Approve
Check the commit the push request pinned and approve it. The platform pushes within a few seconds
Approving needs sessions:approve. Both personal and agent keys can hold it, but the key that started a session cannot approve that session's push requests; another key or a person does. A worker running a session cannot call /v1 with its credentials (401), so an agent cannot approve on its own. Use the sessionId and push from Request (SID, PUSH_ID, and PUSH_COMMIT in the HTTP API). To use a separate approver key in the SDK, make a second client with werft.withOptions({ apiKey }).
Approve
git_commit in the approval body must equal the commit the request pinned. It shows that the person approving has checked what they are approving.
const approved = await werft.sessions.pushRequests.approve(sessionId, push.id, {
git_commit: push.git_commit,
});
console.log(approved.state);approvedSee the push result
The platform picks up one approved request every 3 seconds and pushes it. Wait until the request goes through pushing and becomes pushed or failed.
import { waitForPushRequest } from "@werft-ai/sdk";
const done = await waitForPushRequest(werft, sessionId, push.id);
console.log(done.state);
if (done.push_receipt_id) {
const receipt = await werft.receipts.get(done.push_receipt_id);
const result = receipt.result as { refusal?: string | null } | null;
console.log(receipt.operation, receipt.status, result?.refusal);
}pushed
push succeeded nullwaitForPushRequest waits until the request becomes pushed, failed, or rejected.
The local stack's sample-app is registered with a GitHub App on the stack's own Git server, so the request becomes pushed. The receipt's result records remote_ref (refs/heads/agent/<session-id>) and previous_commit. A repository with no GitHub App credential that can write to it ends with no_push_credential.
The platform makes the approved commit the new tip of that branch (git push <commit>:<branch>). Any of its ancestors the branch does not have yet, that is commits the session made earlier and has not pushed, go up with it. When you approve, review every change from the remote branch (or the default branch when there is none) to that commit, not only the pinned commit. It does not force push. It does not send to the default branch.
refusal | Meaning |
|---|---|
no_push_credential | The repository has no push credential |
catalog_changed | An operator changed the repository settings after the request. Make a new request |
non_fast_forward | The remote branch is not an ancestor of this commit |
default_branch, target_refused | The branch is the default branch or is not agent/<session-id> |
push_failed | Token issuance failed, the remote refused, or a network error |
When the approval is refused
| Response | Meaning |
|---|---|
409 CHECKPOINT_MOVED | git_commit differs from the pinned commit, or the session saved a checkpoint again after the request. Reject this request and make a new one |
409 PUSH_REQUEST_RESOLVED | The request was already approved or rejected |
403 FORBIDDEN | The key lacks sessions:approve, or the caller only sees the session and is not one who approves (its creator, its agent's admins, owners and admins) |
403 FORBIDDEN (details.refusal: self_approval) | The key that started the session tried to approve. A failed resolve_push receipt is left; another key or a person approves |
A refused attempt also leaves a receipt. Read it with error.details.receipt_id in the error body (details.receipt_id of the APIError in the SDK).