How to create 'Deployment Approval Gates' in GitHub Pro private repositories

📝 Originally published (in Japanese) at forge.workstyle.tech.

The Hidden Pitfall of Mandatory Reviewers in Private Repositories

When implementing CI/CD, you might want to prevent deployment to production until a human reviewer approves it, even after merging to the main branch. GitHub has a native feature called mandatory approval reviewers for environments, which allows you to create an ideal gate: "merge → auto-stop → resume with approval button". However, there's an unexpected pitfall when using private repositories.

The Pitfall: Mandatory Reviewers are Not Available in Private Repositories, Even with Pro

The environment's mandatory approval reviewers and waiting timers, also known as "deployment protection rules", are only available in public repositories with GitHub Free, Pro, or Team plans. To use these features in private repositories, you need a GitHub Enterprise plan.

In other words, even if you have a GitHub Pro subscription, attempting to set up approval reviewers in a private repository will result in the following API response:

HTTP 422: Failed to create the environment protection rule.
Please ensure the billing plan supports the required reviewers protection rule.

This is not a billing issue, but rather a plan specification. While you can create environments in private repositories with a Pro plan, the "mandatory approval reviewers" rule is a separate feature that requires an Enterprise plan.

Solution: Using workflow_dispatch as an Approval Gate

If you can't use the native approval gate, you can make the deployment manual using workflow_dispatch. This way, the deployment will only run when a human reviewer triggers it.

name: Deploy
on:
  # Manual trigger = human approval gate
  # The workflow will not run on merge, only when "Run workflow" is clicked
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - name: Production Deployment
        run: echo "Deploying to production"

By doing this, the deployment will not run automatically on merge, but only when the Actions → Deploy → Run workflow button is clicked. This button press serves as the approval.

Choosing the Right Approach

• Keep the repository private → workflow_dispatch manual gate is a permanent solution with zero additional cost.
• Require the native "auto-stop → approval" UI → Either make the repository public or upgrade to Enterprise.

For small teams or personal projects, a manual gate is often sufficient. In many cases, the actual deployment target (e.g., Vercel, Cloudflare) has its own promotion approval mechanism, so there's no need to rely on GitHub's gate.

Conclusion

• Mandatory approval reviewers are only available in public repositories with Free, Pro, or Team plans. Private repositories require an Enterprise plan.
• Manual deployment using workflow_dispatch is a reliable and free alternative for private repositories.
• As long as you can explicitly separate "merge" from "deployment", the mechanism used to achieve this goal is less important.