Question

As an enterprise owner, you want organizations in your enterprise to be able to use actions and reusable workflows, but you must restrict them to only GitHub-authored actions plus a small set of trusted third-party publishers, while still permitting any workflow defined within a repository's own organization. In the enterprise policy settings, which combination of options achieves this?

Accepted Answer

Select 'Allow enterprise, and select non-enterprise, actions and reusable workflows', then enable 'Allow actions created by GitHub' and add the trusted publishers to the allow list; local (same-org) workflows are permitted automatically.

Answer

Select 'Allow all actions and reusable workflows' and rely on each organization to configure its own deny list for untrusted publishers.

Answer

Select 'Allow enterprise actions and reusable workflows only', which blocks all GitHub-authored and third-party actions but keeps local workflows working.

Answer

Disable Actions at the enterprise level and re-enable individual trusted actions per repository using repository-level allow lists.