Make the pipeline the sole holder of deploy credentials, protect production environments with required reviewers and branch limits, and require status checks before merge. People bypass pipelines when a faster path exists, so remove the faster path and make the official one pleasant.
Where bypasses come from
| Bypass | Fix |
|---|---|
| Developers hold production credentials | Move credentials into the pipeline, use short lived federated tokens |
| Deploy from a laptop | Revoke direct access, use break glass with audit |
| Copied workflow with scans removed | Require the shared workflow and review workflow file changes |
| Unprotected default branch | Rulesets requiring PRs and checks |
| Admin override | Limit bypass list, log every use |
| Disabled or renamed check | Required check by name and source |
Protected environments
GitHub environments let you attach protection rules. According to the documentation, you can require up to six reviewers (one approval is enough), enable prevent self-review, add a wait timer, limit deployment branches and tags, and add custom protection rules via GitHub Apps. You can also turn off administrator bypass. Environment secrets are available to a job only after its rules pass.
Two caveats from the docs: a workflow referencing a nonexistent environment creates it with no protection or secrets, and on some plans environments for private repositories have limited features. Verify your plan.
Steps to close the gaps
- List who can deploy to production today, by credential and by role.
- Move deploy credentials into environment secrets or federated identity.
- Add required reviewers and branch limits to the production environment.
- Turn off admin bypass where the plan allows.
- Add a ruleset that requires the scan check on the default branch.
- Alert on deployments that did not come from the pipeline, using cloud audit logs.
Keep an emergency route
Real incidents need a fast path. Define break glass: a named role, time limited access, mandatory ticket, and review within a day. See break glass workflow design. If the emergency route is easy and audited, people do not invent their own.
Make the golden path the easy path
If teams bypass because the pipeline is slow or confusing, fix that. Measure bypass causes and publish what you changed. Tools like time budgets help.
Quick check
Can environment protection stop a malicious workflow edit?
It limits deployment and secrets access until rules pass, but review of workflow file changes is also needed, for example with CODEOWNERS.
How do we detect out of band deploys?
Compare cloud audit log deploy events with pipeline run records and alert on mismatches.
Safeguard gates and guardrails can enforce policy at the pull request and release stages, and asset discovery helps find services that run outside the pipeline.
Sources
- GitHub Docs: Managing environments for deployment, fetched 19 October 2026
Last reviewed: 19 October 2026.
