Organization Actions policy
Why Tier 1
Decides which actions may run, what GITHUB_TOKEN gets by default and which repositories can use runner groups, for every repository at once.
Org-wide Actions settings: allowed actions and workflows, default GITHUB_TOKEN permissions, SHA pinning, fork pull request rules and runner group access.
Available on: Every setup. Source
Attack path
Loosening this policy, for example allowing every Marketplace action or raising the default GITHUB_TOKEN permission to read and write, widens the CI/CD attack surface for every repository in the organization at once.
Mitigations
- Require SHA pinning and allow only selected actions
- Keep the default GITHUB_TOKEN permission read-only
Detect
Alert on org.update_actions_settings, org.set_default_workflow_permissions, org.runner_group_updated, business.update_actions_settings in the audit log.
Related permissions
GitHub Docs: Disabling or limiting GitHub Actions for your organization