What is the purpose of an 'allowlist' for GitHub Actions in an organization?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Actions allowlists are your supply chain security for CI/CD. Instead of letting any Action from the marketplace run in your org's workflows, you define exactly which ones are permitted — GitHub's own actions, specific verified creators, or individually approved actions.
Full explanation below image
Full Explanation
GitHub Actions policies at the organization or enterprise level include an allowlist for permitted actions and reusable workflows. When configured, only actions matching the allowlist criteria can be used in workflows. Options include: (1) Allow all actions (no restriction), (2) Allow only local actions (actions defined in the same repository), (3) Allow GitHub-owned actions (github/ and actions/), (4) Allow actions from verified creators, (5) Allow specific actions by full name and SHA pin. This addresses supply chain security risks where a malicious or compromised public action could execute arbitrary code in your organization's workflows. Repository administrators can add specific actions to the allowed list when organization policies restrict them.