},
		{
			name:              "approved",
			group:             "sigs.k8s.io",
			annotationValue:   "https://github.com/kubernetes/kubernetes/pull/79724",
			validateCondition: verifyCondition(apiextensionsv1.ConditionTrue, `approved in https://github.com/kubernetes/kubernetes/pull/79724`),
		},
		{
			name:              "unapproved",
			group:             "sigs.k8s.io",

		expected    APIApprovalState
	}{
		{
			name:        "bare unapproved",
			annotations: map[string]string{apiextensionsv1.KubeAPIApprovedAnnotation: "unapproved"},
			expected:    APIApprovalBypassed,
		},
		{
			name:        "unapproved with message",
			annotations: map[string]string{apiextensionsv1.KubeAPIApprovedAnnotation: "unapproved, experimental-only"},
			expected:    APIApprovalBypassed,
		},
		{

	APIApprovalInvalid APIApprovalState = iota
	// APIApproved if the annotation has a URL (this means the API is approved)
	APIApproved
	// APIApprovalBypassed if the annotation starts with "unapproved" indicating that for whatever reason the API isn't approved, but we should allow its creation
	APIApprovalBypassed
	// APIApprovalMissing means the annotation is empty
	APIApprovalMissing
)

				t.Helper()
				if len(errors) == 0 {
					t.Fatal("expected errors, got none")
				}
				if e, a := `metadata.annotations[api-approved.kubernetes.io]: Invalid value: "invalid": protected groups must have approval annotation "api-approved.kubernetes.io" with either a URL or a reason starting with "unapproved", see https://github.com/kubernetes/enhancements/pull/1111`, errors.ToAggregate().Error(); e != a {
					t.Fatal(errors)
				}
			},
		},

				ObjectMeta: metav1.ObjectMeta{
					Name:        strings.ToLower(string(scope)) + "s.test.apiextensions-apiserver.k8s.io",
					Annotations: map[string]string{"api-approved.kubernetes.io": "unapproved, test-only"},
				},
				Spec: apiextensionsv1.CustomResourceDefinitionSpec{
					Group: "test.apiextensions-apiserver.k8s.io",
					Versions: []apiextensionsv1.CustomResourceDefinitionVersion{
						{

	// The value should be a link to a URL where the current spec was approved, so updates to the spec should also update the URL.
	// If the API is unapproved, you may set the annotation to a string starting with `"unapproved"`.  For instance, `"unapproved, temporarily squatting"` or `"unapproved, experimental-only"`.  This is discouraged.
	KubeAPIApprovedAnnotation = "api-approved.kubernetes.io"

	// The value should be a link to a URL where the current spec was approved, so updates to the spec should also update the URL.
	// If the API is unapproved, you may set the annotation to a string starting with `"unapproved"`.  For instance, `"unapproved, temporarily squatting"` or `"unapproved, experimental-only"`.  This is discouraged.
	KubeAPIApprovedAnnotation = "api-approved.kubernetes.io"

		signerName:           signerName,
		isRequestForSignerFn: isRequestForSignerFn,
	}
	return ret, nil
}

func (s *signer) handle(ctx context.Context, csr *capi.CertificateSigningRequest) error {
	// Ignore unapproved or failed requests
	if !certificates.IsCertificateRequestApproved(csr) || certificates.HasTrueCondition(csr, capi.CertificateFailed) {
		return nil
	}

name: Label Approved

on:
  schedule:
    - cron: "0 12 * * *"
  workflow_dispatch:

jobs:
  label-approved:
    if: github.repository_owner == 'tiangolo'
    runs-on: ubuntu-latest
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: echo "$GITHUB_CONTEXT"
    - uses: docker://tiangolo/label-approved:0.0.4
      with:
        token: ${{ secrets.FASTAPI_LABEL_APPROVED }}

	"status":             "status of the condition, one of True, False, Unknown. Approved, Denied, and Failed conditions may not be \"False\" or \"Unknown\".",