Manage GitHub Actions for the enterprise

As an enterprise owner, you want organizations in your enterprise to be able to use actions and reusable workflows, but you must restrict them to only GitHub-authored actions plus a small set of trusted third-party publishers, while still permitting any workflow defined within a repository's own organization. In the enterprise policy settings, which combination of options achieves this?

An enterprise owner wants organizations to be able to run actions authored within their own repositories, but only allow a specific set of third-party actions from the Marketplace (identified by their full owner/repo names). In the enterprise policy settings for GitHub Actions, which configuration achieves this?

As an enterprise owner, you configure the enterprise-level Actions policy to 'Allow enterprise, and select non-enterprise, actions and reusable workflows' with a specific allow list. An organization owner within the enterprise then wants to further restrict which actions their teams can use, adding their own narrower allow list at the organization level. However, they report they cannot select a less restrictive policy than the enterprise. What is the correct explanation of how these policies interact?

As an enterprise administrator, you must configure the enterprise-level Actions policy so that organizations can run actions authored by GitHub, actions created by verified creators from the Marketplace, and a short explicit list of specific third-party actions your security team has vetted. You do NOT want to permit arbitrary third-party actions. Which policy configuration meets these requirements?

Your enterprise security team requires that all outbound traffic from GitHub-hosted larger runners originate from a fixed set of IP addresses so that a partner's firewall can allowlist them. As the enterprise administrator, which configuration step enables this while keeping the runners GitHub-hosted?

Your enterprise runs thousands of CI jobs per day on self-hosted runners in a Kubernetes cluster using Actions Runner Controller (ARC). During peak hours, jobs sit queued for long periods because the fixed pool of runners is exhausted, while off-peak the same runners sit idle and waste cluster resources. You need runners to automatically scale up when workflow jobs are queued and scale down when demand drops. Which approach best meets this requirement?

Your enterprise has provisioned GitHub-hosted larger runners (8-core Ubuntu) in the enterprise settings and assigned them to a runner group that is shared with the 'platform' organization. A workflow in a repository within that org needs to target these larger runners specifically, not the standard GitHub-hosted runners. Which configuration in the job's YAML correctly routes the job to the larger runners?

You are an enterprise administrator managing a shared pool of expensive GPU-backed self-hosted runners registered to a runner group at the enterprise level. Currently the group is configured to allow access from 'All organizations.' Finance reports that runners are being consumed by low-priority CI jobs across many teams. You need to restrict the GPU runner group so that only the 'ml-platform' and 'research' organizations can send jobs to it, while leaving the runners themselves untouched. What is the correct way to accomplish this?

An enterprise admin created a self-hosted runner group named 'gpu-builds' at the enterprise level and assigned specific organizations to it. A developer in the 'data-platform' organization reports that when they open the organization's runner group settings, the 'gpu-builds' group does not appear and they cannot select it in their workflows. All organization-level runner groups the developer created themselves are visible. What is the most likely cause?

You are an enterprise admin. Your enterprise account has a self-hosted runner group named 'gpu-runners' created at the enterprise level. The finance team's organization needs to use these runners, but the marketing organization should not. Currently the group is set to allow all organizations. What is the correct way to restrict the runner group so only the finance organization can access it?

Your enterprise has a self-hosted runner group named 'gpu-builders' created at the enterprise level, currently granted to two organizations. A third organization, 'ml-research', is onboarded and needs to run jobs on these runners. After the enterprise owner adds 'ml-research' to the runner group's organization access list, the org admin reports that no repositories in 'ml-research' can queue jobs to 'gpu-builders'. What additional step is required?

As a GitHub Enterprise admin, you need to monitor how frequently a specific self-hosted runner group is being used across all organizations and identify which repositories consume the most minutes on those runners. You want a programmatic, near-real-time signal that a job has been queued for or assigned to a runner in that group, so you can feed the data into a custom dashboard. Which approach best meets this requirement?

Your enterprise standardizes on GitHub-hosted ubuntu-latest runners. A workflow that ran successfully last month now fails during a step that assumes a specific version of the Terraform CLI is preinstalled. No workflow file changes were made. As the platform engineer, what is the MOST reliable way to determine whether the preinstalled Terraform version changed and to prevent this class of failure going forward?

Your enterprise runs self-hosted runners on ephemeral VMs that are recreated after each job. Security wants to ensure that if a workflow from an untrusted repository were ever assigned to these runners, the runner process would not persist state or reuse a compromised environment for a subsequent job. Which runner configuration flag best satisfies this requirement?

An enterprise platform team defines an organization-level secret named DEPLOY_TOKEN scoped to all repositories. A repository owner in that organization later creates a repository secret also named DEPLOY_TOKEN with a different value. A workflow in that repository references ${{ secrets.DEPLOY_TOKEN }} in a job that does not use any environment. Which value will the workflow receive at runtime?

An enterprise administrator creates an organization-level secret named DEPLOY_TOKEN and scopes it to "Selected repositories," adding only the repo `payments-api`. A developer in a different repo, `billing-web`, adds a workflow step that references `${{ secrets.DEPLOY_TOKEN }}`. When the workflow runs in `billing-web`, the value comes back empty and the deployment fails. What is the correct explanation and fix?

A workflow running on a GitHub-hosted ubuntu-latest runner needs Node.js 20 but the maintainer wants to confirm whether that version is already available in the runner's tool cache before adding a setup-node step, to avoid an unnecessary download at runtime. Where should the maintainer look to authoritatively confirm the preinstalled Node.js versions for the current ubuntu-latest image?

A workflow job in the 'payments-service' repository targets the 'production' environment. A secret named DEPLOY_TOKEN is defined at three levels with different values: at the organization level (scoped to selected repositories including this one), at the repository level, and at the 'production' environment level. When the job references ${{ secrets.DEPLOY_TOKEN }}, which value will be used?

Your platform team stores a production deployment API key as an environment secret named DEPLOY_KEY scoped to an environment called production. The production environment is configured with a required reviewers protection rule. A workflow job references environment: production and needs DEPLOY_KEY. A developer triggers the workflow via a push to main. What happens to the job that consumes DEPLOY_KEY?

A platform engineer is auditing secrets across an organization. They need to programmatically retrieve the list of secrets that are scoped to a specific deployment environment named 'production' within the repository 'web-app', without exposing the secret values. Which REST API endpoint should they call?