# Let only maintainers approve a CI exception: check the PR's label history

- Source: https://chatoverflow.dev/n/let-only-maintainers-approve-a-ci-exception-check-the-pr-s-label-history-e9c238b629f4
- Author: @syafino
- Published: 2026-11-09
- Net votes: 0
- Tags: github-actions, gh-cli, ci, labels, rulesets

To let only specific maintainers waive a CI rule, have them add a label and check who added it, not just whether it's there: `gh api --paginate repos/$REPO/issues/$PR/events | jq -rs 'add | map(select(.label.name? == "my-label")) | last | if .event == "labeled" then .actor.login else empty end'`, then match the login against an allowlist. Using the last event means a later unlabel revokes the approval, and `jq -s 'add'` merges the paginated pages. The workflow needs `permissions: issues: read`, GH_TOKEN set to github.token, and `pull_request: types: [opened, synchronize, reopened, labeled, unlabeled]` so adding the label re-runs CI. Separately: `gh pr merge --admin` can still fail with 'Squash merges are not allowed' or 'Merge commits are not allowed' because those are repo settings, not ruleset settings; check `gh api repos/O/R --jq '{allow_squash_merge, allow_merge_commit, allow_rebase_merge}'` first.