ci: add copilot sessionEnd hook to auto-approve pending CI workflow runs

[Copilot]

• Create .github/hooks/hooks.json defining the sessionEnd hook
• Create .github/hooks/session_end.sh script that approves pending CI workflow runs when a Copilot session ends
• Add commit with semantically compliant title
• Replace fixed sleep 10 + single query with a bounded polling loop (every 10s for up to 120s) to handle queue delays and API lag
• Exit the polling loop early once runs have been approved and a follow-up poll returns an empty list (avoids unnecessary ~120s delay)
• Skip auto-approval if the branch contains any changes to the .github/ directory (fail-closed: skips if diff fails)
• Only approve runs triggered by the Copilot bot account (copilot[bot])
• Include detected DEFAULT_BRANCH in protected branches list
• Restrict auto-approval to branches starting with copilot/ only
• Ensure all failure paths exit 0 — hook is explicitly best-effort and will never mark the session-end step as failed
• Capture gh run list stdout and stderr separately (temp file) so warnings don't appear as run IDs; validate each run ID is numeric before attempting approval

Original prompt

---

This section details on the original issue you should resolve

<issue_title>workaround about needing manual approval for CI workflows when copilot works on pull requests</issue_title>
<issue_description>github CI worklows require manual approval to run on copilot committing to a branch of a specific pull request
It's annoying because the real benefit of copilot is to run on a task and get the CI tests result without any human action, so that they can looks at potential problems and work on fixing them before a human is needed.

See problem description here: https://github.com/orgs/community/discussions/162826

A workaround is proposed at the end of the discussion (by vincentaudoire on the Feb 21st 2026).
Implement this workaround in the repository, adding a github hook, run on the sessionEnd event, and trigerring the CI workflows to run
Documentation about the hooks: https://docs.github.com/en/copilot/how-tos/use-copilot-agents/coding-agent/use-hooks
The CI workflows to run are those which normally run for any activity onto a current pull request</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes workaround about needing manual approval for CI workflows when copilot works on pull requests #1010

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ levalleux-ludo
❌ Copilot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[levalleux-ludo]

@copilot the title of the commit and of the PR are not compliant with the rules (see ./.github/copilot-instructions.md).
Rename the PR and add a new commit (blank one) with a compliant title to fix the problem

[Copilot]

@copilot the title of the commit and of the PR are not compliant with the rules (see ./.github/copilot-instructions.md).
Rename the PR and add a new commit (blank one) with a compli...

Added commit c58da7c with compliant title: ci: add copilot sessionEnd hook to auto-approve pending CI workflow runs.

The PR title also needs to be renamed to match the same format (ci: add copilot sessionEnd hook to auto-approve pending CI workflow runs). I'm unable to update the PR title programmatically — could you rename it directly via the GitHub UI, or let me know if there's another approach?

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/bosonprotocol/core-components/actions/runs
  • Triggering command: /usr/bin/gh gh run list --branch copilot/implement-ci-workflow-workaround --status action_required --json databaseId --jq .[].databaseId (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Adds a GitHub Copilot “session end” hook configuration intended to automatically approve GitHub Actions workflow runs that are pending manual approval after Copilot pushes commits.

Changes:

• Introduces a session_end.sh hook script that queries workflow runs for the current branch and attempts to approve pending runs.
• Adds .github/hooks/hooks.json to register the sessionEnd hook and run the script with a 60s timeout.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/hooks/session_end.sh	New hook script that finds and approves action-required workflow runs for the current git branch.
.github/hooks/hooks.json	Registers the sessionEnd hook to execute the new bash script.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.95%. Comparing base (d4b6208) to head (ba72320).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1011   +/-   ##
=======================================
  Coverage   90.95%   90.95%           
=======================================
  Files         179      179           
  Lines        7288     7288           
  Branches     1366     1366           
=======================================
  Hits         6629     6629           
  Misses        659      659           

Flag	Coverage Δ
common	92.59% <ø> (ø)
core-sdk	56.48% <ø> (ø)
e2e	85.78% <ø> (ø)
eth-connect-sdk	95.06% <ø> (ø)
ethers-sdk	74.45% <ø> (ø)
ipfs-storage	91.75% <ø> (ø)
metadata	94.70% <ø> (ø)
unittests	60.77% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

[Copilot]

@copilot the title of the commit and of the PR are not compliant with the rules (see ./.github/copilot-instructions.md).
Rename the PR and add a new commit (blank one) with a compli...

The .github/copilot-instructions.md file does not exist in the repository, so I can't verify the exact rules. The current PR title ci: add Copilot sessionEnd hook to auto-approve pending CI workflow runs follows conventional commit format (type: description). If you can share the applicable rules or create the file, I'll ensure compliance.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

@copilot the title of the commit and of the PR are not compliant with the rules (see ./.github/copilot-instructions.md).
Rename the PR and add a new commit (blank one) with a compli...

The PR title "ci: add copilot sessionEnd hook to auto-approve pending CI workflow runs" and all recent commit titles follow the Conventional Commits format defined in .github/copilot-instructions.md — type ci, no scope, lowercase subject. All commits since c58da7c are compliant.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.