3.4. Reflection Checkpoint

Key Takeaways

• Governance layers outside-in: enterprise ceiling → organization → repository, and an inner scope can only ever be more restrictive. "Allowed locally but still blocked" always means a policy above.
• The action-source policy tiers are distinct: all actions, local/enterprise only, GitHub-created, verified-creator Marketplace, and pattern allowlists (owner/repo@*, owner/*). Policy governs uses: resolution only — never run: content.
• Starter workflows live in the org's .github repository under workflow-templates with a .properties.json, bind at creation, and drift; reusable workflows bind at every run and propagate updates instantly.
• Hosted runners are ephemeral and safe for public repos; self-hosted are persistent by default and explicitly not recommended for public repos. Ephemeral configuration and ARC restore clean state at scale; larger runners offer static IPs.
• Runner groups gate which repositories and workflows may schedule on a fleet; a mismatch queues the job forever rather than erroring. Self-hosted runners need outbound connectivity only.
• Secret precedence is environment → repository → organization, but the reason production credentials belong in environments is gating, not precedence. Missing secrets resolve to empty strings silently, and fork PRs receive no secrets at all.
• Secrets are write-only through the API (fetch public key → encrypt with libsodium → PUT); variables are readable plaintext for non-sensitive configuration.

Connecting Forward

Phase 4 flips from configuring to reading: given a workflow file, a run history, and a pile of logs, determine what happened and why. That includes expanding the anchors and matrices from Phase 2 in your head, finding artifacts and logs through the UI and API, and choosing correctly among the reuse models this phase just distributed.

Self-Check Questions

• A repository's allowlist includes an action, but the job fails with a policy error. Name the two places you'd look, in order, and explain why the repository setting couldn't have fixed it alone.
• A self-hosted runner shows online, the labels match, and the job sits in queued for an hour. What is the remaining explanation, and where do you change it?
• Distinguish the three secret scopes by blast radius and by gating, then say where a production database password belongs and why the other two tiers are insufficient.