How to Offer Self-Service Deploys With Approvals

A protected environment with required reviewers makes a deploy one click for teams while keeping a human gate on production.

Expose a workflow_dispatch deploy that targets a protected environment. Teams trigger it themselves; production still waits for a required reviewer before it proceeds.

Steps

• Add a workflow_dispatch deploy workflow with an environment input.
• Point the job at a protected environment: with required reviewers.
• Let any team member trigger it; the run pauses for approval.
• On approval the deploy proceeds; on reject it stops.

Workflow

on:
  workflow_dispatch:
    inputs:
      target:
        type: choice
        options: [staging, production]
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.target }}
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh --env ${{ inputs.target }}

Gotchas

• Required reviewers live on the environment, not the workflow; configure them in repo settings.
• Give staging no reviewers and production reviewers so self-service stays fast where risk is low.

Related guides