Granular controls for external actions
GitHub has expanded the policy settings that govern which external actions can run in your workflows. The new options are designed to give organizations finer-grained control over the supply chain of actions they depend on, aligning with their security and compliance requirements.
Scoping actions by author type
Administrators can now restrict workflows to actions authored by GitHub itself. This includes any action residing in the GitHub organization or the actions organization. Enabling this setting permits all current and future actions from those organizations.
Another layer of filtering lets you permit only community actions from GitHub-verified authors. In this context, verification confirms that the organization publishing the action is who it claims to be; it does not involve a code review or security assessment by GitHub. When this option is selected, any action from a verified author's organization is allowed, including those added later.
Explicit allow lists
For teams that perform their own due diligence, the recommended security posture is to audit the source code of every external action. The new allow-list setting enforces that review process by making it a technical control: only actions matching the patterns you define can execute. The list supports the * wildcard for flexible matching, and any action that does not match a listed pattern is blocked.
The specific-action allow list is available for all public repositories and for private repositories under a GitHub Enterprise plan.
Documentation
Instructions for configuring these policies, including disabling or limiting GitHub Actions for an organization or repository, are available in the official GitHub documentation.
