Require approvals from at least 1 member of different groups / teams

Question

There is a developer team and a QA team. I want to explore 2 different ways to approve pull requests.

1. Before a PR can be merged into the "develop" branch, a member in the developer team must approve the PR and a member in the QA team must approve the PR

2. Before a PR can be merged into a feature branch, a member in the developer team must approve the PR. Before a PR can merged into the "develop" branch a member in the QA team must approve the PR

My team is thinking about going with the second option. Is there a way to set this up in GitHub? Either through rulesets or actions?

Answer 1

I think it should be possible both ways. Imho best would be to implement using custom PR check.

With second approach you may be tempted to use CODEOWNERS and require PR to be reviewed by them (using rulesets). This would work if only one team was code owner in project but otherwise anyone from both teams could approve in any order. So this is no go.

Use custom check

Create a workflow that will be executed on PR review event and would check how many reviews there is and from which teams were people that approved it.

on:
  pull_request_review:

Then in workflow logic you could use gh cli tool or GitHub API to

1. fetch reviews added to PR (gh cli)

$ gh pr view 846 --json reviews
{
  "reviews": [
    {
      "id": "PRR_xxxxx",
      "author": {
        "login": "XXXXXXX"
      },
      "authorAssociation": "CONTRIBUTOR",
      "body": "",
      "submittedAt": "2024-04-30T12:12:10Z",
      "includesCreatedEdit": false,
      "reactionGroups": [],
      "state": "APPROVED",
      "commit": {
        "oid": "caa04e841e20de0373a6bd7f612bd6e9e6ca23a0"
      }
    }
  ]
}

2. check approved reviews number
3. check if at least one approval is from qa team and at least one is from dev team

Checking if user is in team may be a bit tricky because you need Personal Access Token (PAT) with org:read scope (or GH App) to be able to read this information. Still this is doable as in this action

Last thing to do would be to configure ruleset that require PR with at least 2 approvals and with required check above.