Skip to content

Commit 9ba81c5

Browse files
Martin LopesSarah Edwards
Martin Lopes
and
Sarah Edwards
authored
[Feb-01] [Ecosystem] Update audit log for GitHub Actions events (#17436)
* Added “workflows” category for audit log * Fixed table * Updated links * Small edits * Added versioning * Added entry for `self_hosted_runner_updated` * Added repo entry for `self_hosted_runner_updated` * Added `enterprise` category actions * Added "starting_workflow_job" * Update reviewing-the-audit-log-for-your-organization.md * Added changes to security hardening guide * Update security-hardening-for-github-actions.md * Added versioning for "self-hosted runners" tables * Update reviewing-the-audit-log-for-your-organization.md * Apply suggestions from code review Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update security-hardening-for-github-actions.md * Update reviewing-the-audit-log-for-your-organization.md * Update reviewing-the-audit-log-for-your-organization.md * Update security-hardening-for-github-actions.md * Update reviewing-the-audit-log-for-your-organization.md * Update security-hardening-for-github-actions.md * Update security-hardening-for-github-actions.md * Update reviewing-the-audit-log-for-your-organization.md * Update security-hardening-for-github-actions.md * Update reviewing-the-audit-log-for-your-organization.md * Update reviewing-the-audit-log-for-your-organization.md * Update security-hardening-for-github-actions.md * Moved enterprise events into reusable * Added versioning to exclude AE * Changed table identation and naming for consistency with reusable * Update security-hardening-for-github-actions.md * Update reviewing-the-audit-log-for-your-organization.md * Added note to mention that certain events can only be viewed using the API. * Added event visibility information. * Removed superfluous description text * Fixed typo * Moved table into reusable * Removed unused events superseded by `runner_group_updated` Co-authored-by: Sarah Edwards <skedwards88@github.com>
1 parent 82c4e72 commit 9ba81c5

5 files changed

Lines changed: 112 additions & 53 deletions

File tree

‎content/actions/learn-github-actions/security-hardening-for-github-actions.md‎

Lines changed: 36 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ Some customers might attempt to partially mitigate these risks by implementing s
115115

116116
You can use the audit log to monitor administrative tasks in an organization. The audit log records the type of action, when it was run, and which user account performed the action.
117117

118-
For example, you can use the audit log to track the `action:org.update_actions_secret` event, which tracks changes to organization secrets:
118+
For example, you can use the audit log to track the `org.update_actions_secret` event, which tracks changes to organization secrets:
119119
![Audit log entries](/assets/images/help/repository/audit-log-entries.png)
120120

