Deployment Approvals
Require verified Atmos Pro dispatches and independent human approvals before infrastructure changes are applied.
Atmos Pro integrates with GitHub Environments to verify deployment authorization before an environment-protected job starts. Enable the Atmos Pro custom protection rule to require a recorded Atmos Pro dispatch and an authorized commit. Enable Required reviewers separately to require a human approval before Terraform apply.
This is especially important for production environments where infrastructure changes can have significant impact. With deployment approvals, your team gets an explicit gate between a successful plan and the actual apply — ensuring that changes are reviewed and approved by the right people before anything is provisioned.
GitHub Plan Requirements
Custom deployment protection
rules
require GitHub Enterprise for private and internal repositories. Public repositories support them on all plans.
Required reviewers and wait timers also require Enterprise for private repositories; deployment branch restrictions
are available for private repositories on GitHub Pro and Team. Without custom-rule support, Atmos Pro cannot enforce
its external approval gate. See the non-Enterprise
pattern.
With Deployment Approvals, you can:
Require manual approval before applying infrastructure changes
Reject deployments that Atmos Pro did not dispatch, even from an allowed branch
Verify the requested commit belongs to a branch permitted by the environment
Designate specific reviewers for each environment
Enforce different approval policies per environment (e.g., staging vs production)
Leverage GitHub's built-in audit trail for all approvals
GitHub enforces all configured environment rules. Atmos Pro supplies an automated authorization decision through its custom rule; human reviewers supply their own independent decision.
- 1A developer merges a pull request containing infrastructure changes.
- 2Atmos Pro detects the merge and dispatches the configured apply workflows.
- 3Each workflow targets a specific GitHub environment (e.g.,
production,staging). - 4GitHub pauses the protected job. Atmos Pro looks up the webhook's run ID in its own dispatch records; the webhook does not expose
inputs.sha. - 5Atmos Pro rejects any unknown run ID. For a known dispatch, it checks the environment's current branch policy and verifies that the requested SHA is contained in a branch the environment permits, in either dispatch mode. With the repository's PR-branch dispatch setting enabled, it also checks the exact SHA against the dispatch branch's history.
- 6Required reviewers approve or reject independently. Only after all configured gates pass can Terraform apply run.
- 7Atmos Pro tracks the workflow status and updates the PR comment accordingly.
The Atmos Pro rule is an automated security check, not a substitute for a human reviewer. A direct GitHub or CLI dispatch has no matching authorization record and is rejected even when it runs from
main. By default, a PR dispatch still uses the default branch workflow. In either dispatch mode, Atmos Pro verifies the requested SHA against GitHub source metadata and requires it to belong to a branch permitted by the environment. An unmerged PR targeting a main-only production environment is rejected; use a separate planning environment that permits both the default dispatch branch and the intended PR branches. The optional repository setting changes which branch supplies the workflow; it cannot disable environment authorization. GitHub's native branch restrictions alone evaluate the dispatch branch, not the SHA your workflow checks out.- You configure protection rules in your GitHub repository settings, not in Atmos Pro.
- Atmos Pro approves only its own custom protection rule; it cannot satisfy a required human review through that decision.
- GitHub maintains a complete audit trail of who approved what and when.
- Your existing GitHub access controls and team structures apply.
Workflows must remain trusted and deploy the recorded SHA. GitHub administrators control the environment's rules and bypass setting. If the Atmos Pro rule is absent, GitHub never requests its approval; Workspace → Repairs warns administrators, but the warning itself cannot block deployment.
In the environment's GitHub settings, select Atmos Pro, configure any required reviewers, and save. Then use Recheck under Workspace → Repairs to verify the correct App rule is enabled.
Configure GitHub Environments
Ready to configure deployment approvals?
Set up GitHub environment protection rules to require approval before infrastructure changes are applied.