In your organization's Actions settings, choose a policy that allows only actions from your own organization, plus an explicit list of others, and turn on the option that requires actions to be pinned to a full length commit SHA. Then no one can add an arbitrary action to a workflow without it being reviewed.
Why a policy beats a habit
Reviews and pinning work when everyone remembers them. A policy works when someone is in a hurry. GitHub's secure use reference notes that a single compromised action in a workflow can reach all secrets configured on the repository, so limiting what can be used shrinks that exposure at the source.
What the policy offers
GitHub's documentation for organizations describes choices for which actions and reusable workflows may run. In broad terms:
| Policy | Effect |
|---|---|
| Allow all actions and reusable workflows | No restriction |
| Allow actions from your organization only | Blocks everything else, including actions written by GitHub such as checkout |
| Allow your organization plus select others | Local actions and reusable workflows run, with extra options you choose |
The docs list the extra options for the select policy: allow actions created by GitHub, allow Marketplace actions by verified creators, and allow specified actions and reusable workflows by name or pattern. A warning from the docs worth repeating: if you choose your organization only, actions authored by GitHub, including checkout, are blocked, which breaks most workflows.
Separately, a checkbox requires actions to be pinned to a full length commit SHA. When on, all actions must be pinned, including your own organization's and those authored by GitHub. Reusable workflows can still be referenced by tag.
Set it up in five steps
- Inventory the actions your repositories use today. A search of workflow files for
uses:gives the list. - Decide the allowlist. Start with GitHub's own actions and the few third-party ones you rely on.
- In organization settings, open Actions, then General, and choose the select policy.
- Add the allowed actions by name. Use patterns carefully, since a wide pattern allows more than you intend.
- Enable the SHA pinning requirement, and convert existing references to SHAs first so you do not break builds.
If your organization sits under an enterprise with its own policy, the docs note you may not be able to change these settings, because the enterprise setting overrides.
Keep the allowlist alive
An allowlist that nobody maintains turns into a ticket queue. Put a short process in place:
- A request names the action, why it is needed and which repositories will use it.
- A reviewer runs the checks in our post on reviewing a third-party action.
- Approved actions are added by SHA or version pattern.
- Once a quarter, remove entries nobody uses.
Also restrict who creates runners and PR approvals
GitHub's docs say organization owners can choose which repositories may create repository level self-hosted runners, and you can also block workflows from creating or approving pull requests. Both limits belong in the same settings visit.
Where Safeguard fits
Safeguard's policies and guardrails operate on dependencies and code changes at the pull request. The action allowlist is a GitHub setting, and the two complement each other.
Quick check
Will pinning enforcement break my existing workflows?
Yes, any workflow still referencing a tag will fail. Convert references to full SHAs before enabling the requirement.
Do reusable workflows have to be pinned too?
Per GitHub's docs, reusable workflows can still be referenced by tag under the pinning requirement, so review those references separately.
Sources
- Disabling or limiting GitHub Actions for your organization, GitHub Docs
- Secure use reference, GitHub Docs
- Managing GitHub Actions settings for a repository, GitHub Docs
Last reviewed: 19 October 2026.
