Prerequisites
Nota:
Las reglas de protección de implementación personalizadas se encuentran actualmente en versión preliminar pública y están sujetas a cambios.
For general information about deployment protection rules, see Deploying with GitHub Actions.
Creating a custom deployment protection rule with GitHub Apps
-
Create a GitHub App. For more information, see Registro de una instancia de GitHub App. Configure the GitHub App as follows.
- Optionally, in the Callback URL text field under "Identifying and authorizing users," enter the callback URL. For more information, see Acerca de la dirección URL de devolución de llamada de autorización de usuario.
- Under "Permissions," select Repository permissions.
- To the right of "Actions," click the drop down menu and select Access: Read-only.
- To the right of "Deployments," click the drop down menu and select Access: Read and write.
- Under "Subscribe to events," select Deployment protection rule.
-
Install the custom deployment protection rule in your repositories and enable it for use. For more information, see Configuring custom deployment protection rules.
Approving or rejecting deployments
Once a workflow reaches a job that references an environment that has the custom deployment protection rule enabled, GitHub sends a POST
request to a URL you configure containing the deployment_protection_rule
payload. You can write your deployment protection rule to automatically send REST API requests that approve or reject the deployment based on the deployment_protection_rule
payload. Configure your REST API requests as follows.
-
Validate the incoming
POST
request. For more information, see Validación de entregas de webhook. -
Use a JSON Web Token to authenticate as a GitHub App. For more information, see Autenticarse como una GitHub App.
-
Using the installation ID from the
deployment_protection_rule
webhook payload, generate an install token. For more information, see Acerca de la autenticación con una aplicación de GitHub.curl --request POST \ --url "http(s)://HOSTNAME/api/v3/app/installations/INSTALLATION_ID/ACCESS_TOKENS" \ --header "Accept: application/vnd.github+json" \ --header "Authorization: Bearer {jwt}" \ --header "Content-Type: application/json" \ --data \ '{ \ "repository_ids": [321], \ "permissions": { \ "deployments": "write" \ } \ }'
-
Optionally, to add a status report without taking any other action to GitHub, send a
POST
request to/repos/OWNER/REPO/actions/runs/RUN_ID/deployment_protection_rule
. In the request body, omit thestate
. For more information, see Puntos de conexión de API de REST para ejecuciones de flujo de trabajo. You can post a status report on the same deployment up to 10 times. Status reports support Markdown formatting and can be up to 1024 characters long. -
To approve or reject a request, send a
POST
request to/repos/OWNER/REPO/actions/runs/RUN_ID/deployment_protection_rule
. In the request body, set thestate
property to eitherapproved
orrejected
. For more information, see Puntos de conexión de API de REST para ejecuciones de flujo de trabajo. -
Optionally, request the status of an approval for a workflow run by sending a
GET
request to/repos/OWNER/REPOSITORY_ID/actions/runs/RUN_ID/approvals
. For more information, see Puntos de conexión de API de REST para ejecuciones de flujo de trabajo. -
Optionally, review the deployment on GitHub. For more information, see Reviewing deployments.