Guides

Ensure only verified GitHub actions in-use

Make sure GitHub Marketplace verifies the creators by only using verified actions. By doing so, malicious actors will be prevented from running their actions.

Suggest Edits

Risk Level: medium
Platform: Github
Spectral Rule ID: GH-HRD017

REMEDIATION

Change Github action to verified-only actions.

SaaS:

In the organization setting in the Github site:

  1. Go to 'Actions'.
  2. Go to 'General actions permissions'.
  3. Select 'Allow and select , actions and reusable workflows'.
  4. Click 'Allow actions by Marketplace verified creators' (should be marked).

Read more:

Updated over 1 year ago