Actions only on protected branches
Anyone who can push a branch can change the workflow that runs on it, and that workflow sees the repository’s and the organisation’s secrets. Only run workflows on protected branches closes that path: with it on, a workflow runs only when the ref that triggered it is a protected branch.
It is off by default. Turn it on under Security › Policies › Repository rules (Build & deploy › Environments links there), or with:
curl -X PUT -H "Authorization: Bearer ${FREMFORGE_PAT}" -H "Content-Type: application/json" \
-d '{"only_protected_branches": true}' \
"https://frem.sh/_app/api/v1/orgs/acme/security/actions-policy"The token needs policy:write.
What it refuses
With the switch on, the runner refuses a job unless:
- the ref is a branch,
refs/heads/<name>. Tag pushes and any other ref are refused; - the repository has a branch-protection rule whose name is exactly that branch name. A wildcard rule such as
release/*does not count.
If fremforge cannot read the repository’s branch protection, the job is refused rather than run.
Check how your pull-request and tag workflows are triggered before you turn it on: a workflow that runs on another ref will not run.