{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/gitlab-deployment-approval-manual-job-start/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/",
        "slug": "gitlab-deployment-approval-manual-job-start",
        "url": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/gitlab-deployment-approval-manual-job-start/"
        },
        "title": "Explain why an approved GitLab deployment may still be waiting to run",
        "summary": "Approval satisfies the release gate; the deployment job still requires a separate start.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:42+00:00",
        "modified_at": "2026-10-15T13:36:17+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 258,
        "potentially_affected": "This concerns GitLab deployment approvals on supported Premium or Ultimate environments. Pipeline status, environment protection, approval eligibility, and permission to execute the job are related but separate checks.",
        "dse_recommendation": "DSE recommends making the release procedure explicit about who approves and who starts the reviewed deployment.",
        "primary_source": {
            "name": "GitLab — Deployment approvals",
            "url": "https://docs.gitlab.com/ci/environments/deployment_approvals/",
            "published_on": null,
            "authority": "docs.gitlab.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Approval satisfies the release gate; the deployment job still requires a separate start.</p>\n<h2>Source facts</h2>\n<p>GitLab deployment approvals block jobs targeting protected environments until the required approvals are granted. The deployment job does not have to be configured as a manual job for the approval gate to apply. After approval, however, the documentation requires an operator to run the job manually; approval alone does not start it. A person can provide only one approval per deployment even when they belong to several approver groups. By default, the user who triggered the pipeline cannot approve that deployment.</p>\n<p>Source: <a href=\"https://docs.gitlab.com/ci/environments/deployment_approvals/\">GitLab — Deployment approvals</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns GitLab deployment approvals on supported Premium or Ultimate environments. Pipeline status, environment protection, approval eligibility, and permission to execute the job are related but separate checks.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends making the release procedure explicit about who approves and who starts the reviewed deployment. Present a release record that identifies the pipeline, commit, environment, required approvals, and final execution step. Avoid repeatedly creating pipelines when the existing job is simply waiting for its authorized start. Review overlapping approver-group membership so the requested approval count can actually be satisfied. Keep self-approval settings deliberate, and revisit approval rules promptly when staff move or their access changes.</p>\n<h2>Verification</h2>\n<p>In a test protected environment, observe the blocked job before approval and its state after approval. Confirm that it runs only after the intended operator starts it. Use overlapping test group memberships to verify the one-approval-per-person behavior and record the resulting approval history.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.gitlab.com/ci/environments/deployment_approvals/\">GitLab — Deployment approvals</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Approval satisfies the release gate; the deployment job still requires a separate start.\nSource facts\nGitLab deployment approvals block jobs targeting protected environments until the required approvals are granted. The deployment job does not have to be configured as a manual job for the approval gate to apply. After approval, however, the documentation requires an operator to run the job manually; approval alone does not start it. A person can provide only one approval per deployment even when they belong to several approver groups. By default, the user who triggered the pipeline cannot approve that deployment.\nSource: GitLab — Deployment approvals.\nApplicability\nThis concerns GitLab deployment approvals on supported Premium or Ultimate environments. Pipeline status, environment protection, approval eligibility, and permission to execute the job are related but separate checks.\nDSE recommendation\nDSE recommends making the release procedure explicit about who approves and who starts the reviewed deployment. Present a release record that identifies the pipeline, commit, environment, required approvals, and final execution step. Avoid repeatedly creating pipelines when the existing job is simply waiting for its authorized start. Review overlapping approver-group membership so the requested approval count can actually be satisfied. Keep self-approval settings deliberate, and revisit approval rules promptly when staff move or their access changes.\nVerification\nIn a test protected environment, observe the blocked job before approval and its state after approval. Confirm that it runs only after the intended operator starts it. Use overlapping test group memberships to verify the one-approval-per-person behavior and record the resulting approval history.\nOfficial reference\nGitLab — Deployment approvals. Reviewed October 15, 2026.",
        "content_markdown": "Approval satisfies the release gate; the deployment job still requires a separate start.\n\n## Source facts\n\nGitLab deployment approvals block jobs targeting protected environments until the required approvals are granted. The deployment job does not have to be configured as a manual job for the approval gate to apply. After approval, however, the documentation requires an operator to run the job manually; approval alone does not start it. A person can provide only one approval per deployment even when they belong to several approver groups. By default, the user who triggered the pipeline cannot approve that deployment.\n\nSource: [GitLab — Deployment approvals](https://docs.gitlab.com/ci/environments/deployment_approvals/).\n\n## Applicability\n\nThis concerns GitLab deployment approvals on supported Premium or Ultimate environments. Pipeline status, environment protection, approval eligibility, and permission to execute the job are related but separate checks.\n\n## DSE recommendation\n\nDSE recommends making the release procedure explicit about who approves and who starts the reviewed deployment. Present a release record that identifies the pipeline, commit, environment, required approvals, and final execution step. Avoid repeatedly creating pipelines when the existing job is simply waiting for its authorized start. Review overlapping approver-group membership so the requested approval count can actually be satisfied. Keep self-approval settings deliberate, and revisit approval rules promptly when staff move or their access changes.\n\n## Verification\n\nIn a test protected environment, observe the blocked job before approval and its state after approval. Confirm that it runs only after the intended operator starts it. Use overlapping test group memberships to verify the one-approval-per-person behavior and record the resulting approval history.\n\n## Official reference\n\n[GitLab — Deployment approvals](https://docs.gitlab.com/ci/environments/deployment_approvals/). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/",
                "url": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Explain why an approved GitLab deployment may still be waiting to run",
                        "item": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/#article",
                "identifier": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/",
                "url": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/",
                "headline": "Explain why an approved GitLab deployment may still be waiting to run",
                "description": "Approval satisfies the release gate; the deployment job still requires a separate start.",
                "abstract": "Approval satisfies the release gate; the deployment job still requires a separate start.",
                "articleBody": "Approval satisfies the release gate; the deployment job still requires a separate start.\nSource facts\nGitLab deployment approvals block jobs targeting protected environments until the required approvals are granted. The deployment job does not have to be configured as a manual job for the approval gate to apply. After approval, however, the documentation requires an operator to run the job manually; approval alone does not start it. A person can provide only one approval per deployment even when they belong to several approver groups. By default, the user who triggered the pipeline cannot approve that deployment.\nSource: GitLab — Deployment approvals.\nApplicability\nThis concerns GitLab deployment approvals on supported Premium or Ultimate environments. Pipeline status, environment protection, approval eligibility, and permission to execute the job are related but separate checks.\nDSE recommendation\nDSE recommends making the release procedure explicit about who approves and who starts the reviewed deployment. Present a release record that identifies the pipeline, commit, environment, required approvals, and final execution step. Avoid repeatedly creating pipelines when the existing job is simply waiting for its authorized start. Review overlapping approver-group membership so the requested approval count can actually be satisfied. Keep self-approval settings deliberate, and revisit approval rules promptly when staff move or their access changes.\nVerification\nIn a test protected environment, observe the blocked job before approval and its state after approval. Confirm that it runs only after the intended operator starts it. Use overlapping test group memberships to verify the one-approval-per-person behavior and record the resulting approval history.\nOfficial reference\nGitLab — Deployment approvals. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:42+00:00",
                "dateModified": "2026-10-15T13:36:17+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Explain why an approved GitLab deployment may still be waiting to run"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 258,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitLab — Deployment approvals",
                    "url": "https://docs.gitlab.com/ci/environments/deployment_approvals/"
                }
            }
        ]
    }
}