← All keys & policies
Grant·repository
Environment required reviewer
Tier 2 · MediumData
Why Tier 2
Approving a deployment releases the environment's secrets to the job. On a production environment that is a Tier 1 decision.
A person or team who must approve a job before it can deploy to an environment such as production.
Available on: Free (public repositories only), Team (public repositories only), Enterprise Cloud, EMU, Server. Source
Attack path
The approval is what releases the environment's secrets to the job. A compromised reviewer, or a reviewer list that includes the person who wrote the change, turns the gate into a formality. On Free, Pro and Team plans required reviewers only work on public repositories.
Mitigations
- Turn on "Prevent self-review"
- Use a reviewer team separate from the authors
Detect
Alert on environment.update_protection_rule, environment.add_protection_rule, workflows.approve_workflow_job in the audit log.