Key Security Policy Features
Versions Enforcement
Enforce specific versions of Python, Node.js, and other dependencies across all your workflows to ensure consistency and security.
Environment Restrictions
Set up environment restrictions and require approvals before deployment to production environments, enhancing your security posture.
Custom Policies
Create custom policies tailored to your organization's specific security requirements and compliance needs. We can implement your custom policies as well.
Automatic Enforcement
Automatically enforce policies and receive real-time violation alerts. Prevent non-compliant workflows from executing with pre-run validations.
How It Works
Our security policies platform makes it easy to enforce standards across all your repositories.
Define Your Policies
Use our intuitive policy builder to create security rules that align with your organization's requirements. Set up version constraints, environment configurations, and custom validation rules.
Deploy and Enforce
Deploy your policies across selected repositories. Our system automatically monitors all workflow runs and validates them against your policies before execution.
Monitor and Improve
Review compliance reports, track policy violations, and continuously improve your security posture. Receive alerts for non-compliant workflows and automatically block risky runs.
Security Policy Dashboard
Manage and monitor all your security policies from a centralized dashboard.
Common Use Cases
See how organizations are using our security policies to enhance their GitHub Actions security.
Version Standardization
A financial services company enforces specific versions of Node.js and Python across all their CI/CD workflows to ensure security compliance and consistent builds.
Production Safeguards
A healthcare tech company implements mandatory approvals for any workflow that deploys to production environments, ensuring proper review of all changes.
Secret Protection
A technology enterprise enforces rules preventing direct secret usage in workflow files, requiring all secrets to be properly managed through GitHub Secrets.
Compliance Reporting
A regulated industry company uses our policy reporting to generate compliance documentation proving that their CI/CD pipelines follow required security standards.
Policy-driven CI/CD security
Define rules that flag secrets in workflow logs, restrict unapproved actions, and ensure pipelines meet your organization’s compliance baseline.
Security policies complement the GitHub Actions analyzer by turning inventory data into enforceable guardrails, including rules for shared reusable workflows.
Audit trails document who changed workflows and when, supporting SOC2 and internal security reviews.
Security Policies FAQ
What GitHub Actions security policies can Gitera enforce?
Gitera ships rules to require a specific Node.js or Python version, enforce maximum workflow and job timeouts, require approval for production environments, require that a specific action such as actions/checkout@v4 exists in a workflow, and forbid jobs from running on self-hosted runners. Each rule is configured per organization and evaluated against real workflow files. Use the actions analyzer inventory to decide which actions to require.
How do I require approval for production deployments in GitHub Actions?
GitHub supports required reviewers on environments, but it is easy for a new workflow to deploy without using the protected environment. Gitera's approval rule checks that production environments require approval before execution and reports workflows that violate it, so gaps are visible across every repository instead of being found during an incident review.
Why forbid self-hosted runners for some workflows?
Self-hosted runners persist between jobs and can reach internal networks, so running untrusted code on them, especially from forks or public repositories, is a common supply-chain risk. Gitera's rule flags jobs that use runs-on: self-hosted where your policy forbids it, giving security teams one list of exceptions to review.
How are policy violations reported?
Gitera evaluates each rule against your workflows and lists every violation with the repository, workflow, and rule that failed, plus details such as the version or timeout that was found. A policy dashboard tracks compliance across the organization over time, which supports audit evidence for SOC 2 and internal security reviews.
Related Gitera capabilities
Explore all features on the Gitera homepage or read insights on the blog.