[kgala2]

Summary

Ports GoogleCloudPlatform/cloud-sql-go-connector#1221 to this repo. The new .github/workflows/multi-approvers.yaml is byte-identical to the one merged there.

It replaces abcxyz/actions/.github/actions/multi-approvers and secrets.MULTI_APPROVERS_TOKEN with a self-contained actions/github-script check that uses the built-in GITHUB_TOKEN.

Changes

• No PAT: drops secrets.MULTI_APPROVERS_TOKEN. A user is internal when repos.getCollaboratorPermissionLevel reports role_name in admin, maintain, write (or legacy permission in admin, write). The existing USER_ID_ALLOWLIST for automation bots is unchanged.
• Approval rule for external PRs:
  • PRs from allowlisted bots and from internal authors pass this check directly.
  • PRs from external authors need 2 distinct APPROVED reviews from internal users. Each reviewer's latest substantive review counts (COMMENTED and PENDING do not override an earlier approval, self-reviews are excluded, and any non-404 API error fails the check).
• Permissions and hardening:
  • Top-level permissions: {} and job-level pull-requests: 'read'.
  • concurrency.group keyed on the PR number instead of github.head_ref.
  • actions/github-script pinned to 3a2844b7e9c422d3c10d287c895573f7108da1b3 (v9.0.0).

Behavior notes for reviewers

• "Internal" now means write access or higher on this repo, not membership of the googlers team. An org member without write on this repo is treated as external.
• As before, the workflow does not run when a review is submitted. After the second approval on an external PR, re-run the failed multi-approvers job to refresh it.

Verification

• The same file has been live on main in cloud-sql-go-connector since chore(ci): don't prompt for input in tag_latest script #1221 merged. Its runs there show an allowlisted bot author passing, admin and write authors passing, and an external author with 0 approvals failing with the expected message, all with a token limited to Metadata: read and PullRequests: read.
• Ran the script block locally in Node against mocked github, context and core objects: 30 scenarios (review states, ordering, repeat and self reviews, 404 and 5xx lookups, env parsing), all with the expected outcome.
• Not yet observed live: an external PR reaching 2 approvals.
• Because pull_request_target runs the workflow from main, the new script only takes effect in this repo after merge.