Security policies
Organization-wide rules checked against every workflow file — runtime versions, timeouts, required actions, approval gates, and runner restrictions.
Policies enforce security and reliability standards across all workflow files, so the standard is checked continuously — not remembered during code review.
Built-in rules
| Rule | What it enforces | Config |
|---|---|---|
ensure-python-version | Jobs run a standardized Python version | requiredVersion |
ensure-node-version | Jobs run an approved Node.js runtime | requiredVersion |
enforce-timeout | Workflows/jobs declare a timeout, stopping runaway billing | maxTimeoutMinutes |
require-approval | Deployments to listed environments need approval gates | environments |
ensure-action-exists | A required step exists — e.g. actions/checkout@v4 or a security scanner | action |
forbid-self-hosted-runner | Self-hosted runners restricted to an allowlist | allowList |
Working with policies
Open Policies → New policy and pick a rule.
Fill its configuration — e.g. requiredVersion: "3.12" or maxTimeoutMinutes: 30.
Save. Every synced workflow file is checked against it.
Open Failed workflows to see every non-compliant file with the exact reason, then fix the YAML or adjust the rule.
Each policy has a detail page for editing its configuration and scoping. Non-compliance results include the offending file and the rule detail so a developer knows what to change.