GitHub Actions "This workflow is awaiting approval from required reviewers"

By Daniel Zoghalchali·Latchkey

When a job targets an environment with a required-reviewers protection rule, the job pauses before running until a designated reviewer approves the deployment.

What this error means

A deploy job is paused with a banner that it is awaiting approval from required reviewers.

This workflow is awaiting approval from required reviewers.
The job targeting environment 'production' is paused until a reviewer approves.

Diagnose it: what token do you actually have?

Permission failures in Actions are almost never about your repository settings alone. Three things combine: the default GITHUB_TOKEN permission set for the repo or organization, the permissions: block in the workflow, and whether the event is a fork pull request, which downgrades the token to read-only regardless of everything else.

- name: Show the token scopes actually granted
  run: |
    curl -sI -H "Authorization: Bearer $GITHUB_TOKEN" \
      https://api.github.com/ | grep -i "^x-oauth-scopes\|^x-accepted"
    echo "event: ${{ github.event_name }}"
    echo "fork PR: ${{ github.event.pull_request.head.repo.fork }}"
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Common causes

Environment required-reviewers rule

The targeted environment has a protection rule listing reviewers who must approve each deployment.

How to fix it

Approve the deployment

1. A listed reviewer opens the run and clicks Review deployments, then Approve and deploy.
2. If the wait timer is configured, the job also respects that delay.

Adjust reviewers if unintended

1. Open Settings > Environments > the environment > Required reviewers.
2. Update the reviewer list or remove the rule if it should not gate this environment.

Grant the narrowest permission that works

Declaring a permissions: block switches the job from the repository default to exactly what you list, so an incomplete block is a common cause of a new failure right after someone tightened security. List every scope the job needs, not just the one that failed.

permissions:
  contents: read        # checkout
  packages: write       # push to GHCR
  id-token: write       # OIDC to a cloud provider
  pull-requests: write  # comment on or label a PR
  checks: write         # publish check runs

How to prevent it

• Make sure at least one available reviewer is configured per protected environment.
• Document who approves production deployments.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions