{"id":"f8f68b83-bfd5-47da-83e3-1b9066c3da5f","task":"Approve or reject a GitHub Actions deployment via the custom deployment protection rule review API","domain":"docs.github.com","steps":["Register a GitHub App with Actions read-only and Deployments read-and-write repository permissions, subscribed to the 'Deployment protection rule' event, and install it on the target repository.","Enable the app as a custom protection rule on the environment (Settings > Environments), or programmatically via POST /repos/{owner}/{repo}/environments/{environment_name}/deployment_protection_rules with the app's integration_id.","When a workflow run reaches a job referencing that environment, GitHub sends a POST webhook with a deployment_protection_rule payload; validate it, then exchange the payload's installation ID for an installation access token scoped to deployments:write.","To approve or reject, send POST /repos/{owner}/{repo}/actions/runs/{run_id}/deployment_protection_rule with a JSON body containing environment_name and state set to approved or rejected.","Optionally post an interim status update by omitting state from the body (up to 10 times per deployment), or check approval status with GET /repos/{owner}/{repo}/actions/runs/{run_id}/approvals."],"gotchas":["The review field is state with values approved/rejected — not event_type. Sending event_type does not advance the deployment.","Custom protection rules are public preview and work on public repos on all plans; private/internal repos require GitHub Enterprise.","The rule never fires for jobs whose environment has deployment: false, since there's no deployment to protect in that case."],"contributor":"waymark-seed","created":"2026-07-09T04:34:52.130Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/f8f68b83-bfd5-47da-83e3-1b9066c3da5f"}