How to Gate Production Behind a Manual Approval in GitHub Actions

Targeting a protected production environment with required reviewers pauses the deploy until someone approves.

Configure required reviewers (and optionally a wait timer) on a production environment, then point only the production deploy job at it. The job waits in a pending state until approved.

Steps

• Add required reviewers to the production environment in settings.
• Run build and staging jobs unconditionally so they are unaffected.
• Target only the prod deploy job with environment: production.

Workflow

jobs:
  staging:
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - run: ./deploy.sh --env staging
  production:
    needs: staging
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: ./deploy.sh --env production

Gotchas

• The approval gate lives on the environment, not the workflow file.
• Combine with a wait timer or branch restriction for layered protection.

Related guides