Fix maintainer-approval not blocking PRs without approval

The previous change switched maintainer-approval from commit statuses
to check runs for better UI visibility. However, check runs with
status "in_progress" are treated by GitHub as "still running" rather
than "explicitly blocking". This means the required status check was
satisfied without any approval.

Fix by using status "completed" with conclusion "action_required"
for pending approval states. This properly blocks the PR until
approval is granted.

Co-authored-by: Isaac

Author: simonfaltum

.github/workflows/maintainer-approval.js

@@ -537,7 +537,8 @@ module.exports = async ({ github, context, core }) => {
     core.info(msg);
     await github.rest.checks.create({
       ...checkParams,
-      status: "in_progress",
+      status: "completed",
+      conclusion: "action_required",
       output: { title: STATUS_CONTEXT, summary: msg },
     });
   } else if (result.uncovered && result.uncovered.length > 0) {
@@ -550,15 +551,17 @@ module.exports = async ({ github, context, core }) => {
     );
     await github.rest.checks.create({
       ...checkParams,
-      status: "in_progress",
+      status: "completed",
+      conclusion: "action_required",
       output: { title: STATUS_CONTEXT, summary: msg },
     });
   } else {
     const msg = `Waiting for maintainer approval: ${maintainers.join(", ")}`;
     core.info(msg);
     await github.rest.checks.create({
       ...checkParams,
-      status: "in_progress",
+      status: "completed",
+      conclusion: "action_required",
       output: { title: STATUS_CONTEXT, summary: msg },
     });
   }

.github/workflows/maintainer-approval.test.js

@@ -252,7 +252,7 @@ describe("maintainer-approval", () => {
     await runModule({ github, context, core });
 
     assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].status, "in_progress");
+    assert.equal(github._checkRuns[0].conclusion, "action_required");
     assert.ok(github._checkRuns[0].output.summary.includes("/bundle/"));
   });
 
@@ -269,7 +269,7 @@ describe("maintainer-approval", () => {
     await runModule({ github, context, core });
 
     assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].status, "in_progress");
+    assert.equal(github._checkRuns[0].conclusion, "action_required");
     assert.ok(github._checkRuns[0].output.summary.includes("maintainer"));
   });
 
@@ -284,7 +284,7 @@ describe("maintainer-approval", () => {
     await runModule({ github, context, core });
 
     assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].status, "in_progress");
+    assert.equal(github._checkRuns[0].conclusion, "action_required");
   });
 
   it("team member approved -> success for team-owned path", async () => {
@@ -318,7 +318,7 @@ describe("maintainer-approval", () => {
     await runModule({ github, context, core });
 
     assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].status, "in_progress");
+    assert.equal(github._checkRuns[0].conclusion, "action_required");
   });
 
   it("CHANGES_REQUESTED does not count as approval", async () => {
@@ -334,7 +334,7 @@ describe("maintainer-approval", () => {
     await runModule({ github, context, core });
 
     assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].status, "in_progress");
+    assert.equal(github._checkRuns[0].conclusion, "action_required");
   });
 
   it("self-approval by PR author is excluded", async () => {
@@ -350,7 +350,7 @@ describe("maintainer-approval", () => {
     await runModule({ github, context, core });
 
     assert.equal(github._checkRuns.length, 1);
-    assert.equal(github._checkRuns[0].status, "in_progress");
+    assert.equal(github._checkRuns[0].conclusion, "action_required");
   });
 
   it("no * rule in OWNERS -> setFailed", async () => {