Adding a Manual Approval Step in GitHub Actions for Controlled Deployments on Free GitHub Accounts

Managing code deployment in CI/CD pipelines can be challenging, especially if you want a manual approval step to verify each release. On GitHub, Environments allow you to define such an approval step — but this feature requires GitHub Enterprise for private repositories. For teams on free or standard plans, there’s a clever workaround to introduce a manual approval step using an open-source action called trstringer/manual-approval. Here’s how it works and why it can make a big difference in your deployment process.

Why Add Manual Approval?

A manual approval step is crucial in CI/CD workflows, especially in complex production environments. It allows team members to validate deployments, review infrastructure changes, and perform last-minute checks. Without this step, any merged code can go live automatically, potentially leading to unwanted changes or errors in production.

Manual approvals can be beneficial in the following scenarios:

• Release Verification: For sensitive production deployments, approvals ensure that changes are reviewed.

• Compliance: Some teams require approvals for compliance or audit purposes.

• Cost Management: Approving infrastructure updates in advance can prevent accidental overspending.

For GitHub users without Enterprise, this workaround allows similar control over deployments using only Actions and a GitHub issue.

Setting Up a Manual Approval Step in GitHub Actions

Using the open-source action trstringer/manual-approval, you can create a manual approval step by generating a GitHub issue as part of your workflow. Here’s how it works:

1. Workflow Starts and Runs Preliminary Jobs: For example, a Terraform plan job can prepare an infrastructure deployment without applying changes.

2. Manual Approval Action Creates an Issue: The workflow pauses by creating an issue, notifying the necessary approvers.

3. Approver Responds in Issue Comments: With predefined approval or denial keywords, team members can approve or deny the deployment simply by commenting.

4. Workflow Continues or Exits: Based on the response, the workflow either proceeds with deployment (e.g., terraform apply) or exits, protecting production from unintended changes.

Example Workflow with Approval Step

Here’s an example terraform-apply.yml workflow that includes the manual approval step. This workflow only applies changes after all approvers comment on the generated issue.

name: Terraform Apply Workflow

on:
  push:
    branches:
      - main # Only trigger on push to main (i.e., after merge)

jobs:
  terraform-plan:
    name: Terraform Plan
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: read

    steps:
      ...

  manual-approval:
    name: Manual Approval
    runs-on: ubuntu-latest
    needs: terraform-plan
    if: success() # Only proceed if terraform-plan job succeeds

    permissions:
      issues: write

    steps:
      - name: Await Manual Approval
        uses: trstringer/manual-approval@v1
        with:
          secret: ${{ github.TOKEN }}
          approvers: user1,user2,user3,group1,group2 # Replace with GitHub usernames, with the free version you can only have an issue assigned to one username
          minimum-approvals: 1
          issue-title: "Manual Approval Required for Terraform Apply"
          issue-body: "Please approve or deny the deployment."

  terraform-apply:
    name: Terraform Apply
    runs-on: ubuntu-latest
    needs: manual-approval

    permissions:
      id-token: write
      contents: read

    steps:
      ...

How the Workflow Works

1. Terraform Plan: This job generates a Terraform plan and stops short of applying it. Any issues in the plan stage can be resolved without progressing to deployment.

2. Manual Approval: If the plan succeeds, the workflow pauses, generating an approval issue. Team members specified as approvers receive an issue notification.

3. Approval Comment: Approvers respond to the issue with “approve” or “deny” keywords. Based on the response, the workflow continues or exits.

4. Terraform Apply: If approved, the terraform apply job runs, deploying the code as planned.

Advantages of This Approach

This workaround provides manual approval for free-tier or standard GitHub plans, offering flexibility and control without needing GitHub Enterprise. Here’s why it’s helpful:

• Control Over Production Changes: The workflow pauses, ensuring critical deployments receive proper review.

• No Extra Cost: Since this approach uses only GitHub Actions and the GitHub API, it’s completely free for private or public repositories.

• Automated Approvals: Approvals through GitHub issues allow easy review and can fit into your team’s communication flow without switching platforms.

Potential Limitations

While this workaround is powerful, it does come with certain limitations:

• Workflow Timeout: GitHub has a default 72-hour timeout for workflows, so approvals must happen within this timeframe.

• Concurrency Cost: Pausing the workflow still uses an active runner, so any long pauses consume concurrent job allocations and may incur cost if using paid GitHub runners.

• Permissions Requirement: Approvers need write permissions on the repository, so limited access could complicate the process.

Conclusion

Adding a manual approval step using trstringer/manual-approval in GitHub Actions is a clever way to introduce essential checks for deployments on free GitHub accounts. This solution is invaluable for small teams or organizations needing control without the cost of GitHub Enterprise. By combining GitHub Actions and API integrations, you can efficiently manage releases, improve deployment safety, and align with compliance needs without altering your existing CI/CD processes.

With this simple yet effective solution, you can keep deployment controls strong and stay within GitHub’s free-tier limits — making your development workflow both flexible and secure.

This article guides you on integrating manual approval seamlessly with GitHub Actions, providing a cost-effective way to control deployments in non-Enterprise GitHub setups.

Resources

• Manual Workflow Approval GitHub Action: https://github.com/marketplace/actions/manual-workflow-approval

For any freelance projects or assistance with DevOps, AWS, or GitOps challenges, don’t hesitate to get in touch!