Require production deployment review
Require a designated reviewer before applying or deploying a production instance.
apiVersion: atmos/v1
kind: Policy
metadata:
name: github-production-approval
description: Require a designated reviewer before applying or deploying a production instance.
spec:
policies:
guard:
on: component.command
action: require_approval
rule: input.command in ['apply', 'deploy']
# Covers only instances labeled stage: prod. Replace with `stacks: [<exact stack>]` to select
# production by name instead.
match:
labels: {stage: prod}
approvals:
- id: platform
provider: github-actions
spec:
reviewers: [platform-maintainer]
minimum: 1
1 Configure
The policy covers instances labeled stage: prod, so it protects only what carries that label. A production stack without metadata.labels.stage: prod is not selected, and atmos helm deploy app -s prod then runs without approval. Require the label on every production instance, and review changes to it as you review the policy itself. To select production by an authoritative identifier instead, replace the label selector with exact stack names:
match:
stacks: [prod]
Replace platform-maintainer with your maintained GitHub user logins and set minimum. Requires a current PR checkout and GITHUB_TOKEN with pull-requests: read. Fixture evaluation returns an outstanding obligation; the Native CI adapter verifies live reviews separately. It does not verify organization teams.
2 Save
Save the CEL policy as policy.d/github-production-approval.yaml. Install only one implementation of each policy.
Atmos discovers policy.d/ at the project root selected by atmos.yaml discovery. Set ATMOS_POLICY_DIR to use another directory.
3 Run
atmos helm deploy app -s prod
Review required tools and callback settings before running. In CI, load policies from a protected, pinned revision. See enforcement configuration.
