How to Gate terraform apply Behind an Approval in CI

A protected environment with required reviewers pauses any apply job that names it until a reviewer approves the run.

Create an environment with required reviewers, then set environment: on the apply job. The run waits in a pending state, notifies reviewers, and resumes only after approval.

Steps

• In Settings to Environments, add required reviewers to production.
• Set environment: production on the apply job.
• The apply pauses until a reviewer approves in the run UI.

Workflow

jobs:
  apply:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://console.example.com
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init -input=false
      - run: terraform apply -auto-approve -input=false

Gotchas

• The approval gate lives on the environment, not the workflow YAML.
• Add a wait timer or branch restriction to the environment for defense in depth.

Related guides