Custom deployment gates come to GitHub Actions
GitHub has announced the public beta of Deployment Protection Rules for GitHub Actions, an extensible mechanism for controlling when code moves into production and other protected environments. The feature builds on the platform's existing environment protection rules (manual approvals, branch restrictions, job delays) by letting teams define their own rules for automated deployment gating.
Deployment Protection Rules are powered by GitHub Apps and can be installed at the repository or organization level. The rules can be applied to any deployment environment, complementing the built-in protections already available. This gives engineering organizations a way to enforce quality gates as an automated part of the release pipeline, rather than relying solely on human review or in-platform safeguards.
Extending CI/CD to external systems
The feature is designed to serve as a bridge between GitHub Actions workflows and external tools used during the release process. Because the protective logic can call out to third-party APIs, a deployment can be blocked automatically when a service such as a monitoring platform or security scanner reports a problem.
GitHub also announced that the following vendors are making deployment protection rules available for their platforms:
- Datadog – A rule based on Datadog Monitors lets teams check application performance and infrastructure health before a deploy is allowed to proceed.
- Honeycomb – Deployments can be gated on the results of Honeycomb queries, enabling teams to prevent releases when high-cardinality trace analysis surfaces performance issues.
- New Relic – The New Relic Gate App applies the platform's anomaly detection to automatically validate deployment requests before code reaches production.
- NodeSource – Integrates NCM (NodeSource Certified Modules) vulnerability scanning into pull requests and deployment pipelines, providing security insights throughout the release lifecycle.
- Sentry – Users can incorporate Sentry monitoring into their deployment pipelines to gate releases on the quality of running code.
- ServiceNow – ServiceNow ITSM Pro DevOps connects GitHub Actions pipelines to existing ServiceNow change management workflows, automating change request approvals while maintaining governance control.
The initial partner ecosystem covers observability, security scanning, and change management use cases. GitHub expects additional ecosystem integrations to follow as the feature approaches general availability.
Building custom rules
Teams that want to build their own protection rules can do so by creating a GitHub App that implements the required deployment protection rule endpoints. GitHub has published documentation on creating custom deployment protection rules, with a sample application also planned.
Writing Datadog's integration for GitHub's Deployment Protection Rules was incredibly fun. Setting up a working testing environment takes a few minutes at most, and development cycles are fast with GitHub's ability to resend an App's API calls with the press of a button. The API is well structured, easy to understand, and information rich at the same time, which is an incredibly difficult feat. I've been writing third-party integrations for Datadog for years now, and my experience with GitHub was top tier; at no point was I ever blocked because of an issue on GitHub's end, and I managed to deliver my integration way ahead of schedule.
Eligibility and availability
The Deployment Protection Rules public beta is available to GitHub Enterprise Cloud (GHEC) customers. Community and partner-developed rules are discoverable via the GitHub Marketplace and can be installed across repositories once published. The public beta announcement comes with GitHub App authentication already supported for the rule endpoints, and indicates the mechanism for sharing custom rules through the Marketplace for wider organizational use.
Deployment Protection Rules can be enabled on production environments alongside existing approval requirements. Since the rule checks operate programmatically, they can provide consistent enforcement of release criteria without adding manual coordination overhead across development, operations, and security teams.
