GitHub Actions "not allowed because it requires approval" (First-Time Contributor)
A pull request from a first-time or outside contributor is held with "requires approval" before its workflows run. This is a safety policy for fork PRs - a maintainer must approve the run, or the repo policy must be relaxed.
What this error means
A fork PR shows workflows that are not running, with a banner that the run requires approval. Nothing executes until a maintainer clicks Approve and run.
This workflow requires approval from a maintainer.
Workflows aren't being run on this pull request because it was opened by a
first-time contributor.Common causes
Fork-PR approval policy in effect
Repos can require approval before running workflows on PRs from first-time contributors or all outside collaborators, to avoid running untrusted code automatically.
Contributor not yet trusted
Until a contributor has a merged PR (or the policy is loosened), each of their PR runs waits for explicit maintainer approval.
How to fix it
Approve the run as a maintainer
- Open the PR’s Actions section and review the diff for anything malicious.
- Click "Approve and run" to let the workflows execute.
- Subsequent runs from a contributor with a merged PR may no longer need approval.
Adjust the fork-PR run policy
In Settings > Actions > General, choose the approval level for fork PRs (e.g. require approval for first-time contributors only) that matches your risk tolerance.
How to prevent it
- Set a fork-PR approval policy appropriate to the repo’s sensitivity.
- Use pull_request (not pull_request_target) for untrusted code so secrets stay unavailable.
- Educate maintainers to review fork diffs before approving runs.