121121
The following tables describe the {% data variables.product.prodname_actions %} events that you can find in the audit log. For more information on using the audit log, see
@@ -124,26 +124,45 @@ The following tables describe the {% data variables.product.prodname_actions %}
124124
#### Events for secret management
125125
| Action | Description
126126
|------------------|-------------------
127-
| `action:org.create_actions_secret` | Triggered when a organization admin [creates a {% data variables.product.prodname_actions %} secret](/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-an-organization).
128-
| `action:org.remove_actions_secret` | Triggered when a organization admin removes a {% data variables.product.prodname_actions %} secret.
129-
| `action:org.update_actions_secret` | Triggered when a organization admin updates a {% data variables.product.prodname_actions %} secret.
130-
| `action:repo.create_actions_secret ` | Triggered when a repository admin [creates a {% data variables.product.prodname_actions %} secret](/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository).
131-
| `action:repo.remove_actions_secret` | Triggered when a repository admin removes a {% data variables.product.prodname_actions %} secret.
132-
| `action:repo.update_actions_secret` | Triggered when a repository admin updates a {% data variables.product.prodname_actions %} secret.
133-
127+
| `org.create_actions_secret` | Triggered when a {% data variables.product.prodname_actions %} secret is created for an organization. For more information, see "[Creating encrypted secrets for an organization](/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-an-organization)."
128+
| `org.remove_actions_secret` | Triggered when a {% data variables.product.prodname_actions %} secret is removed.
129+
| `org.update_actions_secret` | Triggered when a {% data variables.product.prodname_actions %} secret is updated.
130+
| `repo.create_actions_secret ` | Triggered when a {% data variables.product.prodname_actions %} secret is created for a repository. For more information, see "[Creating encrypted secrets for a repository](/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository)."
131+
| `repo.remove_actions_secret` | Triggered when a {% data variables.product.prodname_actions %} secret is removed.
132+
| `repo.update_actions_secret` | Triggered when a {% data variables.product.prodname_actions %} secret is updated.
133+
134+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
134135
#### Events for self-hosted runners
135136
| Action | Description
136137
|------------------|-------------------
137-
| `action:org.register_self_hosted_runner` | Triggered when an organization owner [registers a new self-hosted runner](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization).
138-
| `action:org.remove_self_hosted_runner` | Triggered when an organization owner [removes a self-hosted runner](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization).
139-
| `action:repo.register_self_hosted_runner` | Triggered when a repository admin [registers a new self-hosted runner](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository).
140-
| `action:repo.remove_self_hosted_runner` | Triggered when a repository admin [removes a self-hosted runner](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository).
138+
| `enterprise.register_self_hosted_runner` | Triggered when a new self-hosted runner is registered. For more information, see "[Adding a self-hosted runner to an enterprise](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-enterprise)."
139+
| `enterprise.self_hosted_runner_updated` | Triggered when the runner application is updated. Can be viewed using the REST API and the UI; not visible in the JSON/CSV export. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)."
140+
| `org.register_self_hosted_runner` | Triggered when a new self-hosted runner is registered. For more information, see "[Adding a self-hosted runner to an organization](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-an-organization)."
141+
| `org.remove_self_hosted_runner` | Triggered when a self-hosted runner is removed. For more information, see [Removing a runner from an organization](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-an-organization).
142+
| `org.self_hosted_runner_updated` | Triggered when the runner application is updated. Can be viewed using the REST API and the UI; not visible in the JSON/CSV export. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)."
143+
| `repo.register_self_hosted_runner` | Triggered when a new self-hosted runner is registered. For more information, see "[Adding a self-hosted runner to a repository](/actions/hosting-your-own-runners/adding-self-hosted-runners#adding-a-self-hosted-runner-to-a-repository)."
144+
| `repo.remove_self_hosted_runner` | Triggered when a self-hosted runner is removed. For more information, see "[Removing a runner from a repository](/actions/hosting-your-own-runners/removing-self-hosted-runners#removing-a-runner-from-a-repository)."
145+
| `repo.self_hosted_runner_updated` | Triggered when the runner application is updated. Can be viewed using the REST API and the UI; not visible in the JSON/CSV export. For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners)."
146+
{% endif %}
141147

148+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
142149
#### Events for self-hosted runner groups
143150
| Action | Description
144151
|------------------|-------------------
145-
| `action:org.runner_group_created` | Triggered when an organization admin [creates a self-hosted runner group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization).
146-
| `action:org.runner_group_removed` | Triggered when an organization admin removes a self-hosted runner group.
147-
| `action:org.runner_group_renamed` | Triggered when an organization admin renames a self-hosted runner group.
148-
| `action:org.runner_group_runners_added` | Triggered when an organization admin [adds a self-hosted runner to a group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group).
149-
| `action:org.runner_group_runners_removed` | Triggered when an organization admin removes a self-hosted runner from a group.
152+
| `enterprise.runner_group_created` | Triggered when a self-hosted runner group is created. For more information, see "[Creating a self-hosted runner group for an enterprise](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-enterprise)."
153+
| `enterprise.runner_group_removed` | Triggered when a self-hosted runner group is removed. For more information, see "[Removing a self-hosted runner group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group)."
154+
| `enterprise.runner_group_runner_removed` | Triggered when a self-hosted runner is removed from a group.
155+
| `enterprise.runner_group_runners_added` | Triggered when a self-hosted runner is added to a group. For more information, see "[Moving a self-hosted runner to a group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group)."
156+
| `enterprise.runner_group_updated` |Triggered when the configuration of a self-hosted runner group is changed. For more information, see "[Changing the access policy of a self-hosted runner group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#changing-the-access-policy-of-a-self-hosted-runner-group)."
157+
| `org.runner_group_created` | Triggered when a self-hosted runner group is created. For more information, see "[Creating a self-hosted runner group for an organization](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#creating-a-self-hosted-runner-group-for-an-organization)."
158+
| `org.runner_group_removed` | Triggered when a self-hosted runner group is removed. For more information, see "[Removing a self-hosted runner group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#removing-a-self-hosted-runner-group)."
159+
| `org.runner_group_runners_added` | Triggered when a self-hosted runner is added to a group. For more information, see "[Moving a self-hosted runner to a group](/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups#moving-a-self-hosted-runner-to-a-group)."
160+
| `org.runner_group_runner_removed` | Triggered when a self-hosted runner is removed from a group.
161+
{% endif %}
162+
163+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
164+
#### Events for workflow activities
165+
166+
{% data reusables.actions.actions-audit-events-workflow %}
167+
168+
{% endif %}

