A human approves the run before anything reaches a public registry
A registry publish cannot be undone. An approval gate is the last point where a compromised tag, a wrong version, or a bad artifact can be stopped.
Observable check
before public availability, a person other than an automation account must approve through a GitHub environment with required reviewers, a GitLab protected environment with a blocking manual job or deployment approval rules, or a registry proof-of-presence gate such as npm staged publishing with 2FA approval. Verify the configured gate through the forge or registry API. If the repository visibility or forge plan does not provide a native gate and the registry has no equivalent, report the rule as unmet rather than substituting an unverified approval action.
Where this comes from
- https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments
- https://docs.gitlab.com/ci/environments/deployment_approvals/
- https://docs.gitlab.com/ci/environments/protected_environments/
- https://docs.gitlab.com/ci/jobs/job_control/
- https://docs.npmjs.com/staged-publishing/
Last read against these sources on 2026-08-07.
GitHub confirms that required reviewers gate a job and that Prevent self-review is a separate setting. GitLab supports two native gates. A protected environment can restrict who runs a blocking manual deployment job. Deployment approval rules block the deployment, but an approved job still needs a separate manual start. npm staged publishing keeps a package unavailable until a person approves its stage with 2FA. Each stage has its own stage ID and approval command, so a release flow with several packages needs several npm approvals. R-PUB-04 requires at least one verified gate. Extra gates remain valid.