A GitHub Bot to Auto-Approve PRs for SOC2 Compliance
1–4 of 4 posts
Re: A GitHub Bot to Auto-Approve PRs for SOC2 Compliance
#2Hey HN! We recently got our SOC2 certification. One thing that really annoys us is having to get all deployment PRs approved by at least one person per guidelines. This might not sound like a lot but it gets annoying pretty fast when you are 2 people and deploy multiple times a day.
We built a very simple Github bot that snap-approves all pull requests for the default branch. For some extra flair, it sends a very dry joke about the contents of the PR.
In the off-chance that you are also a small team that has a Slack channel filled with PR links just to get them blindly approved, you can download it for yourself.
p.s. This is obviously mostly parody. Even though we have a small use-case for it, we realize how stupid this is.
Re: A GitHub Bot to Auto-Approve PRs for SOC2 Compliance
#3Hey HN! We recently got our SOC2 certification. One thing that really annoys us is having to get all deployment PRs approved by at least one person per guidelines. This might not sound like a lot but it gets annoying pretty fast when you are 2 people and deploy multiple times a day. We built a very simple Github bot that snap-approves all pull requests for the default branch. For some extra flair, it sends a very dry…
Approval is not mandatory for all PRs. You can change your policy about it and easily justify it with your auditor.
=> It makes way more sense to have important stuff reviewed vs automated approval from a bot.
Re: A GitHub Bot to Auto-Approve PRs for SOC2 Compliance
#4Hey HN! We recently got our SOC2 certification. One thing that really annoys us is having to get all deployment PRs approved by at least one person per guidelines. This might not sound like a lot but it gets annoying pretty fast when you are 2 people and deploy multiple times a day. We built a very simple Github bot that snap-approves all pull requests for the default branch. For some extra flair, it sends a very dry…
Approval is not mandatory for all PRs. You can change your policy about it and easily justify it with your auditor. => It makes way more sense to have important stuff reviewed vs automated approval from a bot.
I think most people blindly try to get controls in Vanta/Drata to pass like us. I'd much rather build a dumb bot than having to talk to my auditor. But still
> we realize how stupid this is