What's changed: New GH-200 Chapter 4 (governance = use policies disable/all/GitHub/verified/allow-list, require SHA pinning, reusable-component access settings, fork-PR approval, cascade; runners at scale = GitHub-hosted/self-hosted, runner groups, IP allow lists, preinstalled/toolcache/setup-*, troubleshooting; encrypted secrets & variables = org/repo/environment scope and precedence, secrets/vars, masking, REST API management)
4.1Governing Actions and Workflows
Understand how an enterprise/organization defines and manages reusable components and templates, controls which actions/workflows may run (allow/deny lists, allow only verified actions, required reviewers for unverified actions), and configures organizational use policies.
To run GitHub Actions safely at scale, an organization needs governance over "who can use which actions/workflows, and how." Settings cascade across the enterprise, organization, and repository levels; a restriction set higher (enterprise) flows down to lower levels (org, repo). GH-200 centers on use policies, access control, and managing reusable components.
4.1.1Action use policies
In Settings → Actions policies you choose the allowed scope of actions in tiers—disable all, allow all, allow only GitHub-authored actions, allow GitHub-authored + verified-creator actions, and an allow list of specific actions (with patterns like owner/*). Under least privilege, the safe approach is to permit only the needed actions via the allow list. You can also require pinning external actions to a commit SHA, raising supply-chain safety org-wide.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.