> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo GHAS and Actions Usage Metrics

> Guide for enterprise admins to review GitHub Advanced Security and Actions usage, dashboards, metrics, and a REST API script to estimate Actions adoption

This guide shows how to review GitHub Advanced Security (GHAS) and GitHub Actions usage across an enterprise, and provides a small REST-API script to estimate Actions adoption. It is aimed at enterprise owners and administrators who need visibility into security coverage and automation usage.

## Overview: Security and quality (GHAS)

From your enterprise account, open the "Security and quality" tab to get a high-level summary of GHAS activity. The overview page highlights alert trends and organization-wide insights such as detection rates, remediations, and prevention metrics. Scrolling down to the Detections section surfaces key operational data: average age of open alerts, secrets bypassed, top repositories with open alerts, and severity distribution.

![A dark-themed GitHub security overview dashboard showing a graph of alerts over time and summary cards (Age of alerts: 4 days, Reopened alerts: 0, Secrets bypassed: 1). Below is a table listing repositories with their open alerts and severity counts.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-GHAS-and-Actions-Usage-Metrics/github-security-dashboard-alerts-summary-table.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=8db9ddfa2325641c0cdcce4165a0fabc)

This view helps you find common issues quickly — for example, workflows missing permissions, rate limiting problems, or alerts that map to specific CWEs with varying severities.

## Repository-level code scanning and secret alerts

Click any repository from the enterprise view to open its repository security pages. There you can review code scanning findings (e.g., CodeQL results), secret scanning alerts, and remediation guidance. The repository view consolidates issues and provides direct links to the affected files.

![A dark-themed GitHub "Security and quality" -> "Code scanning" screen for a repository, showing a list of code scanning alerts. The findings include issues like "Uncontrolled data used in path expression," "Missing rate limiting," and several "Workflow does not contain permissions" items with severity tags.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-GHAS-and-Actions-Usage-Metrics/github-code-scanning-alerts-workflow-permissions.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=b7a43375f586ce9de96d45e5f3477e1f)

## Security coverage across repositories

The Coverage tab summarizes adoption of the three primary GHAS features: Dependabot, code scanning (CodeQL), and secret scanning. It lists repositories and which features are enabled (for example: alerts, pull request alerts, push protection, and Dependabot security updates).

![A dark-themed GitHub Enterprise "Security coverage" dashboard showing Dependabot, code scanning, and secret scanning metrics with progress bars at 100% and a list of repositories and their enabled security features.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-GHAS-and-Actions-Usage-Metrics/github-enterprise-security-coverage-dashboard.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=e9560fc13f6558f2428ae02bb42d6d15)

Important: “Enabled” at the enterprise level does not guarantee all related sub-features are active for every repo (e.g., Dependabot security updates may only be enabled for a subset). Use repository search qualifiers to filter and find specific configuration states.

Repository search qualifiers (examples)

| Qualifier | Purpose |
| -: | - |
| `archived:false dependabot-security-updates:not-enabled` | Find repositories where Dependabot security updates are not enabled |
| `archived:false dependabot-security-updates:enabled` | Show repositories where Dependabot security updates are enabled |

## GitHub Actions usage metrics (Insights)

To see Actions usage across the enterprise, open the Insights tab and select "Actions usage metrics." This dashboard reports totals such as minutes used and job runs, and lets you drill down by workflow, repository, runner type, and runtime OS (Linux, Windows, macOS). Use filters to narrow the view to organizations, repositories, runner types (hosted vs. self-hosted), and runtime OS.

![A dark-themed screenshot of a GitHub Enterprise "Actions Usage Metrics" dashboard showing totals (78 total minutes and 55 total job runs) and a table listing workflow names, source repositories, total minutes, runner types and runtime OS. The left sidebar shows other Insights options like Copilot impact and Actions performance metrics.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Monitoring-and-Optimization/Demo-GHAS-and-Actions-Usage-Metrics/github-enterprise-actions-usage-metrics.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=b83788d0339c1c60543f2e4e341b7442)

Key performance metrics to monitor:

* Job failure percentage — identifies flaky workflows.
* Average runtime — signals slow-running jobs.
* Average queue time — indicates runner capacity issues.
* Failed job usage — shows wasted minutes from failed runs.

Actions usage dashboard: common filters

| Filter | Use case |
| - | - |
| Organization | Aggregate usage by org |
| Repository | Investigate specific repo usage |
| Runner type | Compare hosted vs. self-hosted runners |
| Runtime OS | Identify OS-specific runtime trends |

## Automating an estimate of Actions adoption (REST API)

If you prefer automation over manual inspection, you can use the GitHub REST API to approximate Actions adoption. A common heuristic is to check whether each repository contains the `.github/workflows` directory. This does not guarantee full adoption (workflows can live elsewhere or projects may use alternate CI), but it gives a quick indication.

