Question

An enterprise owner has enabled an allowlist of approved GitHub Actions. A security engineer wants organizations to use a shared, centrally maintained custom CodeQL workflow (rather than default setup) so that all repositories analyze code with the organization's mandated query pack. The custom workflow lives in a reusable-workflow repository and is called via a `uses:` reference. Developers report that when they add the reusable workflow reference to their repos, the CodeQL scan job never runs and Actions reports the workflow is not permitted. What is the MOST likely cause and correct remediation?

Accepted Answer

The reusable workflow repository and the CodeQL actions it invokes are not included in the enterprise Actions allowlist; add them (or enable 'Allow actions created by GitHub' plus the specific reusable-workflow reference) to the permitted actions policy.

Answer

Custom CodeQL workflows cannot be centrally shared as reusable workflows; each repository must define its own inline advanced setup workflow, so the shared approach is unsupported.

Answer

Default setup must be disabled at the enterprise level before any advanced setup workflow can run; toggle off CodeQL default setup in the enterprise security configuration.

Answer

The security-manager role does not have permission to run CodeQL analysis, so scans are silently skipped until an enterprise owner grants write access to each repository.