Policies

Use this page to view and manage all workflow run policies created in your organization.

Existing workflow run policies displayed in the dashboard

Creating a New Policy in Your Organization

There are three policy types you can create:

• Runner Label Policy - Prevent or monitor usage of specific runners
• Actions Policy - Block specific GitHub Actions
• Secret Exfiltration Policy - Ensure only certain branches have access to Secrets

Runner Label Policy

Use this policy to block untrusted GitHub-hosted runners or allow only specific self-hosted runners.

Step 1: Navigate to the Policies page

• Go to your StepSecurity dashboard, then to Run Policies → Policies in the sidebar.

Workflow Run Policies dashboard

Step 2: Click “Create Policy”

• Click the Create Policy button on the top right of the page.

Click the create button

Step 3: Fill in Policy Details

• Policy Name – e.g., Do not allow GitHub-Hosted Runners

• Policy Type – Select Runner Label Policy

• Action – Choose between:

  • Enforce: Actively blocks disallowed runner labels

  • Dry Run: Sends notifications but does not block

Selecting Runner Label Policy Type

Step 4: Specify Disallowed Runner Labels

• Type in the runner labels you want to block (e.g., ubuntu-latest, macos-latest) and press Enter to add.

Specify runner labels to disable

Step 5: Select Repositories

Choose whether to apply the policy to:

• All current and future repositories (default), or

• Select specific repositories manually

Select Repositories

Step 6: Save the Policy

• After configuring all settings, click Save to create the policy.

Click the save button

Actions Policy

Use this policy to enforce an allowlist of GitHub Actions. Any action not listed is blocked (Enforce) or flagged (Dry Run).

Step 1: Select “Actions Policy” and Actions to Allowlist

• Manually type and add actions (e.g., actions/checkout) OR

Setting up Actions policy

• Use All Actions (Used) to select from known usage

Setting up Actions Policy using existing Action in the organization

17. Select one Action and click "Add to Allowed List"

Setting up Actions Policy using existing Action in the organization

• Decide whether to allow all versions (default) or select specific commit versions OR

Setting up Actions Policy using existing Action in the organization

• Use Repository Filter (Optional): Go to By Repository (Used) tab → Select a repo → Add used actions

Setting up Actions Policy by Repository using Actions

Step 2: Click "Save"

Setting up Actions Policy by Repository using Actions

Secret Exfiltration Policy

Use this policy to ensure that only certain branches have access to secrets. This helps prevent accidental or malicious exposure of secrets, especially from untrusted branches like those in pull requests from forks.

Step 1: Select “Secret Exfiltration Policy”

Setting up Secret Exfiltration Policy

Step 2: Choose Target Repositories

Setting up Secret Exfiltration Policy

Step 3: Save the Policy

Setting up Secret Exfiltration Policy