How to Gate a Release on Manual Approval in GitHub Actions

Pointing the publish job at a protected environment with required reviewers pauses the run until a reviewer approves the release.

Create an Environment (for example release) with required reviewers, then set environment: on the publishing job. The run waits in a pending state until someone approves.

Steps

• Open Settings to Environments and add required reviewers to a release environment.
• Split build (unguarded) from publish (guarded).
• Set environment: release on the publish job and needs: build.

Workflow

on:
  push:
    tags: ['v*.*.*']
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: make build
  publish:
    needs: build
    runs-on: ubuntu-latest
    environment: release
    steps:
      - run: ./publish.sh

Gotchas

• The approval gate lives on the environment, not the workflow file.
• A reviewer cannot approve their own run when the environment forbids self-review.

Related guides