# Explain why an approved GitLab deployment may still be waiting to run

> Approval satisfies the release gate; the deployment job still requires a separate start.

- Canonical URL: https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:42+00:00
- Modified: 2026-10-15T13:36:17+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Approval satisfies the release gate; the deployment job still requires a separate start.

## Potentially affected

This concerns GitLab deployment approvals on supported Premium or Ultimate environments. Pipeline status, environment protection, approval eligibility, and permission to execute the job are related but separate checks.

## DSE recommendation

DSE recommends making the release procedure explicit about who approves and who starts the reviewed deployment.

## Article

Approval satisfies the release gate; the deployment job still requires a separate start.

## Source facts

GitLab deployment approvals block jobs targeting protected environments until the required approvals are granted. The deployment job does not have to be configured as a manual job for the approval gate to apply. After approval, however, the documentation requires an operator to run the job manually; approval alone does not start it. A person can provide only one approval per deployment even when they belong to several approver groups. By default, the user who triggered the pipeline cannot approve that deployment.

Source: [GitLab — Deployment approvals](https://docs.gitlab.com/ci/environments/deployment_approvals/).

## Applicability

This concerns GitLab deployment approvals on supported Premium or Ultimate environments. Pipeline status, environment protection, approval eligibility, and permission to execute the job are related but separate checks.

## DSE recommendation

DSE recommends making the release procedure explicit about who approves and who starts the reviewed deployment. Present a release record that identifies the pipeline, commit, environment, required approvals, and final execution step. Avoid repeatedly creating pipelines when the existing job is simply waiting for its authorized start. Review overlapping approver-group membership so the requested approval count can actually be satisfied. Keep self-approval settings deliberate, and revisit approval rules promptly when staff move or their access changes.

## Verification

In a test protected environment, observe the blocked job before approval and its state after approval. Confirm that it runs only after the intended operator starts it. Use overlapping test group memberships to verify the one-approval-per-person behavior and record the resulting approval history.

## Official reference

[GitLab — Deployment approvals](https://docs.gitlab.com/ci/environments/deployment_approvals/). Reviewed October 15, 2026.

## Primary reference

- Name: GitLab — Deployment approvals
- Authority: docs.gitlab.com
- URL: https://docs.gitlab.com/ci/environments/deployment_approvals/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Explain why an approved GitLab deployment may still be waiting to run,” DSE Security, https://update.dsesecurity.com/updates/gitlab-deployment-approval-manual-job-start/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.