Deploying to Production with Approval Gates
Learn how to safely promote builds from staging to production using GitHub Actions environment protection rules, manual approvals, and deployment gates.
Deploying to Production with Approval Gates is a free DevOps Bootcamp lesson on CoddyKit. This is lesson 4 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, and your progress syncs across the web and the CoddyKit app. The DevOps Bootcamp course includes 4 lessons in total.
Why Production Needs Gates
Continuous Deployment ships code automatically, but pushing straight to production without any checkpoint is risky. A bad release can affect every user instantly.
An approval gate is a deliberate pause where a human (or an automated check) confirms a deployment should proceed.
- Reduces blast radius of mistakes
- Creates an audit trail of who approved what
- Lets you separate
stagingfromproductionconfidence levels
GitHub Environments
GitHub Actions has a feature called Environments. An environment (like production) can hold its own secrets, variables, and protection rules.
You reference an environment from a job using the environment key. This is the foundation for adding approval gates.
jobs:
deploy:
runs-on: ubuntu-latest
environment: production
steps:
- run: echo 'Deploying to production'Required Reviewers
In the repository settings, under Settings > Environments > production, you can enable Required reviewers.
When a job targets that environment, the workflow run pauses and waits until one of the listed reviewers clicks Approve.
- Up to 6 reviewers can be configured
- Any one approval (by default) unblocks the job
- The approver cannot be the person who triggered the run, depending on settings
A Full Gated Workflow
Here a build job runs first, then a deploy job depends on it via needs and targets the protected production environment.
The deploy will not start until the required reviewer approves it in the Actions UI.
name: Deploy
on:
push:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
steps:
- run: echo 'build artifact'
deploy:
needs: build
runs-on: ubuntu-latest
environment:
name: production
url: https://myapp.example.com
steps:
- run: echo 'deploy to prod'Wait Timers
Besides reviewers, environments support a wait timer. This forces a delay (up to 30 days) before a deployment can proceed.
A short wait timer is useful as a safety cooldown: it gives the team a window to cancel a run before it reaches production.
Deployment Branch Restrictions
Environments can restrict which branches are allowed to deploy. For production, you typically only allow main (or release tags).
This prevents an accidental deploy to production from a feature branch.
- Protected branches — only branches with protection rules
- Selected branches — an explicit allow-list or tag pattern
Environment-Scoped Secrets
Each environment has its own secrets. A production environment can hold PROD_DB_URL while staging holds STAGING_DB_URL.
Secrets defined on the environment are only available to jobs that target that environment, adding another layer of isolation.
steps:
- name: Deploy
env:
DB_URL: ${{ secrets.PROD_DB_URL }}
run: ./deploy.shTracking Deployment Status
Setting an url on the environment adds a clickable link to the deployment in the GitHub UI and records a deployment object via the Deployments API.
This gives you a visible history: which commit went to production, when, and by whom.
environment:
name: production
url: https://myapp.example.comApproving a Pending Run
When a gated job is waiting, you will see a yellow Review deployments banner on the workflow run page.
- Open the run in the Actions tab
- Click
Review deployments - Select the environment and click
Approve and deployorReject
You can also leave a comment explaining the decision.
Combining Multiple Gates
The strongest production gate combines several rules together:
- Required reviewers (human approval)
- A wait timer (cooldown)
- Branch restrictions (only
main) - Environment secrets (isolation)
Layering these creates a robust promotion process from staging to production.
Bypassing Gates Safely
Sometimes you need an emergency hotfix. Rather than removing protection rules, consider a separate, narrowly scoped hotfix workflow with its own logging and stricter reviewers.
Never disable gates permanently for convenience — that defeats the purpose of the safety mechanism.
Quick Check
Test your understanding of production approval gates.
Recap
You learned how to add approval gates for production deployments using GitHub Environments.
- Use the
environmentkey to target a protected environment - Required reviewers add human approval
- Wait timers add a cooldown window
- Branch restrictions and environment secrets add isolation
Together these gates make promoting from staging to production safe and auditable.
Learn DevOps Bootcamp with an AI tutor — free
Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.
- Courses
- 142
- Lessons
- 568
Frequently Asked Questions
Is the “Deploying to Production with Approval Gates” lesson free?
Yes — any 3 lessons of the DevOps Bootcamp learning path, including “Deploying to Production with Approval Gates”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The DevOps Bootcamp course includes 4 lessons in total.
What will I learn in “Deploying to Production with Approval Gates”?
Learn how to safely promote builds from staging to production using GitHub Actions environment protection rules, manual approvals, and deployment gates. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.
How long does the “Deploying to Production with Approval Gates” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Introduction to Continuous Deployment
- Deploying to a Staging Environment
- Environment Variables and Secrets
- Deploying to Production with Approval Gates