Question

As an enterprise administrator, you must configure the enterprise-level Actions policy so that organizations can run actions authored by GitHub, actions created by verified creators from the Marketplace, and a short explicit list of specific third-party actions your security team has vetted. You do NOT want to permit arbitrary third-party actions. Which policy configuration meets these requirements?

Accepted Answer

Select 'Allow enterprise, and select non-enterprise, actions and reusable workflows', enable 'Allow actions created by GitHub' and 'Allow actions by Marketplace verified creators', and add the vetted actions to the allow list patterns.

Answer

Select 'Allow all actions and reusable workflows', then add each disallowed third-party action to a deny list of patterns.

Answer

Select 'Allow enterprise actions and reusable workflows only' and add the vetted third-party actions to the allow list patterns.

Answer

Disable Actions at the enterprise level and re-enable only the specific vetted actions in each organization's settings individually.