Environments and Continuous Deployment

An environment is a named deployment target — staging, production — that carries its own secrets, protection rules, and deployment history. Attaching one to a job is what turns a plain CI run into controlled CD: required reviewers, wait timers, and branch restrictions all hang off the environment, not the workflow file.

The advantage is that the gates live with the target rather than the pipeline. A deploy job that names environment: production automatically resolves production's secrets and obeys production's approval rules, no matter which workflow invoked it.

Declaring an Environment

Add environment: production to a job and its secret lookups resolve to that environment's scope. The job appears in the environment's deployment history, and any protection rule configured on the environment applies before the job's steps run.

jobs:
  deploy:
    needs: [build, test]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh
        env:
          TOKEN: ${{ secrets.DEPLOY_TOKEN }}

Protection Rules

An environment can require reviewers — named people or teams who must approve before the job proceeds — plus an optional wait timer and a list of branches allowed to deploy. Required reviewers are the actual control; the wait timer only delays.

Deployment Gates

When a job hits a protected environment, it pauses and waits for approval. The run records who approved and when, so there is an audit trail tying each production deploy to a human decision rather than an automatic merge.

Environment Secrets and Variables

Secrets and variables scoped to an environment are visible only to jobs that name it. That is what keeps production credentials out of staging jobs and out of pull-request CI — a PR job that never declares environment: production cannot read its secrets.

Deployment History and Rollback

The environment tab tracks every deployment and shows the active version, so before promoting a new build you can confirm what is currently live and, if needed, identify the revision to roll back to.