By default, when do GitHub Actions workflows run on the agent's code?
Why C is the answer
After someone with write access clicks Approve and run workflows
Workflows wait for review by default, because they could run untrusted code. You can opt to run them automatically.
In detail
- By default, someone with write access must click Approve and run workflows.
- That stops unreviewed code from running with workflow access.
- Read the changes before approving the run.
Use case
An illustrative scenario, not a real incident.
An agent pushes code that changes a workflow. Nothing runs until someone with write access clicks Approve and run workflows, so unreviewed code does not run with workflow access.
See it in different ways
flowchart TD A["Cloud agent"] --> B["Pushes to a single branch"] A --> C["Cannot approve or merge"] A --> D["Workflows wait for approval"] A --> E["Internet access limited by a firewall"]
sequenceDiagram participant D as Developer participant A as Cloud agent participant P as Another reviewer D->>A: Requests a pull request A->>P: Draft pull request P->>P: Approve and run workflows P->>A: Review and merge
stateDiagram-v2 state "Agent pushes" as s0 state "Workflows waiting" as s1 state "Workflows run" as s2 [*] --> s0 s0 --> s1 s1 --> s2: Approve and run workflows s2 --> [*]
Key point: Workflows wait for approval by default.
Why the other options are wrong
- A. Never, because workflows are disabled on agent branches for good
- They are not disabled for good.
- B. Immediately on each commit that the agent pushes to its branch
- They do not run automatically on each commit.
- D. Only once the pull request has been merged into the main branch
- They run before merging, once approved.