Description

Minimize the sharing of your organization secrets to a smaller set of specific repositories. Limit the usage of organization secrets. Protect your secrets by declaring them as environment secrets and use required reviewers to protect environment secrets. The organization secret visibility should be limited to fewer selected repositories. Anyone with collaborator access to the repositories with access to a secret or variable can use it for Actions. They are not passed to workflows that are triggered by a pull request from a fork. Learn more: https://docs.github.com/en/enterprise-cloud@latest/actions/security-guides/security-hardening-for-github-actions#using-secrets https://docs.github.com/en/enterprise-cloud@latest/actions/security-guides/using-secrets-in-github-actions

Recommendation

1. Go to Organization Settings. 
2. In the 'Security' section of the sidebar, select Secrets and variables, then click Actions. 
3. Click the 'Secrets' tab. 
4. Find the secret and click on edit pencil icon. 
5. Ensure the 'Repository access' setting is 'Selected repositories' and the number of repositories is under 10.

Policy Rule

{
  "target": "GHActionsSecret",
  "if": {
    "allOf": [
      {
        "resource": "GHActionsSecret",
        "property": "Visibility",
        "operator": "equals",
        "value": "selected"
      },
      {
        "resource": "GHActionsSecret",
        "property": "SelectedRepositoriesTotalCount",
        "operator": "greaterThan",
        "value": 1
      },
      {
        "resource": "GHActionsSecret",
        "property": "SelectedRepositoriesTotalCount",
        "operator": "lessThan",
        "value": 11
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}