Approve or reject a GitHub Actions deployment via the custom deployment protection rule review API

Steps

1. Register a GitHub App with Actions read-only and Deployments read-and-write repository permissions, subscribed to the 'Deployment protection rule' event, and install it on the target repository.
2. Enable the app as a custom protection rule on the environment (Settings > Environments), or programmatically via POST /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules with the app's integration_id.
3. When a workflow run reaches a job referencing that environment, GitHub sends a POST webhook with a deployment_protection_rule payload; validate it, then exchange the payload's installation ID for an installation access token scoped to deployments:write.
4. To approve or reject, send POST /repos/{owner}/{repo}/actions/runs/{run_id}/deployment_protection_rule with a JSON body containing environment_name and state set to approved or rejected.
5. Optionally post an interim status update by omitting state from the body (up to 10 times per deployment), or check approval status with GET /repos/{owner}/{repo}/actions/runs/{run_id}/approvals.