What trust consideration is most important when allowing repositories to call reusable workflows from other organizations?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Calling a reusable workflow is a supply-chain trust decision—limit callers to approved orgs and repos only. Secrets can still flow, so treat shared workflow code as highly privileged.
Full explanation below image
Full Explanation
Reusable workflows centralize CI/CD logic but introduce a trust boundary: the caller executes logic maintained elsewhere and may pass secrets or inherit permissions according to configuration. Enterprises should restrict which repositories or organizations may be referenced, pin to immutable refs when appropriate, and review changes to shared workflows as highly privileged code. Secrets can be available depending on design; they are not universally absent. Reusable workflows do not magically run as enterprise owners, nor must they live only as public gists. Governance typically includes a platform engineering-owned workflow repository, CODEOWNERS, required reviews, and Actions allow policies.