‎content/admin/user-management/audited-actions.md‎

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ versions:
1111
---
1212
#### Authentication
1313

14-
Name | Description
15-
------------------------------------:| ----------------------------------------
14+
Action | Description
15+
------------------------------------ | ----------------------------------------
1616
`oauth_access.create` | An [OAuth access token][] was [generated][generate token] for a user account.
1717
`oauth_access.destroy` | An [OAuth access token][] was deleted from a user account.
1818
`oauth_application.destroy` | An [OAuth application][] was deleted from a user or organization account.
@@ -31,45 +31,52 @@ Name | Description
3131
[OAuth application]: /guides/basics-of-authentication/#registering-your-app
3232
[2fa]: /articles/about-two-factor-authentication
3333

34+
{% if currentVersion ver_gt "enterprise-server@2.21" %}
35+
#### {% data variables.product.prodname_actions %}
36+
37+
{% data reusables.actions.actions-audit-events-for-enterprise %}
38+
39+
{% endif %}
40+
3441
#### Hooks
3542

36-
Name | Description
37-
---------------------------------:| -------------------------------------------
43+
Action | Description
44+
--------------------------------- | -------------------------------------------
3845
`hook.create` | A new hook was added to a repository.
3946
`hook.config_changed` | A hook's configuration was changed.
4047
`hook.destroy` | A hook was deleted.
4148
`hook.events_changed` | A hook's configured events were changed.
4249

4350
#### Enterprise configuration settings
4451

45-
Name | Description
46-
-----------------------------------------------:| -------------------------------------------
52+
Action | Description
53+
----------------------------------------------- | -------------------------------------------
4754
`business.update_member_repository_creation_permission` | A site admin restricts repository creation in organizations in the enterprise. For more information, see "[Enforcing repository management policies in your enterprise](/admin/policies/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation)."
4855
`business.clear_members_can_create_repos` | A site admin clears a restriction on repository creation in organizations in the enterprise. For more information, see "[Enforcing repository management policies in your enterprise](/admin/policies/enforcing-repository-management-policies-in-your-enterprise#setting-a-policy-for-repository-creation)."{% if enterpriseServerVersions contains currentVersion %}
4956
`enterprise.config.lock_anonymous_git_access` | A site admin locks anonymous Git read access to prevent repository admins from changing existing anonymous Git read access settings for repositories in the enterprise. For more information, see "[Enforcing repository management policies in your enterprise](/admin/policies/enforcing-repository-management-policies-in-your-enterprise#configuring-anonymous-git-read-access)."
5057
`enterprise.config.unlock_anonymous_git_access` | A site admin unlocks anonymous Git read access to allow repository admins to change existing anonymous Git read access settings for repositories in the enterprise. For more information, see "[Enforcing repository management policies in your enterprise](/admin/policies/enforcing-repository-management-policies-in-your-enterprise#configuring-anonymous-git-read-access)."{% endif %}
5158

