GitHub
Security & compliance
Releases
GitHub Actions allows all third-party actions
Part of the Repository protection posture check · fix arrives as a guide
What it is
Actions permissions are set to allow all actions and reusable workflows, including any third-party action from the marketplace.
Why it matters
Any workflow — including one added in a pull request — can pull in arbitrary third-party code that runs with your repository token and secrets. The supply chain becomes everything published to the marketplace.
How to fix it
Restrict to actions created by GitHub plus an explicit allow-list of the third-party actions you have reviewed. Combined with SHA pinning, this bounds what CI can execute.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.