CSPL-4372: Add approval gate workflow and integrate into existing Git…

.github/workflows/approval-gate.yml

@@ -0,0 +1,27 @@
+name: Approval Gate
+
+on:
+  workflow_call:
+    inputs:
+      environment-name:
+        description: 'Environment name for approval'
+        required: false
+        type: string
+        default: 'external-contributor-approval'
+
+jobs:
+  approval-gate:
+    runs-on: ubuntu-latest
+    environment: ${{
+            (github.event_name == 'pull_request_target' &&
+            !contains(fromJSON('["MEMBER", "OWNER"]'), github.event.pull_request.author_association))
+            && inputs.environment-name
+            || ''
+        }}
+    steps:
+      - name: Approval status
+        run: |
+          echo "Event: ${{ github.event_name }}"
+          echo "Author association: ${{ github.event.pull_request.author_association }}"
+          echo "Approval granted or not required"
+

.github/workflows/build-test-push-workflow.yml

@@ -5,14 +5,17 @@ permissions:
   id-token: write
   pull-requests: write
 on:
-  pull_request: {}
+  pull_request_target: {}
   push:
     branches:
     - main
     - develop
 jobs:
+  approval-gate:
+    uses: ./.github/workflows/approval-gate.yml
   check-formating:
     runs-on: ubuntu-latest
+    needs: approval-gate
     steps:
     - uses: actions/checkout@v2
     - name: Dotenv Action

.github/workflows/distroless-build-test-push-workflow.yml

@@ -5,14 +5,17 @@ permissions:
   id-token: write
   pull-requests: write
 on:
-  pull_request: {}
+  pull_request_target: {}
   push:
     branches:
     - main
     - develop
 jobs:
+  approval-gate:
+    uses: ./.github/workflows/approval-gate.yml
   check-formating:
     runs-on: ubuntu-latest
+    needs: approval-gate
     steps:
       - uses: actions/checkout@v2
       - name: Dotenv Action

.github/workflows/prodsec-workflow.yml

@@ -4,13 +4,16 @@ permissions:
   packages: write
   pull-requests: write
 on:
-  pull_request: {}
+  pull_request_target: {}
   push:
     branches:
     - main
     - develop
 jobs:
+  approval-gate:
+    uses: ./.github/workflows/approval-gate.yml
   semgrep:
+    needs: approval-gate
     name: Semgrep Scanner
     runs-on: ubuntu-24.04
     env:
@@ -32,7 +35,7 @@ jobs:
     - name: Dotenv Action
       id: dotenv
       uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
-    - name: Run FOSSA Test 
+    - name: Run FOSSA Test
       uses: fossas/fossa-action@main
       with:
         api-key: ${{secrets.FOSSA_API_TOKEN}}