Question

As an organization owner, you want to restrict which GitHub Actions can run across all repositories in your organization. Company policy requires that only actions authored by GitHub, a small set of specified third-party actions (referenced by exact owner/repo), and any actions defined within your own organization's repositories be permitted. Which Actions policy configuration in the organization settings satisfies this requirement with the least ongoing maintenance?

Accepted Answer

Select 'Allow enterprise, and select non-enterprise, actions and reusable workflows', enable 'Allow actions created by GitHub', and add the specific third-party actions using the 'owner/repo@ref' allow list syntax

Answer

Select 'Allow enterprise, and select non-enterprise, actions and reusable workflows', enable 'Allow actions created by GitHub', enable 'Allow actions by Marketplace verified creators', and add the specific third-party actions to the allow list

Answer

Select 'Allow all actions and reusable workflows' and rely on branch protection to block unwanted actions

Answer

Disable Actions entirely for the organization and require developers to run all workflows on self-hosted runners with custom scripts