Fine-tune access to external actions
Limit use of external actions within Actions workflow for enterprises, organizations, and repositories.
![](https://github.blog/wp-content/uploads/2019/03/company-twitter.png?resize=1201%2C630)
You can now fine-tune access to external actions. These updated settings make it easier to achieve your security and compliance goals with GitHub Actions.
Limiting to GitHub and GitHub-verified authors
GitHub authors a number of essential actions which are widely used, such as ‘checkout’. When you check the box for GitHub-authored actions, you’re allowing workflows to use any action in the GitHub organization or the actions organization, including those that will be created in the future.
You can also limit the community actions that can be executed to just those created by GitHub-verified authors. With GitHub-verified authors, GitHub ensures that the organization that created the action is authentic, and truly represents the company or entity which it appears to represent (GitHub does not review any code or security practices as part of its verification process). When you check the box for GitHub-verified authors, you’re allowing workflows to use any action in the verified author’s organization, including those that will be created in the future.
Limiting to specific actions
The most secure way to use GitHub Actions includes a review of the source code of all external actions. You can now ensure that workflows use only those actions that have been reviewed by creating an explicit allow list. You can use the * syntax to create flexible patterns. When you use the allow list, only actions that patch a pattern in the list are allowed.
The allow list for specific actions can be used for any public repository, or private repositories that are part of a GitHub Enterprise plan.
Learn more
To get started with Actions policies, visit our documentation.
Tags:
Written by
Related posts
![](https://github.blog/wp-content/uploads/2023/10/Collaboration-DarkMode-2.png?resize=400%2C212)
2024 is the biggest global election year in history. What’s at stake for developers?
GitHub is considering what is at stake for our users and platform, how we can take responsible action to support free and fair elections, and how developers contribute to resilient democratic processes.
![](https://github.blog/wp-content/uploads/2023/10/AI-DarkMode-2.png?resize=400%2C212)
GitHub named a Leader in the Gartner first-ever Magic Quadrant for AI Code Assistants
This year, as part of its annual Magic Quadrant series, Gartner published a first-of-its-kind report analyzing the state of play in the AI Code Assistants market–and named GitHub a Leader.
![AI in software development 2024 survey results with colorful graphics and percentages.](https://github.blog/wp-content/uploads/2024/08/ai-survey-header.png?resize=400%2C212)
Survey: The AI wave continues to grow on software development teams
We surveyed 2,000 people on software development teams at enterprises in the U.S., Brazil, India, and Germany about the use, experience, and expectations around generative AI tools in software development.