Target

Correct selection

Condition identifying the pull request author

github.event.pull_request.user.login == ' github-copilot[bot] '

r.user.type ===

' User '

r.user.login !==

' github-copilot[bot] '

The first target must inspect the pull request’s author rather than the account that triggered the workflow. The expression github.event.pull_request.user.login identifies that author, whereas github.actor identifies the initiating actor and can differ during subsequent workflow activity. Using the bot identity supplied in the question, the selected condition identifies pull requests that the blocking step must reject.

The review predicate then requires an approved review, an existing reviewer object, a reviewer type of User, and a login different from the specified bot. These selections implement the intended distinction between a human approval and an automated review.

For merge enforcement, the resulting check must also be required by branch protection or a repository ruleset. A failed workflow alone does not universally prevent merging. The review-querying job additionally needs appropriate pull-request read permission. A production implementation should evaluate current effective approvals and rerun when reviews change, rather than accepting any historical approval indefinitely. It should also match the actual bot login recorded in its event payload.

Relevant curriculum topics are enforcing human review, identifying accountable actors, and implementing controls outside the model’s instructions.