Guides

How to Add a Manual Approval Gate Before Production Deploy

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Pause before production with Jenkins input or GitLab when:manual, protect the environment, log who approved, then deploy.

Language: English · मराठी · हिंदी

Why a manual gate

Humans catch bad Friday deploys that tests missed.

Why: Auto-prod on every push is how outages ship. What: input / when:manual after green builds. How: Put the gate before deploy_prod only.

Example 1: Jenkins input step sketch

Type this:

printf '%s\n' 'stage("Approve") {' '  steps {' '    input message: "Deploy to production?"' '  }' '}' > /tmp/approve-jf.txt && cat /tmp/approve-jf.txt

You will see:

input message: "Deploy to production?"

What it means: Pipeline pauses until a human clicks Proceed.

Example 2: GitLab manual job

Type this:

printf '%s\n' 'deploy_prod:' '  stage: deploy' '  script: ["echo deploy"]' '  when: manual' '  only: [main]' > /tmp/gl-manual.yml && grep -n manual /tmp/gl-manual.yml

You will see:

4:  when: manual

What it means: Manual jobs show a play button in the GitLab UI.

Example 10: Order of stages

Type this:

printf '%s\n' 'test -> build -> approve -> deploy_prod'

You will see:

test -> build -> approve -> deploy_prod

What it means: Never put approve before tests.

Concept 1: Who may approve

Separation of duties.

Why: Author approving alone fails audits. What: submitter:false / approver lists. How: Protected environments.

Example 3: Environment protection idea

Type this:

printf '%s\n' 'production environment requires approvers list in the CI settings'

You will see:

production environment requires approvers list in the CI settings

What it means: Protected environments add a second gate.

Example 4: Who may approve

Type this:

printf '%s\n' 'submitter: false  # do not let the same person who pushed approve alone'

You will see:

submitter: false  # do not let the same person who pushed approve alone

What it means: Separation of duties — Capgemini audit ask.

Example 11: Two-person rule note

Type this:

printf '%s\n' 'ok: require two approvers for prod in bank projects'

You will see:

ok: require two approvers for prod in bank projects

What it means: Some clients require two clicks.

Concept 2: After the click

Deploy and record.

Why: Silent deploys leave no trail. What: Deploy steps + approver log. How: Notify channel; write audit line.

Example 5: Timeout so it does not hang forever

Type this:

printf '%s\n' 'options { timeout(time: 2, unit: "HOURS") }'

You will see:

options { timeout(time: 2, unit: "HOURS") }

What it means: Abandoned approvals should expire.

Example 6: Post-approve deploy echo

Type this:

printf '%s\n' 'echo DEPLOY_PROD_START' 'echo DEPLOY_PROD_DONE'

You will see:

echo DEPLOY_PROD_START
echo DEPLOY_PROD_DONE

What it means: Keep deploy steps after the gate, never before.

Example 7: Audit line

Type this:

printf '%s\n' 'Approved by: $APPROVER at $(date -u +%Y-%m-%dT%H:%MZ)'

You will see:

Approved by: $APPROVER at

What it means: Log who approved — Infosys change tickets expect this.

Concept 3: Abort and timeout

Abort is safe; hanging is not.

Why: Forgotten inputs block the queue. What: timeout + Abort path. How: Expire waits; keep stage auto.

Example 8: Reject path

Type this:

printf '%s\n' 'If Abort is clicked the pipeline stops and prod stays untouched'

You will see:

If Abort is clicked the pipeline stops and prod stays untouched

What it means: Abort is success for safety.

Example 9: Notify Slack-style message

Type this:

printf '%s\n' 'echo Notify: waiting for production approval on pipeline $BUILD_ID'

You will see:

echo Notify: waiting for production approval on pipeline $BUILD_ID

What it means: Tell the on-call channel while waiting.

Example 12: Dry run vs prod

Type this:

printf '%s\n' 'deploy_stage can be automatic; deploy_prod stays manual'

You will see:

deploy_stage can be automatic; deploy_prod stays manual

What it means: Stage auto, prod gated — common TCS pattern.

Approval card

1 Green tests 2 Manual input/when:manual 3 Protected environment 4 Deploy 5 Log approver

Suppose: Pipeline stuck on input

Timeout the stage; notify the channel.

Suppose: Same person pushes and approves

Turn on submitter:false / two-person rule.

Check yourself (quiz)

test → build → approve → deploy → verify. Did you understand? Let us try it once more.