Concept
Evidence and approvals are tied to a commit
Updated
On this page
Zof decides about one exact commit: the pull request's latest. Evidence and approvals count only for the commit they were given for, and an approval never counts from someone who wrote the change.
What is a decision about?
Each decision is about the pull request's head commit. In Verification, an allowed pull request with a green check reads "Release authorized for" and the first 7 characters of that commit.
When someone pushes a new commit, Zof starts again for the new one, and the old commit's result no longer applies. GitHub shows the pull request's checks for its latest commit. The old commit keeps the check it last had, and Zof refuses a Re-evaluate or "Re-run" of that old check. Retargeting the pull request to another base branch starts again too, because the diff and the target can change.
Why does a new push reset the evidence?
Evidence proves something about one version of the code. Test results for an older commit say nothing about the new one. So evidence counts only when it is for the commit Zof is deciding about:
| The evidence | Result |
|---|---|
| Is for another commit | It doesn't count: stale_evidence. |
| Is older than the maximum age a rule sets | It doesn't count: stale_evidence. |
| Was checked against another policy version | It doesn't count: evidence_criteria_mismatch. |
| Hasn't arrived for the new commit yet | The result is Needs evidence until Verification reports. |
Why does a new push reset approvals?
An approver approves the code they reviewed. Zof binds each approval to the commit, to the diff, and to the evidence Zof had when the approver reviewed it. An approval counts only when all three still match.
- An approval of an older commit is ignored. The check asks for the approval again.
- An approval given before Verification reported on the commit is recorded, but it never counts.
- If the evidence changes after the approval, the approval stops counting until the approver approves again.
An approver's "Request changes" review is tied to the commit too. It blocks the change until that reviewer approves the commit, the review is dismissed, or a new commit is pushed.
Why does the author never count?
What checks a change must be independent of what produced it. So Zof never counts an approval from:
- the person who opened the pull request;
- anyone who pushed commits to it;
- for an agent's change, the person the agent acts for;
- a bot or app account.
This holds even when that person is listed in Release approvers. Someone else from the owning team has to approve.
What this means for you
- To approve again after a new commit, see Approve a change.
- To see why an approval doesn't count, see Find out why a pull request is blocked.
- To make sure there is more than one approver for each owner, see Choose who can approve.