Description

Prevent GitHub Actions workflows from creating or approving pull requests. Allowing workflows, or any other automation, to create or approve pull requests could be a security risk if the pull request is merged without proper oversight. By default, when you create a new organization, workflows are not allowed to create or approve pull requests. Learn more: https://docs.github.com/en/enterprise-cloud@latest/actions/security-guides/security-hardening-for-github-actions#preventing-github-actions-from-creating-or-approving-pull-requests https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#preventing-github-actions-from-creating-or-approving-pull-requests

Recommendation

1. Go to Organization Settings. 
2. In the 'Code, planning, and automation' section of the sidebar, click on Actions -> General. 
3. Under the 'Workflow permissions' section. 
4. Ensure the 'Allow GitHub Actions to create and approve pull requests' setting is disabled.

Policy Rule

{
  "target": "GHActionsPolicies",
  "if": {
    "allOf": [
      {
        "resource": "GHActionsPolicies",
        "property": "CanApprovePullRequestReviews",
        "operator": "equals",
        "value": false
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}