Question

You administer a GitHub organization. Security policy requires that workflows may run actions authored by your own organization, actions created by GitHub, and a specific set of vetted third-party actions from the Marketplace. All other third-party actions must be blocked. In the organization's Actions settings under 'Policies', which configuration correctly enforces this requirement?

Accepted Answer

Select 'Allow , and select non-, actions and reusable workflows' (the owner-scoped policy at the organization level), enable 'Allow actions created by GitHub', and add the vetted actions to the 'Allow specified actions and reusable workflows' list using owner/repo@ref patterns.

Answer

Select 'Allow all actions and reusable workflows', then rely on branch protection rules to reject any workflow that references an unapproved action.

Answer

Select 'Disable actions' for the organization, then re-enable Actions individually on each repository that needs the vetted third-party actions.

Answer

Select the owner-scoped policy but leave both the 'Allow actions created by GitHub' checkbox and the specified-actions list empty, since GitHub and the org are trusted by default.