Question

You are the enterprise administrator for a GitHub Enterprise Cloud organization. Your security team wants developers to be able to run CodeQL default setup, but they also want to permit only a specific, vetted set of third-party GitHub Actions in workflows across all organizations — including a custom CodeQL Action fork the team maintains. Any other Actions should be blocked from running. What is the correct way to enforce this at scale while still allowing the approved custom CodeQL workflow?

Accepted Answer

Configure the enterprise-level Actions policy to 'Allow enterprise, and select non-enterprise, actions and reusable workflows', then add the vetted actions (including the custom CodeQL fork) to the allow list

Answer

Disable GitHub Actions entirely at the enterprise level and require all CodeQL scans to be uploaded via the SARIF API from an external CI system

Answer

Add a required ruleset at the organization level that blocks any pull request whose workflow files reference unapproved Actions

Answer

Set each repository's Actions permissions to 'Allow all actions and reusable workflows' and rely on branch protection to reject unwanted workflow runs