Guides

Production Deploy से पहले Manual Approval Gate कैसे जोड़ें

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Prod से पहले Jenkins input या GitLab when:manual, environment protect, who-approved log, फिर deploy.

Language: English · मराठी · हिंदी

Manual gate क्यों

इंसान Friday बचाता है.

Why: Auto-prod = outage. What: input/manual. How: सिर्फ deploy_prod से पहले.

Example 1: Jenkins input step sketch

Type this:

printf '%s\n' 'stage("Approve") {' '  steps {' '    input message: "Deploy to production?"' '  }' '}' > /tmp/approve-jf.txt && cat /tmp/approve-jf.txt

You will see:

input message: "Deploy to production?"

What it means: Pipeline pauses until a human clicks Proceed.

Example 2: GitLab manual job

Type this:

printf '%s\n' 'deploy_prod:' '  stage: deploy' '  script: ["echo deploy"]' '  when: manual' '  only: [main]' > /tmp/gl-manual.yml && grep -n manual /tmp/gl-manual.yml

You will see:

4:  when: manual

What it means: Manual jobs show a play button in the GitLab UI.

Example 10: Order of stages

Type this:

printf '%s\n' 'test -> build -> approve -> deploy_prod'

You will see:

test -> build -> approve -> deploy_prod

What it means: Never put approve before tests.

Concept 1: कौन approve

Separation of duties.

Why: Author अकेले = audit fail. What: submitter:false. How: Protected env.

Example 3: Environment protection idea

Type this:

printf '%s\n' 'production environment requires approvers list in the CI settings'

You will see:

production environment requires approvers list in the CI settings

What it means: Protected environments add a second gate.

Example 4: Who may approve

Type this:

printf '%s\n' 'submitter: false  # do not let the same person who pushed approve alone'

You will see:

submitter: false  # do not let the same person who pushed approve alone

What it means: Separation of duties — Capgemini audit ask.

Example 11: Two-person rule note

Type this:

printf '%s\n' 'ok: require two approvers for prod in bank projects'

You will see:

ok: require two approvers for prod in bank projects

What it means: Some clients require two clicks.

Concept 2: Click के बाद

Deploy + record.

Why: Silent = no trail. What: audit line. How: Notify.

Example 5: Timeout so it does not hang forever

Type this:

printf '%s\n' 'options { timeout(time: 2, unit: "HOURS") }'

You will see:

options { timeout(time: 2, unit: "HOURS") }

What it means: Abandoned approvals should expire.

Example 6: Post-approve deploy echo

Type this:

printf '%s\n' 'echo DEPLOY_PROD_START' 'echo DEPLOY_PROD_DONE'

You will see:

echo DEPLOY_PROD_START
echo DEPLOY_PROD_DONE

What it means: Keep deploy steps after the gate, never before.

Example 7: Audit line

Type this:

printf '%s\n' 'Approved by: $APPROVER at $(date -u +%Y-%m-%dT%H:%MZ)'

You will see:

Approved by: $APPROVER at

What it means: Log who approved — Infosys change tickets expect this.

Concept 3: Abort/timeout

Abort सुरक्षित; hang नहीं.

Why: Forgotten input. What: timeout. How: Stage auto.

Example 8: Reject path

Type this:

printf '%s\n' 'If Abort is clicked the pipeline stops and prod stays untouched'

You will see:

If Abort is clicked the pipeline stops and prod stays untouched

What it means: Abort is success for safety.

Example 9: Notify Slack-style message

Type this:

printf '%s\n' 'echo Notify: waiting for production approval on pipeline $BUILD_ID'

You will see:

echo Notify: waiting for production approval on pipeline $BUILD_ID

What it means: Tell the on-call channel while waiting.

Example 12: Dry run vs prod

Type this:

printf '%s\n' 'deploy_stage can be automatic; deploy_prod stays manual'

You will see:

deploy_stage can be automatic; deploy_prod stays manual

What it means: Stage auto, prod gated — common TCS pattern.

Approval card

1 green tests 2 manual 3 protect 4 deploy 5 log

Suppose: stuck

Timeout + notify.

Suppose: same person

submitter:false.

Check yourself (quiz)

test → build → approve → deploy → verify. Did you understand? Let us try it once more.