Select Topic Area

Product Feedback

Body

We'd like to be able to require manual approval to our staging environment from feature branches, but have them automatically proceed when running from the main branch. We allow developers to optionally test in staging from their feature branches, but we want every main commit to go to staging as part of our continuous delivery pipeline.

Currently I see no secure way to do this.

I see a couple options to get the desired workflow, but both undermine security and cause other maintenance headaches:

1. Create two 'environment' definitions for staging, one with and one without the approval condition. This is bad for maintainability because it requires manual duplication/synchronization of variables and secrets between environments. It's bad for security, because any contributor could easily swap the environment values and run staging deployments without the approval from feature branches. It's also a clear hack that undermines the design of the "environment" concept in Github actions. We don't have two staging environments, so the two instances would no longer represent environments, they'd just be functional needs imposed on the environment feature.
2. Another option that I've seen suggested more frequently in here is to store a PAT as a repo secret that has permissions to do approvals, and conditionally send a REST request within the workflow. This fully undermines the security goals of environments, as anyone could use that PAT to approve any environment that the PAT's user is an approver for. We also avoid using PAT's in workflows as they depend on user's inclusion in the org, which will unexpectedly break in a few years whenever that person leaves the company.

Allowing environments to be configured to bypass approvals for specific branches seems like the simplest and most desirable approach. This still enables the repo admins to control the conditions under which environment access can occur, since they can set branch protection rules that must be met to merge to that branch.