Question

An enterprise owner notices that a compromised third-party action in one repository was able to push commits and create releases using the automatically generated GITHUB_TOKEN. They want to reduce the blast radius of the default token across all organizations without breaking existing workflows that explicitly request the permissions they need. Which enterprise-level setting should they configure?

Accepted Answer

Set the default GITHUB_TOKEN permissions for the enterprise to 'Read repository contents and packages permissions' (restricted), allowing workflows to elevate scopes via the permissions key as needed

Answer

Disable GitHub Actions entirely for all organizations until each third-party action is manually reviewed

Answer

Require that all workflows store a fine-grained PAT as an organization secret and use it instead of GITHUB_TOKEN

Answer

Enable an IP allow list so that only approved networks can trigger workflow runs