Skip to main content
This guide shows how to review GitHub Advanced Security (GHAS) and GitHub Actions usage across an enterprise, and provides a small REST-API script to estimate Actions adoption. It is aimed at enterprise owners and administrators who need visibility into security coverage and automation usage.

Overview: Security and quality (GHAS)

From your enterprise account, open the “Security and quality” tab to get a high-level summary of GHAS activity. The overview page highlights alert trends and organization-wide insights such as detection rates, remediations, and prevention metrics. Scrolling down to the Detections section surfaces key operational data: average age of open alerts, secrets bypassed, top repositories with open alerts, and severity distribution.
A dark-themed GitHub security overview dashboard showing a graph of alerts over time and summary cards (Age of alerts: 4 days, Reopened alerts: 0, Secrets bypassed: 1). Below is a table listing repositories with their open alerts and severity counts.
This view helps you find common issues quickly — for example, workflows missing permissions, rate limiting problems, or alerts that map to specific CWEs with varying severities.

Repository-level code scanning and secret alerts

Click any repository from the enterprise view to open its repository security pages. There you can review code scanning findings (e.g., CodeQL results), secret scanning alerts, and remediation guidance. The repository view consolidates issues and provides direct links to the affected files.
A dark-themed GitHub "Security and quality" -> "Code scanning" screen for a repository, showing a list of code scanning alerts. The findings include issues like "Uncontrolled data used in path expression," "Missing rate limiting," and several "Workflow does not contain permissions" items with severity tags.

Security coverage across repositories

The Coverage tab summarizes adoption of the three primary GHAS features: Dependabot, code scanning (CodeQL), and secret scanning. It lists repositories and which features are enabled (for example: alerts, pull request alerts, push protection, and Dependabot security updates).
A dark-themed GitHub Enterprise "Security coverage" dashboard showing Dependabot, code scanning, and secret scanning metrics with progress bars at 100% and a list of repositories and their enabled security features.
Important: “Enabled” at the enterprise level does not guarantee all related sub-features are active for every repo (e.g., Dependabot security updates may only be enabled for a subset). Use repository search qualifiers to filter and find specific configuration states. Repository search qualifiers (examples)

GitHub Actions usage metrics (Insights)

To see Actions usage across the enterprise, open the Insights tab and select “Actions usage metrics.” This dashboard reports totals such as minutes used and job runs, and lets you drill down by workflow, repository, runner type, and runtime OS (Linux, Windows, macOS). Use filters to narrow the view to organizations, repositories, runner types (hosted vs. self-hosted), and runtime OS.
A dark-themed screenshot of a GitHub Enterprise "Actions Usage Metrics" dashboard showing totals (78 total minutes and 55 total job runs) and a table listing workflow names, source repositories, total minutes, runner types and runtime OS. The left sidebar shows other Insights options like Copilot impact and Actions performance metrics.
Key performance metrics to monitor:
  • Job failure percentage — identifies flaky workflows.
  • Average runtime — signals slow-running jobs.
  • Average queue time — indicates runner capacity issues.
  • Failed job usage — shows wasted minutes from failed runs.
Actions usage dashboard: common filters

Automating an estimate of Actions adoption (REST API)

If you prefer automation over manual inspection, you can use the GitHub REST API to approximate Actions adoption. A common heuristic is to check whether each repository contains the .github/workflows directory. This does not guarantee full adoption (workflows can live elsewhere or projects may use alternate CI), but it gives a quick indication.
Do not hardcode personal access tokens (PATs) in scripts. Use an environment variable (for example, GH_TOKEN) and limit the token scope to only what’s needed. Keep tokens secret.
Tip: the script below uses jq to parse JSON responses. Ensure jq is installed on the machine where you run the script. Example: Bash script to estimate Actions adoption
  • What it does:
    1. Reads the organization and token from environment variables.
    2. Lists up to 100 repositories for the org.
    3. Checks each repo for .github/workflows (HTTP 200 indicates presence).
    4. Prints per-repo status and a final adoption percentage.
Save as github_actions_adoption_script.sh and export GH_ORG and GH_TOKEN before running.
Running the script
Sample console output:

Notes, limitations, and next steps

  • Heuristic limitations: The .github/workflows directory check is a quick heuristic. Repositories may store workflows elsewhere, use external CI, or have workflows that never run.
  • Pagination: If your enterprise/org has more than 100 repositories, implement pagination by iterating ?page=<n>&per_page=100.
  • Deeper adoption checks: To measure GHAS feature adoption (CodeQL, secret scanning, Dependabot), query repository settings or dedicated API endpoints to validate whether features are enabled, licensed, and configured.
  • Improve accuracy: Extend the script to:
    • Inspect workflow YAML files to ensure active workflows.
    • Query Actions usage API endpoints for actual job run metrics.
    • Aggregate usage across multiple orgs in an enterprise by iterating enterprise org lists.
Links and references

Summary

This lesson covered how to use GHAS security dashboards and Actions usage Insights to assess security posture and runner usage. It also provided a practical REST-API-based script that approximates Actions adoption across an organization. Use the UI for rapid exploration and the script for automated, repeatable checks; combine both for comprehensive monitoring.

Watch Video