auditing-gha-settings

Diff a fleet repo's GitHub Actions repository-level settings against the canonical baseline. Read-only: surfaces what to change, doesn't change it.

When to use

"action X is not allowed to be used" CI failure: the allowlist is missing an entry, or the policy got flipped from selected to local_only.
Onboarding a new fleet repo: before the first CI run, confirm the new repo matches the baseline so the first push doesn't hit policy errors.
Periodic fleet health check: drift accumulates. Somebody adds a workflow that needs a new action and silently flips verified_allowed: true to make it work instead of adding the explicit pattern.

Setting (per repo)	Baseline	Why
`enabled`	`true`	Per-repo override is on. Note: `enabled: false` does NOT mean Actions are off — it means the per-repo override is unset and org policy is the source of truth. To get drift-detection on a repo, opt in to per-repo settings + mirror the canonical baseline.
`allowed_actions`	`'selected'`	"Allow enterprise, and select non-enterprise, actions and reusable workflows" — the only mode where the explicit allowlist is the source of truth.
`github_owned_allowed`	`false`	Don't blanket-allow `actions/*`. The canonical patterns list already names every github-owned action we need; unlisted ones must be explicit.
`verified_allowed`	`false`	Marketplace "verified creator" is not implicit allow — every action must be on the canonical patterns list.
`patterns_allowed ⊇ canonical set`	Each fleet pattern present	Each canonical entry is referenced by at least one socket-registry shared workflow; missing one breaks every consumer.