commit has not changed.
The repository policy is valid and no matching rule requires human review.
The model returns approve, reports no blockers, assigns a risk within the effective threshold, and has at least 80% confidence.
Complete review context is available.

CodeAnt fails closed when it cannot evaluate the entire change. Pull requests with more than 300 changed files, more than 60,000 patch characters, or a missing GitHub patch for any changed file require human review. Policy-loading or model failures defer approval instead of approving by default. In shadow mode, CodeAnt posts the decision, reason, risk, confidence, evaluation summary, and reviewed commit in a PR comment. Later evaluations update the same comment instead of adding another one. The comment is advisory, and CodeAnt never approves the PR while shadow mode is enabled.

Policy-agent model calls currently use CodeAnt’s managed AI provider and do not consume the organization’s AI-credit balance.

Required GitHub Permissions

The CodeAnt GitHub App needs the following permissions, which are part of the standard CodeAnt install:

Pull requests: Read & Write - to submit the APPROVE review.
Webhook event: pull_request_review_thread - to react when a thread is resolved.

If you installed CodeAnt before these permissions were required, GitHub will prompt you to accept the new permission set the next time you visit the install page.

Interaction with Branch Protection

Auto-approval counts as a normal PR review for the purpose of branch protection rules. If you require N approving reviews to merge, CodeAnt’s auto-approval contributes one of those approvals. If your protection rules require approval from CODEOWNERS or specific users/teams, CodeAnt’s approval will not satisfy those rules unless the CodeAnt installation user is explicitly listed.

Get Started

AI Code Review

Repositories

Code Security

Cloud Security

Code Quality

Engineering Metrics

IDE

CLI

CI/CD

Integrations

Rule Reference

How CodeAnt Uses CodeAnt

Resources

Overview

Approval modes

How It Works

1. After every review

2. When a thread is resolved

What gets approved

Configuring Auto Approve PR

Org vs Repo

Repository approval policy

Policy schema and limits

Policy-agent decision rules

Required GitHub Permissions

Interaction with Branch Protection

​Overview

​Approval modes

​How It Works

​1. After every review

​2. When a thread is resolved

​What gets approved

​Configuring Auto Approve PR

​Org vs Repo

​Repository approval policy

​Policy schema and limits

​Policy-agent decision rules

​Required GitHub Permissions

​Interaction with Branch Protection

Overview

Approval modes

How It Works

1. After every review

2. When a thread is resolved

What gets approved

Configuring Auto Approve PR

Org vs Repo

Repository approval policy

Policy schema and limits

Policy-agent decision rules

Required GitHub Permissions

Interaction with Branch Protection