Release Approval
Use Facets release approval workflows to enforce governance: define structured approval processes so only reviewed, authorized changes reach production.
Release approval holds a release for manual review before it changes anything. You define the conditions that require approval, and Facets stops any matching release at a gate until an authorized approver acts on it.
How a Gated Release Moves
- Someone triggers a release on an environment.
- Facets evaluates the project's approval rule against the release: the target environment, the resources being changed, and the release stream.
- If nothing matches, the release proceeds normally. If the rule matches, the release stops at the gate with the status Pending Approval.
- An approver with authority on that environment chooses Approve or Reject.
- Approving lets the release continue and apply its changes. Rejecting terminates it, and Rejected is a terminal status.
The environment's release queue stays on hold for as long as the gate is open. One release parked at a gate stops every other release on that environment until someone approves it, rejects it, or aborts it. Held releases resume on their own once the gate clears.
Facets does not time out a release waiting at a gate. It keeps polling the release rather than force-failing it, so the release waits as long as it takes.
Permissions
Two separate permissions govern the two halves of the feature, at different scopes.
| Action | Scope | Permission required |
|---|---|---|
| Create or edit the approval rule | Blueprint (project) | STACK_WRITE |
| Remove the approval rule | Blueprint (project) | STACK_DELETE |
| Approve or reject a gated release | Environment | RELEASE_APPROVAL_AUTHORITY, plus access to that environment |
These are independent. Configuring a gate does not let you approve releases through it, and holding approval authority on an environment does not let you change the rule that created the gate.
Facets hides the Approve and Reject actions from users who lack RELEASE_APPROVAL_AUTHORITY on that environment. That is the usual reason an approver reports the actions are missing.
Related
- Parallel Release - How parallel releases behave on an environment
- Performing Releases - Triggering and tracking releases
- API Reference - Programmatic access to release and hook operations
Configuring Release Approval
Configure release approval for a Facets project using the no-code Builder or a custom pre-release hook script.
Approving and Rejecting Releases
Review, approve, reject, or abort a release that Facets is holding at a release approval gate in an environment's release history.
Pre-Release Hook Script Reference
The exit-code contract, release-context JSON schema, and working Python and Shell samples for hand-written Facets pre-release approval hooks.
Creating a Guardrail Policy
Step-by-step guide to creating a guardrail policy in Facets: set severity, scope it to blueprints and resources, and add Rego enforcement code.
Configuring Release Approval
Configure release approval for a Facets project using the no-code Builder or a custom pre-release hook script.