Security & Compliance
GitHub Actions security and compliance, operated at scale
Securing GitHub Actions across thousands of repositories is a consistency-and-evidence problem, not a missing-feature one. GitHub gives you strong native building blocks; CodeCargo applies them uniformly across your estate, controls the runtime, and proves it.
The four layers of GitHub Actions security
Before anything runs
Supply-chain integrity
Pin actions to full commit SHAs, use OIDC for short-lived cloud credentials instead of stored secrets, allow-list trusted publishers, and scan dependencies and workflow files before merge, applied consistently across every repository.
Block the risky before it runs
Policy enforcement
Author policy once and enforce it everywhere. CodeCargo runs a fresh compliance scan on every workflow-file edit and surfaces violations inline on the pull request, so risky workflows are caught before they merge.
While jobs execute
Runtime detection
A malicious build step or a mid-job exfiltration attempt only appears at runtime. CargoWall, an eBPF kernel-level egress firewall, controls the network a workflow is allowed to reach and blocks exfiltration before the connection opens.
Prove it stays in policy over time
Continuous compliance
Every workflow is re-evaluated against policy on an ongoing basis, drift is surfaced the moment it appears, and there is an audit-ready evidence trail, rather than a point-in-time snapshot.
CargoWall: runtime network security
Pre-run scanning cannot catch a threat that only appears once a job is executing. CargoWall is an eBPF kernel-level egress firewall for GitHub Actions runners that closes that gap.
- Egress allow-lists at three scopes: hostnames, IPs, or CIDR blocks per workflow, per repository, or organization-wide.
- DNS query interception blocks tunnelling and data-exfiltration paths, not just direct IP connections.
- Audit mode logs every connection and policy decision without blocking, so a team learns a workflow’s real network behaviour before turning enforcement on.
- Supports GitHub-hosted and self-hosted runners, loading eBPF programs dynamically during execution with near-zero (microsecond) latency.
- Every blocked connection is logged with the workflow, the destination, and the policy that applied, so a runtime signal ties back to a specific owner.
Continuous compliance and scoring
A workflow that was compliant at audit time drifts. CodeCargo's compliance engine re-evaluates every workflow against policy and keeps the evidence current.
- A fresh compliance scan on every workflow-file edit, with violations surfaced inline on the pull request before merge.
- A 0-100 compliance score per workflow, tracked on a real-time dashboard by repo, team, and rule.
- A rule set covering SHA pinning, OIDC authentication, approved-actions-only, least-privilege permissions, hardcoded-credential prevention, secrets scanning, dependency review, and branch protection.
- Drift detection, audit trails of policy history and enforcement events, and auto-remediation pull requests with the fix already authored.
What CodeCargo covers
| Layer | What CodeCargo does |
|---|---|
| Supply chain | SHA pinning, OIDC, approved-actions allow-lists, pre-merge scanning, applied across every repo |
| Policy enforcement | Per-PR compliance scan, inline violations, one policy applied org-wide |
| Runtime network security | CargoWall eBPF egress firewall with per-workflow/repo/org allow-lists and DNS interception |
| Compliance scoring | 0-100 score per workflow, real-time dashboard, drift detection |
| Evidence | Audit trails of policy history, scores over time, remediation actions, enforcement events |
| Remediation | Auto-remediation pull requests with the fix authored |
CodeCargo operates under SOC 2 Type II and is a GitHub-native product. It extends GitHub rather than competing with it. For the full picture, read the runtime security and compliance guide.
Frequently asked questions
What are the four layers of GitHub Actions security?
Supply-chain integrity (before anything runs), policy enforcement (block the risky before it runs), runtime detection (catch threats while jobs execute), and continuous compliance (prove it stays in policy over time). A mature program needs all four; no single tool spans them all.
How does CargoWall stop data exfiltration in GitHub Actions?
CargoWall is an eBPF kernel-level egress firewall for GitHub Actions runners. It controls the network a workflow job is allowed to reach with per-workflow, per-repo, and org-wide allow-lists and DNS interception, and blocks connections outside the allow-list before they are established, which pre-run scanning cannot do.
How does CodeCargo keep GitHub Actions workflows compliant over time?
CodeCargo scans each workflow on every edit, scores it 0-100, tracks drift on a real-time dashboard, and keeps audit trails of policy history, scores, remediation actions, and enforcement events, so compliance is continuous and evidenced rather than a point-in-time scan.
Is CodeCargo SOC 2 Type II compliant?
Yes. CodeCargo operates under SOC 2 Type II, an independent audit of how it runs its own security controls over a period of time. That is evidence of CodeCargo’s own posture; your organization’s regulatory compliance still depends on the controls you enforce across your workflows, which is the layer CodeCargo helps you apply and evidence.
Does CodeCargo replace tools like Falco, Wiz, or OPA?
No. CodeCargo is a control plane that complements detection and policy engines by applying controls consistently across a GitHub estate and proving compliance over time. It ties runtime signals to specific workflows and owners, enforces paved-road defaults, and adds runner-network egress control with CargoWall.
Secure and prove GitHub Actions at scale
See how CodeCargo applies GitHub-native controls across every repository, gates the runtime with CargoWall, and produces the compliance evidence auditors accept.