~4 min to deploy

GitHub Deploy Approval Gate

Blocks production deploys during a freeze, escalates out-of-hours releases, and stamps the verdict on the PR.

For: CI/CD owners gating deploys, releases, and infra changes

SOC 2 CC8.1ISO 27001 A.8.32Change evidence

What it enforces

Change-freeze block

Blocks a production deploy while a change freeze is active.

Out-of-hours escalation

Escalates any production deploy outside business hours to a human approver.

Green-CI allowance

Allows deploys that carry a green CI run and an approved pull request.

Deploy in Shadow Mode

github-deploy-approval-gate.yaml

# GitHub Deploy Approval Gate
# Fork: mirrors the DECIONIS_POLICY.md shipped in apps/github/examples.
# Start with mode: shadow — the step records every verdict and never fails.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
  name: github-deploy-approval-gate
  surface: github
  workflow_key: github_deploy_approval
  standards: [SOC2-CC8.1, ISO27001-A.8.32]
defaults:
  mode: shadow            # shadow | enforce
  emit_dossier: true
  comment_pr: true
rules:
  - name: change_freeze_block
    when: "decision_type == 'production-deploy'"
    decision: |
      BLOCK IF context.change_freeze == true
      ALLOW OTHERWISE
    reason_code: deploy_during_change_freeze
  - name: out_of_hours_escalation
    when: "decision_type == 'production-deploy'"
    decision: |
      ESCALATE IF context.business_hours == false
      ALLOW OTHERWISE
    reason_code: deploy_outside_business_hours
  - name: green_ci_allowance
    when: "decision_type == 'production-deploy'"
    decision: |
      ALLOW IF context.ci_status == 'success' AND context.pr_approved == true
      ESCALATE OTHERWISE
    reason_code: missing_green_ci_or_approval

Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.

How to install it

Drops into any workflow YAML in one line. Verdicts surface on the PR + the run summary.

GitHub Action — shadow mode

# .github/workflows/deploy.yml
- uses: decionis/govern@v1
  with:
    api-key: ${{ secrets.DECIONIS_API_KEY }}
    org-id:  ${{ secrets.DECIONIS_ORG_ID }}
    workflow-key: github_deploy_approval
    mode: shadow          # ← every verdict recorded; step never fails
    comment-pr: 'true'    # ← post verdict + verify URL on the PR

Add the GitHub ActionShips in shadow mode — every verdict is recorded, nothing is blocked.

Loading…

Open-Policy Exchange