World C3: Release & Deploy

Environments with required reviewers

You will learn: how to make production wait for a person to say yes.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Pick an event. Press Run and watch the line.

Midnight: a push to main tests, then deploys at once.

What happened on GitHub

Push to main

Workflow file .github/workflows/deploy.yml

1name: Deploy
2on:
3  push:
4    branches: [main]
5permissions:
6  contents: read
7jobs:
8  test:
9    runs-on: ubuntu-latest
10    steps:
11      - uses: actions/checkout@v7
12      - run: npm ci
13      - run: npm test
14  deploy:
15    needs: test
16    runs-on: ubuntu-latest
17    steps:
18      - uses: actions/checkout@v7
19      - run: npm ci
20      - run: npm run deploy
21        env:
22          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

The line

Push to main · main

Midnight. A teammate pushes to main. The van leaves at once. Nobody tasted the food. Run it and watch.

Watch

Give production a guard. An is a named place you deploy to. It has its own rules. Which of these are environment rules?

Drag a card into a box. Or tap the card, then tap the box.

Try it

Production now has a : Aina. Run it. The deploy job waits. You are Aina: check it, then approve.

Run it. When a job waits for you, check it and approve.

What happened on GitHub

Push to main

Workflow file .github/workflows/deploy.yml

1name: Deploy
2on: push
3permissions:
4  contents: read
5jobs:
6  test:
7    runs-on: ubuntu-latest
8    steps:
9      - uses: actions/checkout@v7
10      - run: npm ci
11      - run: npm test
12  deploy:
13    needs: test
14    runs-on: ubuntu-latest
15    environment:
16      name: production
17      url: https://shop.example.com
18    steps:
19      - uses: actions/checkout@v7
20      - run: npm ci
21      - run: npm run deploy
22        env:
23          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

The line

Push to main · main

Try it

Now build it. A job joins an environment with one key: environment.

Tap blocks to add them. Put them in order.

Blocks

Your workflow

Tap a block above to start.

Workflow file .github/workflows/

name: Deploy

What runs

Nothing to run yet.

Predict

Someone pushes to the branch feature. Production allows only main. What happens to the deploy job?

Check

Check it on the belt. Find the push the guard stops. Read the real message.

Try the events. Find the one asked for.

What happened on GitHub

Push to mainPush to feature

Workflow file .github/workflows/deploy.yml

1name: Deploy
2on: push
3permissions:
4  contents: read
5jobs:
6  test:
7    runs-on: ubuntu-latest
8    steps:
9      - uses: actions/checkout@v7
10      - run: npm ci
11      - run: npm test
12  deploy:
13    needs: test
14    runs-on: ubuntu-latest
15    environment:
16      name: production
17      url: https://shop.example.com
18    steps:
19      - uses: actions/checkout@v7
20      - run: npm ci
21      - run: npm run deploy
22        env:
23          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

The line

Push to main · main

You did it!

You can now put a human gate in front of production.

Go deeper (optional)

Up to six people or teams can be reviewers. One approval is enough. Turn on “prevent self-review” so nobody approves their own deploy. A wait timer can pause up to 30 days. On private repos, required reviewers need GitHub Enterprise.

Real rep (optional): in a public test repo, make a production environment. Add yourself as its reviewer.