Label and ChatOps triggers
Approve and dismiss reviews through configured labels or permission-checked commands on the pull request.
Self-hosted GitHub App · Apache-2.0
Approve routine pull requests at the speed of a stamp.
Stampbot uses configured labels and authorized ChatOps commands to approve pull requests and withdraw its own approvals. Your branch protection rules still apply.
- Repository-scoped policy
- Container and Helm releases
- Prometheus and OpenTelemetry
Policy approved
Pull request event
verified
- 01 Label addedautoapprove
- 02 Policy checkedlabels, author, title
- 03 Review submittedAPPROVE
Controlled automation
Automation that stays inside GitHub's review model.
Stampbot creates and dismisses its own reviews. It does not merge pull requests, bypass branch protection, grant repository access, or act as a native code owner.
How it works
Set up Stampbot in three steps.
Each repository owns its approval rules. Organization defaults can live in the
organization's .github repository, while repository policy takes
precedence.
-
1
Install the App
Give the GitHub App access only to the repositories where it should evaluate approval events.
-
2
Commit policy
Put
stampbot.tomlon the default branch and describe the labels, users, teams, titles, and commands that are eligible. -
3
Trigger a review
Add an approval label or mention the installed App with an authorized approve or unapprove command.
Readable policy
Review rules belong beside the code they govern.
Stampbot reads TOML from the target repository's default branch. Empty filters do not restrict approval. When filters are configured, every one must pass for a label to trigger approval.
Explore every configuration option
stampbot.toml
# Label-driven approvals
approval_labels = ["autoapprove"]
required_labels = ["tests-passed"]
# ChatOps authorization
chatops_enabled = true
approve_commands = ["approve", "stamp"]
chatops_required_permission = "maintain"
# Eligible pull request authors
allowed_teams = ["platform-automation"]Built for operations
Configure, deploy, and monitor Stampbot.
Stampbot reads policy from each repository and can access only the repositories selected for its GitHub App installation. Versioned releases and built-in telemetry help you run it in production.
Author, team, title, and label filters
Limit label-based approvals to the pull requests that satisfy every configured repository condition.
GitHub installation tokens
API access follows the GitHub App installation's repository scope and declared permissions.
Metrics, traces, and structured logs
Observe request health, webhook decisions, GitHub API calls, and approval outcomes with standard tooling.
Container and Helm releases
Run the same application image directly or deploy it through the maintained Kubernetes chart.
Guided GitHub App registration
Use the setup page to generate a GitHub App manifest, then store the App credentials in your secret manager.
Deployment
Choose how to run Stampbot.
Start locally, run the published container, or install the Helm chart. All three options keep App credentials outside the image and use the same health endpoints.
01
Local development
Use Poetry and the repository Makefile for a reloadable local service.
make install-dev && make dev
02
Container runtime
Pull the published image and provide settings through mounted secrets or files.
docker.io/stampbot/stampbot
03
Kubernetes
Install the OCI Helm chart and configure ingress, scaling, and secret delivery.
oci://ghcr.io/dannysauer/charts/stampbot
Ready to try Stampbot?
Start with one test repository.
Give Stampbot access to one test repository and configure one approval label. Confirm that it can approve the pull request and withdraw its own approval before you give it access to more repositories.