search

loopbackio / security

[WORK IN PROGRESS] A centralised repository for all security-related matters on the LoopBack Project.
MIT License
4 stars 1 forks source link

Restrict imported GitHub Actions to an allowlist #28

Open achrinza opened 2 years ago

achrinza commented 2 years ago

GitHub allows restricting imported GitHub Actions at either the GitHub Repository and/or GitHub Organisation level, with the latter taking precedence.

Currently, there's no org-wide allowlist that's being enforced.

This issue is to track creating that allowlist, so as to enforce use of known-good GitHub Actions.

Blocked by: https://github.com/loopbackio/security/issues/27