It's possible to whitelist actions on an org level. You can whitelist - all actions from a specific org (e.g. actions/*) - a specific action (e.g. actions/se

It's possible to whitelist actions on an org level. You can whitelist - all actions from a specific org (e.g. actions/*) - a specific action (e.g. actions/setup-go) - a specific version of a specific action (e.g. actions/setup-go@commit-sha) Any workflow attempting to use actions outside of the whitelist will simply fail to start up.