Approve stale lead maintainer PRs

[MikeMcQuaid]

Add a scheduled workflow to approve stale lead maintainer PRs when all
approval requirements are met.

Require the PR to be:

• not from a fork
• not a draft
• authored by a Homebrew lead maintainer who has approved another Homebrew/brew PR in the last 7 days
• reviewed by Copilot
• unreviewed by humans for 48 hours
• fully green across CI
• unchanged in sensitive paths
• evaluated during a weekday approval window

This will:

• Reduce review latency for trusted lead maintainer PRs that already satisfy explicit safety checks.
• Keep approval behaviour auditable by documenting every requirement in the generated review body, workflow summary and temporary branch report.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 high with local review and much tweaking.

---

[Copilot]

Pull request overview

Adds a scheduled GitHub Actions workflow plus supporting Ruby script and documentation updates to automatically approve certain stale PRs authored by Homebrew lead maintainers in Homebrew/brew, when a defined set of safety requirements are met (non-fork PR, recent maintainer approval activity, Copilot review, no human review for 24h, and fully green CI).

Changes:

• Add a scheduled/dispatchable workflow to evaluate and (when eligible) approve stale lead maintainer PRs, plus a “report” mode for auditing.
• Add a Ruby automation script that gathers PR facts (reviews, CI status, changed files) and posts an approval/reports with a documented rationale.
• Document the new exception/behavior in relevant security and maintainer docs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
docs/Supply-Chain-Security.md	Documents the new narrow automatic-approval exception in the supply-chain model.
docs/Maintainer-Guidelines.md	Notes the existence/constraints of the stale lead maintainer auto-approval workflow.
docs/Homebrew-brew-Maintainer-Guide.md	Describes when and how stale lead maintainer PRs may be auto-approved.
.github/workflows/approve-stale-lead-maintainer-prs.yml	Introduces scheduled + manual workflow to approve/report on eligible PRs.
.github/scripts/approve_stale_lead_maintainer_prs.rb	Implements eligibility checks and posts approval/report bodies via GitHub API.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.

[woodruffw]

This makes sense to me, although my 0.02c would be for:

• A 48h weekday window instead (24h seems like it might be a little too short, particularly if a PR would have one specific maintainer as its reviewer).
• Additional restrictions on auto-approvals if the PR's diff touches CI/CD or other sensitive files. I think those kinds of changes ideally always involve explicit two person operation 🙂

[bevanjkay]

A 48h weekday window

I'm also in favour of setting this to 48h for the initial implementation.

[bevanjkay]

The cooldown time didn't work correctly here - #22848 (review)
It only looks for no reviews in 48 hours from what I can tell, not that it has sat for 48 hours.

[MikeMcQuaid]

@bevanjkay yup thanks on it

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.