Why might an organization require approval before GitHub Actions workflows run from first-time contributors' pull requests, especially on public repositories?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Requiring approval for first-time contributor pull request workflows stops drive-by jobs from burning Actions minutes or probing secrets before a maintainer trusts the source.
Full explanation below image
Full Explanation
Public repositories and open-source programs face hostile pull requests that may modify workflows or execute untrusted code on Actions. Requiring approval for workflows from first-time contributors adds a human gate before compute and secret exposure. Maintainers should still avoid pull_request_target anti-patterns and keep secrets out of jobs that checkout untrusted code. The setting does not grant enterprise write access, does not publish packages on comments, and does not disable Dependabot. Administrators should document contributor onboarding so legitimate first contributions are approved promptly without weakening the control.