Skip to main content
Learn how to enforce organization-wide policies for GitHub Actions to secure your CI/CD pipelines. Using the solar-system repository as an example, you’ll see how to restrict which actions can run, preventing unapproved third-party code from executing.

Types of Actions in Your Workflows

  • Official GitHub Actions (e.g., actions/checkout, actions/setup-node)
  • Custom Composite Actions (e.g., ./github/custom-actions/npm-action)
  • Verified Marketplace Actions (e.g., Docker, Azure)
  • Community Actions (e.g., jakejarvis/s3-sync-action@master)

Example Workflow: NodeJS CI

Below is an excerpt from .github/workflows/nodejs-ci.yml showcasing various action types:
If you enable strict policies without allowing required actions, existing workflows will fail. Always test policy changes on a non-production branch first.
The image shows the GitHub Actions settings page for an organization, where permissions for actions and workflows are being configured. Various options for allowing actions and workflows are displayed, with one option selected.

Configuring Organization-Level Policies

  1. Navigate to OrganizationSettingsActionsGeneral.
  2. Under Repository access, select Allow actions and reusable workflows selected repositories, then add solar-system.
  3. Choose a Workflow permissions option:
  4. To restrict to official GitHub actions, select Allow actions created by GitHub.
  5. Click Save.

Testing Your Policy

In solar-system repository:
  1. Open the Actions tab.
  2. Choose Solar System Workflow.
  3. Click Run workflow.
The run will fail at startup if unapproved actions are blocked:
The image shows a GitHub Actions page for a repository named "solar-system," displaying a "Solar System Workflow" with a startup failure status.
The image shows a GitHub Actions workflow page with a "Startup failure" status and an error message indicating that certain actions are not allowed to be used in the specified repository.

Allowing Verified & Specific Community Actions

To include verified Marketplace actions (Azure, Docker) without approving all third-party code:
  1. Go back to OrganizationSettingsActionsGeneral.
  2. Under Workflow permissions, select Allow actions from GitHub, local Enterprise, and GitHub Marketplace (verified creators).
  3. Click Save and rerun the workflow.
Community actions still blocked? Add them explicitly under Custom policy:
Save your changes and retry. Any remaining disallowed actions will be reported:
The image shows a GitHub settings page for an organization, focusing on configuring general actions permissions. It includes options for allowing specific actions and reusable workflows within selected repositories.

Summary

By enforcing organization-level use policies for GitHub Actions, you can:
  • Restrict workflows to approved actions
  • Mitigate risks from untrusted third-party code
  • Maintain consistent, secure CI/CD practices across all repositories

Watch Video