Do not hardcode personal access tokens (PATs) in scripts. Use an environment variable (for example, `GH_TOKEN`) and limit the token scope to only what's needed. Keep tokens secret.

Tip: the script below uses `jq` to parse JSON responses. Ensure `jq` is installed on the machine where you run the script.

Example: Bash script to estimate Actions adoption

* What it does:
  1. Reads the organization and token from environment variables.
  2. Lists up to 100 repositories for the org.
  3. Checks each repo for `.github/workflows` (HTTP 200 indicates presence).
  4. Prints per-repo status and a final adoption percentage.

Save as `github_actions_adoption_script.sh` and export `GH_ORG` and `GH_TOKEN` before running.

```bash theme={null}
#!/usr/bin/env bash
# github_actions_adoption_script.sh
set -euo pipefail

# Configuration: set these in your environment before running the script:
# export GH_ORG="game-devstudio"
# export GH_TOKEN="ghp_xxxREDACTED"
# Note: This script requires 'jq' to parse JSON responses.
ORG="${GH_ORG:-game-devstudio}"
TOKEN="${GH_TOKEN:-}"

if [ -z "$TOKEN" ]; then
  echo "Error: GH_TOKEN is not set. Export GH_TOKEN before running the script."
  exit 1
fi

TOTAL=0
ADOPTED=0

# 1. Fetch the list of repositories (up to 100)
repos=$(curl -s -H "Authorization: token $TOKEN" \
  "https://api.github.com/orgs/$ORG/repos?per_page=100" | jq -r '.[].name')

# 2. Loop through each repository
for repo in $repos; do
  TOTAL=$((TOTAL + 1))

  # 3. Check if the .github/workflows directory exists
  status=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Authorization: token $TOKEN" \
    "https://api.github.com/repos/$ORG/$repo/contents/.github/workflows")

  if [ "$status" = "200" ]; then
    ADOPTED=$((ADOPTED + 1))
    echo "[✓] $repo: Actions Adopted"
  else
    echo "[ ] $repo: No Workflows Found"
  fi
done

# 4. Calculate the percentage safely (prevent division by zero)
if [ "$TOTAL" -gt 0 ]; then
  PERCENT=$(( ADOPTED * 100 / TOTAL ))
else
  PERCENT=0
fi

# 5. Output the final summary
echo "Actions adoption: $ADOPTED / $TOTAL repos (${PERCENT}%)"
```

Running the script

```bash theme={null}
export GH_ORG="game-devstudio"
export GH_TOKEN="ghp_xxxREDACTED"
bash github_actions_adoption_script.sh
```

Sample console output:

```bash theme={null}
[✓] gh-actions: Actions Adopted
[ ] app-backend: No Workflows Found
[✓] ghas-guardrail-demo: Actions Adopted
[✓] .github: Actions Adopted
[ ] test-repo-2: No Workflows Found
Actions adoption: 3 / 5 repos (60%)
```

## Notes, limitations, and next steps

* Heuristic limitations: The `.github/workflows` directory check is a quick heuristic. Repositories may store workflows elsewhere, use external CI, or have workflows that never run.
* Pagination: If your enterprise/org has more than 100 repositories, implement pagination by iterating `?page=<n>&per_page=100`.
* Deeper adoption checks: To measure GHAS feature adoption (CodeQL, secret scanning, Dependabot), query repository settings or dedicated API endpoints to validate whether features are enabled, licensed, and configured.
* Improve accuracy: Extend the script to:
  * Inspect workflow YAML files to ensure active workflows.
  * Query Actions usage API endpoints for actual job run metrics.
  * Aggregate usage across multiple orgs in an enterprise by iterating enterprise org lists.

Links and references

* GitHub Advanced Security (GHAS) docs: [https://docs.github.com/en/code-security](https://docs.github.com/en/code-security)
* GitHub Actions metrics and Insights: [https://docs.github.com/en/organizations/monitoring-your-organizations-health/about-organization-insights](https://docs.github.com/en/organizations/monitoring-your-organizations-health/about-organization-insights)
* REST API: Repositories endpoints — [https://docs.github.com/en/rest/repos/repos#list-organization-repositories](https://docs.github.com/en/rest/repos/repos#list-organization-repositories)
* REST API: Contents endpoints — [https://docs.github.com/en/rest/repos/contents#get-repository-content](https://docs.github.com/en/rest/repos/contents#get-repository-content)

## Summary

This lesson covered how to use GHAS security dashboards and Actions usage Insights to assess security posture and runner usage. It also provided a practical REST-API-based script that approximates Actions adoption across an organization. Use the UI for rapid exploration and the script for automated, repeatable checks; combine both for comprehensive monitoring.

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/ddb3d739-d57f-4374-b851-69bb14cbeb8b/lesson/38797a9b-de2b-4cbb-815c-24bdc0ad546e)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.