How to Implement Prow-Style Commands Like /lgtm and /approve

By Kaveh Alemi·Latchkey

Prow popularized /lgtm and /approve as label-driven merge signals; you can approximate them in GitHub Actions with labels and required checks.

Map /lgtm to an lgtm label and /approve to an approved label, each backed by a required status. Enforce that only reviewers may /lgtm and only owners may /approve.

Steps

• Match /lgtm and /approve on issue_comment.
• Check the commenter role for the specific command.
• Add the matching label and set its required status.

Command step

- uses: actions/github-script@v7
  with:
    script: |
      const body = context.payload.comment.body.trim()
      const map = { '/lgtm': 'lgtm', '/approve': 'approved' }
      const label = map[body]
      if (!label) return
      await github.rest.issues.addLabels({
        owner: context.repo.owner, repo: context.repo.repo,
        issue_number: context.issue.number, labels: [label]
      })

Gotchas

• Distinguish /lgtm (review) from /approve (ownership); require different roles for each.
• Real Prow tracks OWNERS files; a lightweight version can use an allowlist of approvers.
• Back each label with a required status so merges wait for both signals.

Verify it actually works

A workflow that runs is not a workflow that works. Confirm the behaviour on a real event rather than on a manual dispatch, because trigger conditions, permissions, and context values all differ between the two.

# 1. validate the file before pushing
docker run --rm -v "$(pwd):/repo" --workdir /repo rhysd/actionlint:latest -color

# 2. trigger the real event, not workflow_dispatch
git commit --allow-empty -m "ci: verify trigger" && git push

# 3. watch it and read the conclusion, not just the colour
gh run watch
gh run view --log-failed

What usually goes wrong first

• The workflow file must exist on the default branch before scheduled or dispatch triggers appear at all.
• GITHUB_TOKEN permissions default to read-only in many organisations. Declare a permissions: block listing every scope the job needs.
• Fork pull requests get a read-only token and no access to secrets, regardless of workflow configuration.
• actions/checkout gives you depth 1 on a detached HEAD, so anything needing history or a branch name needs fetch-depth: 0.

Frequently asked questions

Related guides

References

• GitHub Actions documentation