GitHub Actions deployment environment wait timers auto-approve after expiry even when self-approval is blocked
When using GitHub Actions OIDC trusted publishing for PyPI with a deployment environment (e.g., environment: pypi), the environment may have both a required reviewer and a wait timer configured. The current_user_can_approve field in the pending deployments API returns false when the push actor is also the required reviewer — GitHub prevents self-approval of deployments triggered by the same user.
However, if the environment has a wait timer (e.g., 5 minutes), the deployment auto-approves after the timer expires without needing manual intervention. This means:
gh api repos/{owner}/{repo}/actions/runs/{id}/pending_deployments --method POST will fail with "No pending deployment requests to approve or reject" even though the job shows status: waitingWorkaround: Just wait for the timer to expire. Check wait_timer_started_at in the pending deployments response to calculate when auto-approval happens. Polling gh run view until the publish job completes is sufficient.