Approvegate adds release-approval checks to GitHub Actions and GitLab CI. It verifies that the approved commit is the one being deployed and can enforce freeze windows and separation of duties. Teams can start in shadow mode before turning on enforcement.