security(high/easy): require approval for every external fork workflow run

Why

Actions currently require approval only for first-time contributors. A previously trusted but compromised fork account could otherwise trigger dependency installation and builds automatically.

Scope

Change the fork pull-request workflow approval policy to require approval for all external contributors.

Acceptance criteria

Set the policy to all_external_contributors.
Verify organization members and trusted internal collaborators retain the intended workflow.
Do not grant fork workflows access to repository secrets.
Record the final setting in this issue without exposing account details or tokens.

No workflow file change is required.

@Ramino2406

@Ramino2406 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

Hello maintainer, I've checked this out and I'm very certain I can get the issue solved

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ramino2406 to this issue.

@abojeEdwin

@abojeEdwin has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

Hello Maintainer, I've got a good understanding of this issue. I'm confident I can implement a fix fast. Kindly assign to me. Thank you

ℹ️ Repo Maintainers: To accept this application, review their application or assign @abojeEdwin to this issue.

@Rafiat30

@Rafiat30 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

can i work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Rafiat30 to this issue.

@ollypee22

@ollypee22 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

Hi maintainer I would love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ollypee22 to this issue.

@VeronicDev

@VeronicDev has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

pls assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @VeronicDev to this issue.

@Jubilee-001

@Jubilee-001 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

Please assign me this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Jubilee-001 to this issue.

@Kemi-agbadev

@Kemi-agbadev has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

I would love to work on this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Kemi-agbadev to this issue.

@Marywase

@Marywase has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

Good day maintainer
Kindly assign, I’d love to work on this issue
Thanks…

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Marywase to this issue.

@Devadakene

@Devadakene has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

I would like to work on this issue having worked on something similar issues in the past. Please assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Devadakene to this issue.

@Jubilee-001

Congratulations, @Jubilee-001! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

🧑‍💻 @Jubilee-001: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

Final setting:

Fork pull request workflow approval policy: all_external_contributors
Verification: GET /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval returns {"approval_policy":"all_external_contributors"}.
Internal access: organization members and trusted internal collaborators are not external contributors, so their intended workflow access is unchanged.
Secrets: default GITHUB_TOKEN permissions are read; can_approve_pull_request_reviews is disabled; workflows use pull_request (not pull_request_target), declare permissions: contents: read, and contain no secrets.* references. Fork workflows therefore have no repository-secret access.
No account identifiers or tokens are recorded here.

Documented in PR #557 (adds docs/GITHUB_ACTIONS_SECURITY.md). No workflow file changes are required.

Navigation Menu

Repository navigation

security(high/easy): require approval for every external fork workflow run #487

Why

Scope

Acceptance criteria

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

security(high/easy): require approval for every external fork workflow run #487

Description

Why

Scope

Acceptance criteria

Activity

Ramino2406 commented on Oct 21, 2026

abojeEdwin commented on Oct 21, 2026

Rafiat30 commented on Oct 21, 2026

ollypee22 commented on Oct 21, 2026

VeronicDev commented on Oct 21, 2026

Jubilee-001 commented on Oct 21, 2026

Kemi-agbadev commented on Oct 21, 2026

Marywase commented on Oct 21, 2026

Devadakene commented on Oct 21, 2026

drips-wave commented on Oct 21, 2026

Jubilee-001 commented on Oct 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions