Skip to content
PERMISSION/PROTOCOL

Deploy Gate · GitHub workflows

GitHub approval gates for AI-generated changes.

Deploy Gate adds an authorization check and signed receipt to a configured GitHub workflow. Keep your code review and CI checks, and record who authorized the exact change.

Review setup Walk through an approval

What you are connecting

Your GitHub workflow → authorization check → protected merge or deployment.

Start with one repository, one selected workflow, and named approvers.

Workflow preview
Example actionProtected GitHub change

  1. Change requests authorization

    The workflow identifies the commit and action.

  2. Named approver reviews

    A consequential change waits for a decision.

  3. Signed receipt checked

    The receipt must cover this commit and action.

  4. Authorization check passes

    Other required CI and deployment checks still apply.
Change requests authorization
Illustrative flow with required checks configured. No actions are sent.

The protected path

Keep your GitHub approval workflow

GitHub reviews and deployment protection remain part of your workflow. Configure Deploy Gate alongside those controls so an authorization record covers the intended commit and action. A GitHub Actions approval gate only protects the paths covered by your required checks and deployment rules.

Tie approval to the change under review

Start with one repository and a protected change. Review the approval, compare the receipt with the intended commit, then test a new commit and a denied request. Record successful execution separately from the authorization decision.

Read the GitHub approval-gate guide

From setup to a tested decision

Connect one workflow, then verify it.

  1. Connect one repository

    Install the GitHub App for the selected repository and choose the approval workflow you want to evaluate.

  2. Configure the enforced path

    Set the required check and deployment rules. Select protected changes and approvers; keep your existing CI and review requirements.

  3. Exercise the gate

    Test approval, denial, changed commits, alternate paths, and service errors. Inspect the matching receipt before using the workflow in production.

Connect a repositoryReview the GitHub Action

Scope and boundaries

What this controls, and what it doesn’t.

  • Required checks and deployment rules must actually cover the production path. Administrators and alternate credentials can change or bypass that path.
  • An approval must cover the intended commit and action. A changed action needs a fresh evaluation.
  • Outage behavior varies by integration and version. Some Action versions continue on API errors; verify the behavior you intend to rely on.
  • An authorization receipt documents approval. It does not by itself prove that execution succeeded.

The record behind the decision

Inspect the authorization evidence.

Review the action, commit, approver, policy, and signature. Compare the receipt with the action your workflow actually intends to execute.

From approval to receipt Discuss your workflow
How to choose which AI actions need human approval

Your first workflow

Ready to test your first workflow?

Work through setup, approval, denial, and evidence inspection. Keep track of your checks before expanding the rollout.

Open the test checklist