Controlling who can execute GitHub Actions workflows

Actions 정책 정보

작업 정책을 사용하면 조직 및 리포지토리에서 워크플로가 실행되는 방식을 GitHub Actions 제어할 수 있습니다. 기존 일반 설정과 별도로 설정의 GitHub Actions 새 정책 섹션에서 작업 정책을 구성합니다.

작업 정책은 엔터프라이즈, 조직 및 리포지토리 수준에서 사용할 수 있습니다.

작업 정책에는 현재 워크플로 실행 보호라는 한 가지 유형의 정책이 포함되어 있습니다. GitHub 는 시간이 지남에 따라 더 많은 정책을 추가할 계획입니다.

워크플로 실행 보호 정보

워크플로 실행 보호를 사용하면 워크플로를 트리거 GitHub Actions 할 수 있는 사용자와 워크플로를 실행할 수 있는 이벤트를 제어하는 허용 목록을 정의할 수 있습니다. 워크플로 실행 보호에는 이벤트 및 행위자라는 두 가지 규칙 유형이 있습니다. GitHub 는 시간이 지남에 따라 더 많은 규칙을 추가할 계획입니다.

워크플로 실행 보호는 규칙 집합 프레임워크를 GitHub 기반으로 하므로 규칙 집합에서 이미 알고 있는 대상 지정도 여기에서 작동합니다. 규칙 집합을 사용하여 보호를 적용하고 리포지토리 사용자 지정 속성을 사용하여 특정 리포지토리로 범위를 지정할 수 있습니다. 규첵 세트에 관한 자세한 내용은 규칙 세트에 대한 정보을 참조하세요. For more information, see About Actions policies.

Preparing to add protections

Like rulesets, workflow execution protections layer with other protections in the same repository, organization, or enterprise.

Rather than creating one large policy per account, we recommend creating multiple clearly defined policies and layering protections across account levels. Enterprise owners can create protections at the enterprise level for broad, non-negotiable policies. Organization owners and repository administrators can then add to these restrictions.

For each policy you define, think about:

1. Which organizations or repositories your protection will target. For example, open source repositories may need tighter restrictions on who can trigger workflows. You can target repositories by factors like visibility, deployment status, or custom property.

   • Deployment status comes from an organization's linked artifacts page. If this is an important factor, make sure you're uploading deployment records when an artifact is deployed. See 연동된 아티팩트 개요.
   • To create and assign custom properties, see 조직의 리포지토리에 대한 사용자 지정 속성 관리.

2. Which workflows will be protected. For example, workflows that deploy production code might need a certain level of protection, but less sensitive automations may not need the same level of protection. You can scope policies to specific workflow paths or required workflows.

3. Who should be able to run these workflows in the repositories you're targeting. This might be users with a certain role, selected bot accounts, or a specific team. Consider grouping these users in an organization or enterprise team so they can be easily contacted and referenced across multiple rulesets. See 조직 팀 만들기 or 엔터프라이즈 팀 만들기.

Creating a workflow execution policy

First, create a new Actions policy for the account level you're working at.

In a repository or organization:

1. Click the Settings tab.
2. In the left sidebar, under Actions, click Policies.

In an enterprise:

1. Click the Policies tab.
2. In the left sidebar, click Actions, then Policies.

Configuring the policy

Next, create a new policy.

1. Choose a name for the policy.
2. Choose an enforcement status. If you select Evaluate (GitHub Enterprise Cloud only), you will be able to monitor when users would hit the restriction in policy insights.
3. Target your desired workflows, organizations, or repositories.
4. Configure the following workflow execution protections.

Restrict actors

By default, every user with write access to a repository can trigger workflows. Actor rules let you separate who contributes code from who runs your CI, so you can grant a contributor write access without granting them the ability to execute workflows.

Only the allowed actors will be able to run the specified workflows in the targeted repository. If you also restrict events, these users will only be able to trigger workflows with the allowed events. Non-allowed actors will not be able to run the specified workflows at all.

GitHub features are exempt from these restrictions for the built-in processes that they run on GitHub Actions. However, if you have created workflows that need to be run by the identity associated with a GitHub feature, such as dependabot[bot], then this identity must be added as an allowed actor.

Restrict events

Event rules control which events are permitted, such as push, pull_request, pull_request_target, and workflow_dispatch.

Evaluating policies

You can view policy insights to see workflow runs that have been blocked (for active policies) or would have been blocked (for "evaluate" policies). This is a good way to check that policies are working as intended and not causing unnecessary friction.

To view insights, click the Policy insights page. You'll find this directly under the page for GitHub Actions policies in your repository, organization, or enterprise sidebar.