GitHub Actions "Waiting for approval to run workflows for this PR"

By Kaveh Alemi·Latchkey

A PR can sit indefinitely with no checks running while it waits for a maintainer to approve the workflow run. Until approved, no jobs are dispatched, so required checks never report.

What this error means

PR checks show no progress and the run is in a "waiting for approval" state.

Waiting for approval to run workflows for this pull request.
A repository maintainer must approve before these workflows will run.

Diagnose it: what token do you actually have?

Permission failures in Actions are almost never about your repository settings alone. Three things combine: the default GITHUB_TOKEN permission set for the repo or organization, the permissions: block in the workflow, and whether the event is a fork pull request, which downgrades the token to read-only regardless of everything else.

- name: Show the token scopes actually granted
  run: |
    curl -sI -H "Authorization: Bearer $GITHUB_TOKEN" \
      https://api.github.com/ | grep -i "^x-oauth-scopes\|^x-accepted"
    echo "event: ${{ github.event_name }}"
    echo "fork PR: ${{ github.event.pull_request.head.repo.fork }}"
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Common causes

Pending maintainer approval

The repo requires approval before workflows run on this PR and no one has approved yet.

How to fix it

Approve the queued run

1. A user with write access opens the PR and clicks Approve and run.
2. If required status checks are blocking merge, they will only appear after approval.

Grant the narrowest permission that works

Declaring a permissions: block switches the job from the repository default to exactly what you list, so an incomplete block is a common cause of a new failure right after someone tightened security. List every scope the job needs, not just the one that failed.

permissions:
  contents: read        # checkout
  packages: write       # push to GHCR
  id-token: write       # OIDC to a cloud provider
  pull-requests: write  # comment on or label a PR
  checks: write         # publish check runs

How to prevent it

• Notify maintainers when external PRs are awaiting approval.
• Set the approval policy to match your contributor trust level.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions