Workflow execution protections in GitHub Actions generally available
By Steven Van ·
GitHub Actions execution protections leave preview, adding per-workflow-file rules, an insights view, a REST API, and a default block on public-repo pull_request_target from Nov 2, 2026.
Workflow execution protections for GitHub Actions are now generally available across GitHub Enterprise, organizations, and repositories, moving out of the public preview announced earlier. The feature lets admins set an allowlist controlling who can trigger a workflow (actor rules) and which events can start it (event rules), with disallowed runs failing with an error.
General availability adds three capabilities on top of what was in preview:
- Workflow file targeting, so rules can apply to a specific workflow file rather than the whole repository, for example restricting deploy.yml to a designated team while leaving CI workflows open to all contributors.
- Insights, showing how rules are evaluated and enforced across an enterprise, organization, or repository, to audit and tune policy before and after enforcement.
- A REST API for managing execution protections programmatically, including workflow path conditions, at the enterprise, organization, and repository level.
GitHub is also rolling out a default rule that disables the pull_request_target event for public repositories that don't already have an applicable event policy, aimed at preventing pipeline poisoning from forks. The rule initially runs in evaluate mode and will be enforced from November 2, 2026; it does not apply to private or internal repositories. Full details are in the Actions policies documentation.
