Question

An enterprise owner wants organizations to be able to run actions authored within their own repositories, but only allow a specific set of third-party actions from the Marketplace (identified by their full owner/repo names). In the enterprise policy settings for GitHub Actions, which configuration achieves this?

Accepted Answer

Select 'Allow enterprise, and select non-enterprise, actions and reusable workflows' and add the specific third-party actions to the allow list

Answer

Select 'Allow all actions and reusable workflows' and rely on the organization-level allow list to filter the third-party actions

Answer

Select 'Allow enterprise actions and reusable workflows' only, then add the third-party actions as verified creators

Answer

Disable Actions at the enterprise level and re-enable it per organization with individual allow lists