5259
#### Issues and pull requests
5360

54-
Name | Description
55-
------------------------------------:| -----------------------------------------------------------
61+
Action | Description
62+
------------------------------------ | -----------------------------------------------------------
5663
`issue.update` | An issue's body text (initial comment) changed.
5764
`issue_comment.update` | A comment on an issue (other than the initial one) changed.
5865
`pull_request_review_comment.delete` | A comment on a pull request was deleted.
5966
`issue.destroy` | An issue was deleted from the repository. For more information, see "[Deleting an issue](/github/managing-your-work-on-github/deleting-an-issue)."
6067

6168
#### Organizations
6269

63-
Name | Description
64-
------------------:| ----------------------------------------------------------
70+
Action | Description
71+
------------------ | ----------------------------------------------------------
6572
`org.async_delete` | A user initiated a background job to delete an organization.
6673
`org.delete` | An organization was deleted by a user-initiated background job.{% if currentVersion != "github-ae@latest" %}
6774
`org.transform` | A user account was converted into an organization. For more information, see "[Converting a user into an organization](/github/setting-up-and-managing-your-github-user-account/converting-a-user-into-an-organization)."{% endif %}
6875

6976
#### Protected branches
7077

71-
Name | Description
72-
--------------------------:| ----------------------------------------------------------
78+
Action | Description
79+
-------------------------- | ----------------------------------------------------------
7380
`protected_branch.create ` | Branch protection is enabled on a branch.
7481
`protected_branch.destroy` | Branch protection is disabled on a branch.
7582
`protected_branch.update_admin_enforced ` | Branch protection is enforced for repository administrators.
@@ -83,8 +90,8 @@ Name | Description
8390

8491
#### Repositories
8592

86-
Name | Description
87-
---------------------:| -------------------------------------------------------
93+
Action | Description
94+
--------------------- | -------------------------------------------------------
8895
`repo.access` | The visibility of a repository changed to private{% if enterpriseServerVersions contains currentVersion %}, public,{% endif %} or internal.
8996
`repo.archived` | A repository was archived. For more information, see "[Archiving a {% data variables.product.prodname_dotcom %} repository](/github/creating-cloning-and-archiving-repositories/archiving-a-github-repository)."
9097
`repo.add_member` | A collaborator was added to a repository.
@@ -103,8 +110,8 @@ Name | Description
103110

104111
#### Site admin tools
105112

106-
Name | Description
107-
-----------------------------:| -----------------------------------------------
113+
Action | Description
114+
----------------------------- | -----------------------------------------------
108115
`staff.disable_repo` | A site admin disabled access to a repository and all of its forks.
109116
`staff.enable_repo` | A site admin re-enabled access to a repository and all of its forks.
110117
`staff.fake_login` | A site admin signed into {% data variables.product.product_name %} as another user.
@@ -113,8 +120,8 @@ Name | Description
113120

114121
#### Teams
115122

116-
Name | Description
117-
---------------------------------:| -------------------------------------------
123+
Action | Description
124+
--------------------------------- | -------------------------------------------
118125
`team.create` | A user account or repository was added to a team.
119126
`team.delete` | A user account or repository was removed from a team.{% if currentVersion ver_gt "enterprise-server@2.22" or currentVersion == "github-ae@latest" %}
120127
`team.demote_maintainer` | A user was demoted from a team maintainer to a team member.{% endif %}
@@ -124,8 +131,8 @@ Name | Description
124131

125132
#### Users
126133

127-
Name | Description
128-
---------------------------------:| -------------------------------------------
134+
Action | Description
135+
--------------------------------- | -------------------------------------------
129136
`user.add_email` | An email address was added to a user account.
130137
`user.async_delete` | An asynchronous job was started to destroy a user account, eventually triggering `user.delete`.{% if enterpriseServerVersions contains currentVersion %}
131138
`user.change_password` | A user changed his or her password.{% endif %}

0 commit comments

Comments
 (0)