Skip to main content
| With Automatic Approvals, CodeRabbit’s review decision follows its feedback. When a review leaves actionable comments, CodeRabbit requests changes. When that feedback is resolved and CodeRabbit has reviewed the latest commit, CodeRabbit approves the pull request. Repositories that require approving reviews before merging can count CodeRabbit as one of the reviewers. Automatic Approvals adds only review decisions. It does not merge the pull request, and your Git provider’s other merge requirements still apply. To decide how CodeRabbit’s approval combines with human reviews, see Choose an approval policy.
GitHub pull request merge box showing a changes requested review from coderabbitai[bot] and merging blocked

A GitHub pull request blocked by CodeRabbit's request-changes review

​
How it works

1

CodeRabbit reviews a commit

If the review posts actionable inline comments, CodeRabbit submits a request-changes review.
2

You address the feedback

Push changes to the pull request and let CodeRabbit review the new commit.
3

CodeRabbit resolves addressed threads

During the next review, CodeRabbit checks its open threads and resolves those that the changes addressed.
4

CodeRabbit checks the approval requirements

CodeRabbit approves only when every approval requirement is met.
5

CodeRabbit approves the reviewed commit

Immediately before approving, CodeRabbit checks that the pull request HEAD has not changed.

​
Approval requirements

CodeRabbit approves a pull request only when all of these are true:
  • The latest commit has a completed CodeRabbit review.
  • All required review threads are resolved.
  • No Pre-Merge Check is failing.
  • The pull request is within any configured risk limits.
  • No matching team or path override disables approval.
If every changed file is excluded by path filters, CodeRabbit skips the review content but still checks the other requirements and can approve the pull request. With a risk limit set, it withholds approval instead, because the commit has no risk assessment. On GitLab, discussion handling depends on what triggers the approval check. When resolving a discussion triggers the check, CodeRabbit waits until GitLab reports that all blocking discussions are resolved. When a clean CodeRabbit review triggers the check, CodeRabbit checks only discussions that it created.

​
Turn on Automatic Approvals

Automatic Approvals is off by default. Turn it on for a repository or an organization:
Add reviews.auto_approvals.enabled to .coderabbit.yaml in your repository or central configuration repository:
.coderabbit.yaml
CodeRabbit’s approval counts toward your Git provider’s required approvals. Before you turn the feature on, decide how many approvals a pull request needs and whether higher-risk changes should need human approval. Choose an approval policy walks through the common setups.

​
Why CodeRabbit hasn’t approved

While a review, thread, or Pre-Merge Check requirement is unmet, the approval stays pending and CodeRabbit posts no notice about it: During a rate-limited run, CodeRabbit may still resolve threads that the new changes addressed, but the approval stays pending because the latest commit has no completed review.

​
Approve or resolve on demand

Post @coderabbitai approve or @coderabbitai resolve as a top-level pull request comment to skip the wait. Both commands resolve CodeRabbit’s review threads. With Automatic Approvals turned on, both can also approve the pull request without a completed review of the latest commit and without passing Pre-Merge Checks. They work only as top-level comments, not as replies in a review thread. The commands do not bypass risk limits or disabled overrides. The risk assessment comes from a completed review, so when a limit is set, the latest commit needs a completed review before either command can approve. CodeRabbit also checks, immediately before approving, that the pull request HEAD has not changed. If every approved commit must have a completed review, run @coderabbitai review first.

​
Stop authors from approving their own pull requests

By default, pull request authors can use both commands on their own pull requests. Set reviews.allow_author_approval to false to prevent this:
.coderabbit.yaml
Anyone other than the author can still use the commands, provided CodeRabbit can identify both the commenter and the author. The pull request’s branch configuration cannot turn author approval back on. This setting does not affect the approvals CodeRabbit submits after its own reviews.

​
Turn off Automatic Approvals

Set reviews.auto_approvals.enabled to false, or turn off Automatic approvals in the web interface. CodeRabbit then stops requesting changes and approving on new reviews. Turning the feature off does not remove reviews that CodeRabbit already submitted. On open pull requests, dismiss CodeRabbit’s approvals that should no longer count toward your merge rules, and any request-changes reviews that still block merging.

​
Configuration

Approval risk limits explains the risk limits and overrides for teams and paths.
​
boolean
default:false
Request changes for blocking findings. Automatically approve when required threads are resolved, the latest commit is reviewed, pre-merge checks pass, and configured risk limits are satisfied. In GitLab, required discussions must be resolved.
​
enum
Highest inclusive merge risk that permits approval. Omitted limits can be inherited; merge risk is unrestricted only when no configuration source sets a limit. A configured limit requires an assessment covering the current commit. One of: minimal, low, moderate, high, critical
​
enum
Highest inclusive security architecture risk that permits approval. Security risk assessments require the Advanced plan or above. Omitted limits can be inherited; security risk is unrestricted only when no configuration source sets a limit. This is separate from Security finding severity. A configured limit requires an assessment covering the current commit. One of: minimal, low, moderate, high, critical
​
boolean
Set to false to withhold approval for matching pull requests, regardless of risk. Omit to use the global setting. Any matching disabled override wins. Review comments and requests for changes continue normally; overrides cannot turn on a globally disabled workflow.
​
array of string
Apply this override when the pull request author belongs to any listed GitHub team. Use organization/team-slug.
​
array of string
Apply this override when any changed file matches these repository-relative globs. Uses the same glob syntax as path_filters, including ! exclusions. Renames match both old and new paths. When teams and paths are set, both must match. Omit to match all paths.
​
enum
Override the global merge-risk limit for matching pull requests. Omit to inherit the global limit. One of: minimal, low, moderate, high, critical
​
enum
Override the global security-risk limit for matching pull requests. Omit to inherit the global limit. Security risk assessments require the Advanced plan or above. One of: minimal, low, moderate, high, critical
Full reference: Automatic approvals

​
Legacy configuration key

CodeRabbit also reads reviews.request_changes_workflow and treats it as reviews.auto_approvals.enabled. Use only one of the two keys. If a configuration sets both to different values, CodeRabbit turns off Automatic Approvals for that configuration and reports a configuration error.

​
What’s next

Approval risk limits

Keep higher-risk pull requests for human approval while CodeRabbit approves routine ones.

Choose an approval policy

Combine CodeRabbit approvals with human reviews, GitHub branch rules, and Triage merges.

Pre-Merge Checks

Configure the quality gates that CodeRabbit verifies before it approves.