Deploy Pipeline

A deploy workflow earns trust the same way the artifact it ships does: it can't run twice at once, it holds no standing credential worth stealing, and every failure mode has a stated way back.

Environments and protection rules

A GitHub Actions environment: applies the protection rules actually configured for that environment. The field alone does not require approval:

jobs:
  deploy:
    environment: production
    runs-on: ubuntu-latest

Configure required reviewers and deployment branch restrictions on the environment itself (repo Settings → Environments). A production environment with no protection rule is a secret with a workflow trigger instead of a login form.

OIDC federation