GitHub Actions is enabled and not used in a repository

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_60
Category	System Configuration
Severity	LOW

Impact

CI/CD automation allows execution of code within the context of a repository. These automation features are often enabled by default in an organization or repository. Since any user with sufficient permissions can trigger workflows that interact with repository code or APIs—including actions requiring elevated permissions—these automation features can serve as an attack surface for the repository and organization, even if the workflows are not actively used.

Recommended Solution - Buildtime

If GitHub Actions is not in use in the organization, disable it completely at the organization level. If it is in use in the organization, restrict it to the specific repositories in which it is used:

1. Browse to the organization settings.
2. Click Actions, and under Policies, disable GitHub Actions, or restrict to specific repositories.