GitHub
Releases
Security & compliance
Production deploy job without environment protection
Part of the Release & branch safety check · fix arrives as a guide
What it is
A workflow job deploys to production without being tied to a GitHub Environment carrying protection rules.
Why it matters
Anyone able to trigger the workflow can deploy, and there is no approval gate or audit trail beyond the run log. Production secrets are also scoped to the job rather than to an environment you can restrict.
How to fix it
Create a production environment with required reviewers and a deployment branch restriction, scope the production secrets to it, and set environment: production on the deploy job.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.