From 40e383866a824b66ef5ef658b0313b485054b285 Mon Sep 17 00:00:00 2001
From: qwerty287 <80460567+qwerty287@users.noreply.github.com>
Date: Mon, 11 Aug 2025 12:59:02 +0200
Subject: [PATCH] Allow to set default approval mode (#5406)

---
 cmd/server/flags.go                                 |  6 ++++++
 cmd/server/setup.go                                 | 13 ++++++++++++-
 .../30-administration/10-configuration/10-server.md |  9 +++++++++
 server/api/repo.go                                  |  2 +-
 server/config.go                                    |  1 +
 5 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/cmd/server/flags.go b/cmd/server/flags.go
index abd24024c..750405be6 100644
--- a/cmd/server/flags.go
+++ b/cmd/server/flags.go
@@ -153,6 +153,12 @@ var flags = append([]cli.Flag{
 		Usage:   "The default value for allowing pull requests on a repo.",
 		Value:   true,
 	},
+	&cli.StringFlag{
+		Sources: cli.EnvVars("WOODPECKER_DEFAULT_APPROVAL_MODE"),
+		Name:    "default-approval-mode",
+		Usage:   "The default value for allowing pull requests on a repo.",
+		Value:   "forks",
+	},
 	&cli.StringSliceFlag{
 		Sources: cli.EnvVars("WOODPECKER_DEFAULT_CANCEL_PREVIOUS_PIPELINE_EVENTS"),
 		Name:    "default-cancel-previous-pipeline-events",
diff --git a/cmd/server/setup.go b/cmd/server/setup.go
index fc7e9563e..b5b978a77 100644
--- a/cmd/server/setup.go
+++ b/cmd/server/setup.go
@@ -180,6 +180,13 @@ func setupEvilGlobals(ctx context.Context, c *cli.Command, s store.Store) (err e
 	// Pull requests
 	server.Config.Pipeline.DefaultAllowPullRequests = c.Bool("default-allow-pull-requests")
 
+	// Approval mode
+	approvalMode := model.ApprovalMode(c.String("default-approval-mode"))
+	if !approvalMode.Valid() {
+		return fmt.Errorf("approval mode %s is not valid", approvalMode)
+	}
+	server.Config.Pipeline.DefaultApprovalMode = approvalMode
+
 	// Cloning
 	server.Config.Pipeline.DefaultClonePlugin = c.String("default-clone-plugin")
 	server.Config.Pipeline.TrustedClonePlugins = c.StringSlice("plugins-trusted-clone")
@@ -189,7 +196,11 @@ func setupEvilGlobals(ctx context.Context, c *cli.Command, s store.Store) (err e
 	_events := c.StringSlice("default-cancel-previous-pipeline-events")
 	events := make([]model.WebhookEvent, 0, len(_events))
 	for _, v := range _events {
-		events = append(events, model.WebhookEvent(v))
+		e := model.WebhookEvent(v)
+		if err := e.Validate(); err != nil {
+			return err
+		}
+		events = append(events, e)
 	}
 	server.Config.Pipeline.DefaultCancelPreviousPipelineEvents = events
 	server.Config.Pipeline.DefaultTimeout = c.Int64("default-pipeline-timeout")
diff --git a/docs/docs/30-administration/10-configuration/10-server.md b/docs/docs/30-administration/10-configuration/10-server.md
index f47ac222c..6f975934a 100644
--- a/docs/docs/30-administration/10-configuration/10-server.md
+++ b/docs/docs/30-administration/10-configuration/10-server.md
@@ -808,6 +808,15 @@ The default setting for allowing pull requests on a repo.
 
 ---
 
+### DEFAULT_APPROVAL_MODE
+
+- Name: `WOODPECKER_DEFAULT_APPROVAL_MODE`
+- Default: `forks`
+
+The default setting for the approval mode on a repo. Possible values: `none`, `forks`, `pull_requests` or `all_events`.
+
+---
+
 ### DEFAULT_CANCEL_PREVIOUS_PIPELINE_EVENTS
 
 - Name: `WOODPECKER_DEFAULT_CANCEL_PREVIOUS_PIPELINE_EVENTS`
diff --git a/server/api/repo.go b/server/api/repo.go
index e9cb9e505..00fe44bd9 100644
--- a/server/api/repo.go
+++ b/server/api/repo.go
@@ -91,7 +91,7 @@ func PostRepo(c *gin.Context) {
 		repo.Update(from)
 	} else {
 		repo = from
-		repo.RequireApproval = model.RequireApprovalForks
+		repo.RequireApproval = server.Config.Pipeline.DefaultApprovalMode
 		repo.AllowPull = server.Config.Pipeline.DefaultAllowPullRequests
 		repo.AllowDeploy = false
 		repo.CancelPreviousPipelineEvents = server.Config.Pipeline.DefaultCancelPreviousPipelineEvents
diff --git a/server/config.go b/server/config.go
index daa38c786..5548c85d0 100644
--- a/server/config.go
+++ b/server/config.go
@@ -68,6 +68,7 @@ var Config = struct {
 		AuthenticatePublicRepos             bool
 		DefaultAllowPullRequests            bool
 		DefaultCancelPreviousPipelineEvents []model.WebhookEvent
+		DefaultApprovalMode                 model.ApprovalMode
 		DefaultWorkflowLabels               map[string]string
 		DefaultClonePlugin                  string
 		TrustedClonePlugins                 []string