Skip to main content

Reviewing and approving

Sometimes a pipeline should not finish on its own. A review step pauses a workflow and waits for a person to approve or reject before anything downstream runs.

Adding a review step​

Add a Review node at the point where the decision belongs, and set To to the reviewer's email address. Optionally set a Subject so the email is recognisable.

Where you place it matters. The reviewer sees the data as it exists at that point in the pipeline, so put the node after the processing that informs the decision. Reviewing a raw upload before normalization and compliance checks have run asks someone to judge data the workflow has not finished preparing.

A typical placement:

… → Verify Licenses → Regulatory Compliance → Review → Generate PDF Report
                                                │
                                                └─ (failure path) → Send Email Report

Here the reviewer sees an SBOM that has been cleaned up and checked, and decides whether it is fit to be reported on.

Handling rejection​

A rejection takes the node's failure path, exactly as a failure would. Connect something to the bottom handle — an email to the submitter, a database write recording the outcome — so a rejection produces a result rather than just stopping.

With no failure path, a rejected run ends with the status rejected and nothing else happens.

What the reviewer does​

The reviewer does not need to know anything about the workflow. They receive an email containing the data under review and a secure one-time link.

Opening the link shows the review page: what is being reviewed, the file itself for download, and the two decisions.

  • Approve — the workflow continues along the success path.
  • Reject — the failure path is taken, or the run ends as rejected.

Either way the decision is recorded against the execution.

While a workflow waits​

An execution at a review step sits at pending approval, and the review node at awaiting approval. Nothing downstream runs. Other executions of the same workflow are unaffected — each run waits on its own review.