EnvironmentProtection
The rules for deploying to an environment: whether a deployment needs approval and from whom, which refs may deploy, and which groups and repositories may use it. Approvers are checked when the approval is given, so a change in who belongs to a team applies at once.
Shape
- accept_fromAcceptFrompeople_signed_inpeoplepeople_and_service_accountspeople_and_agentsoptionalWhich kinds of approval count. A deployment approved by a bot is rarely what anyone meant, so the default is people, signed in.
- allowed_refsarray of stringoptionalGlobs the ref a run was started from must match for it to deploy here, in the same pattern language as branch rules. Empty allows any ref.
- allowed_scopesarray of ScopeRef or nulloptionalThe only groups and repositories allowed to deploy to this environment. Absent means the group or repository that owns it and everything beneath it.
- approversarray of ApproverRefoptionalWho may approve: people, teams, or a role at a group or repository. Authority to approve a deployment comes from being named here, never from a role alone.
- prevent_self_approvalbooleanoptionaldefault falseWhether the person who started the run is barred from approving its deployment. What counts is who started the run, not who wrote the commit: deploying somebody else's commit is still your deploy.
- requiredinteger · int32optional0–∞default 1Distinct approvals needed before the deployment starts, 1–10.
- requires_approvalbooleanoptionaldefault falseWhen set, a deployment to this environment waits for approval before it starts. Nothing runs and no credentials are issued while it waits.
- wait_timer_secondsinteger · int32optional0–∞default 0How long a deployment waits before it may start, in seconds, up to one hour.
0means no wait.
Example
Synthesized example{
"accept_from": "people_signed_in",
"allowed_refs": [
"allowed-refs-006e"
],
"allowed_scopes": [
{
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
},
{
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
}
],
"approvers": [
{
"anyone": {}
},
{
"anyone": {}
}
],
"prevent_self_approval": false,
"required": 1,
"requires_approval": false,
"wait_timer_seconds": 0
}
Graph
Used by
Sent by 0 operations
No operation takes it as a request body.
Returned by 0 operations
No operation returns it directly.