Summary
GitHub made workflow execution protections generally available in Actions. Enterprise administrators can define allowlists — actor rules covering users, repository roles, GitHub Apps, Copilot, and Dependabot, plus event rules like push, pull_request, and workflow_dispatch — that GitHub evaluates before a run, so unauthorized actors or events can never trigger a workflow.
What changed
Workflow execution protections moved from public preview to general availability, letting administrators define allowlists of who (users, repo roles, GitHub Apps, Copilot, Dependabot) and which events (push, pull_request, pull_request_target, workflow_dispatch) may trigger Actions workflows, evaluated before any run.
Why it matters
CI pipelines are a prime target because anyone able to modify a workflow file can run code with repository privileges — a risk that grows as automated agents like Copilot and Dependabot gain trigger rights. Pre-execution allowlists close that gap, giving security teams deterministic control over which humans and non-human actors can start workflows as agentic automation enters CI.
Evidence excerpt
Execution protections let you define an allowlist that controls who can trigger an Actions workflow and what events can start it.