renovate-auto-approve: removing the automerge label doesn't revoke the approval #62

Problem

renovate-auto-approve doesn't take back its approval when someone removes the automerge label.

The job only runs while the PR has automerge or security. After automerge is removed, neither label is there, so the unlabeled run is skipped and the earlier approval stays. Once CI is green, the PR can still be merged without a human review.

The workflow's header says "the revoke path reacts to labels changing", and callers have to trigger on unlabeled for that reason, so this is a bug, not a missing feature. Today only adding security revokes.

Steps to reproduce

1. Renovate opens a PR with automerge; the workflow approves it.
2. Remove the automerge label.
3. The unlabeled run skips the job; the approval is still there.

Expected

Removing automerge revokes the earlier automated approval, the same way the other failed checks do.

Suggested fix

Drop the label condition from the job's if (keep the Renovate-author check) and reject inside the script when the label is missing:

if ! gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name' | grep -qxF "$LABEL"; then
  reject "the $LABEL label is missing"
fi

reject already revokes an earlier approval, or does nothing if there is none.

Related: opendefensecloud/artifact-conduit#528