Governance of 3rd party GitHub Actions in GHES instances

kevin@elyclover.com (Kevin Holmes) — Fri, 28 Jul 2023 10:00:00 +0000

After spending a few years using GitHub Actions in Open Source, Commercial, and FedRamp environments, I wanted to share some of my takeaways for a few options on how to provide governance over what Actions you allow to be used within your self-hosted GHES and Actions runner instances. This article will focus on government or commercial users self-hosting source code (GHES) and the Actions runners in their secured environments.

There are two paths if you boil this down:

GHES on Ely Clover

Governance of 3rd party GitHub Actions in GHES instances