DeploymentProtection rule

[ReenaChandra03]

Select Topic Area

General

Body

Hi Team,

Is there a method by which we can create a Deployment Protection Rule using the actions and workflows.
The requirement is to deploy to Prod only after approval from the managers.

This I am able to do using Environments in the UI, but I want to do it programatically. Could someone please help on this.

Thanks in advance.

[orazmyradov]

Certainly! GitHub Actions provides a way to programmatically handle deployment protection rules and approvals using "environments" in the workflow. When using environments, you can specify required reviewers for any environment, ensuring that changes only get deployed after an approval.

Here's how you can set this up programmatically in a workflow:

1. Define an Environment in your Workflow:

   Use the environment key in your job to specify which environment the job references. For example:

   jobs:
     deploy:
       runs-on: ubuntu-latest
       environment:
         name: production
         url: ${{ steps.deploy.outputs.url }}
       steps:
       - name: Checkout code
         uses: actions/checkout@v2
         
       # ... your other steps for deployment ...
   
       - name: Deploy to production
         id: deploy
         run: |
           # Your deployment script/code

   In this example, the environment key indicates that the job is associated with the "production" environment. The optional url key allows you to link to the deployed app or service directly from the GitHub Actions UI.

2. Define Approval Rules Programmatically:

   Unfortunately, as of my last update in September 2021, GitHub does not allow you to programmatically set environment protection rules (like required reviewers) directly via the GitHub Actions YAML or via the GitHub API. The environment and its associated protection rules are typically set up via the GitHub UI.

   However, there are a couple of workarounds:

   • Manual Setup: After defining an environment in your workflow, you'll need to go to the GitHub UI to set up protection rules for that environment once. Navigate to your repository's settings, find "Environments," and there you can configure required reviewers for the "production" environment.

   • GitHub API with External Scripting: While you can't directly set up environment protection rules via the GitHub Actions YAML, you can potentially utilize the GitHub API along with some external scripting. This would involve making API calls to create or manage environments and their protection rules. You'd probably need to do some exploration and experimentation to get this working, given the changing nature of the GitHub API and its capabilities.

3. Handle Deployment with Approval:

   Once you've set up the required reviewers in the UI, whenever the workflow runs and tries to deploy to "production," it will pause and request approval from the specified managers. Only after one of them approves will the workflow continue and execute the deployment step.

While it would be ideal to handle everything directly within the GitHub Actions workflow, the current capabilities of GitHub require some manual setup. However, once set up, the process is robust and can effectively gate deployments behind managerial approval.

[rodrigociro]

Hello, I am in the same situation. I would like to create a code to approve it through API. Is it possible that deployments can be approved only with the PAT?

because I have this url to detect pending deployments.

curl -L
-H "Accept: application/vnd.github+json"
-H "Authorization: Bearer $TOKEN"
-H "X-GitHub-Api-Version: 2022-11-28"
https://api.github.com/repos/OWNER/REPO/actions/runs/RUNS_ID/pending_deployments

But with the following command I can't execute it.

curl -L
-X POST
-H "Accept: application/vnd.github+json"
-H "Authorization: Bearer $TOKEN"
-H "X-GitHub-Api-Version: 2022-11-28"
https://api.github.com/repos/OWNER/REPO/actions/runs/RUNS_ID/deployment_protection_rule
-d '{"environment_name":"pro","state":"approved","comment":"trought curl command"}'

Response:

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 231 100 167 100 64 534 204 --:--:-- --:--:-- --:--:-- 742{
"message": "Not Found",
"documentation_url": "https://docs.github.com/rest/actions/workflow-runs#review-custom-deployment-protection-rules-for-a-workflow-run"
}

Seleccionar área temática

General

Cuerpo

Hola, equipo,

¿Existe algún método mediante el cual podamos crear una regla de protección de implementación utilizando las acciones y los flujos de trabajo? El requisito es implementar en Prod solo después de la aprobación de los gerentes.

Esto lo puedo hacer usando entornos en la interfaz de usuario, pero quiero hacerlo mediante programación. ¿Podría alguien ayudarme con esto?

Gracias de antemano.