GitHub Actions Workflow Execution Protections Now Generally Available
GitHub Actions workflow execution protections are now generally available for GitHub Enterprise, organizations, and repositories, moving from public preview. These protections enable administrators to define allowlists controlling who can trigger workflows and under what events. The GA release adds workflow file targeting, detailed insights for auditing, and a REST API for programmatic policy management. Additionally, GitHub is introducing a secure default rule that disables `pull_request_target` for public repositories lacking an existing policy, set for enforcement on November 2, 2026, to mitigate common security vulnerabilities.
- →Workflow execution protections in GitHub Actions generally available
- →New secure default for pull_request_target workflows
- →New capabilities for workflow execution protection policies
Security (1) ›
- New secure default for pull_request_target workflows
GitHub is implementing a default protection rule to limit `pull_request_target` events, which are common vulnerability vectors, by disabling them for public repositories without existing event policies. This rule will initially run in evaluate mode and be automatically enforced for affected repositories on November 2, 2026.
Features (1) ›
- Workflow execution protections in GitHub Actions generally available
GitHub Actions workflow execution protections are now generally available for GitHub Enterprise, organizations, and repositories. Previously in public preview, these protections allow defining allowlists that control which actors can trigger a workflow and which events can start it.
Enhancements (1) ›
- New capabilities for workflow execution protection policies
General availability introduces workflow file targeting to scope rules to specific files, insights to audit policy impact and tune rules, and a REST API for programmatic management of execution protections at enterprise, organization, and repository levels. Evaluate mode for shadow runs also carries over from the preview.
https://github.blog/changelog/2026-09-17-workflow-execution-protections-in-github-actions-generally-available
Related releases
- GitHub Actions Ubuntu 26.04 Runner Now GA; ubuntu-latest Migrates GitHub Changelog ·
- GitHub Enterprise Adds Automated SSO Authorization for PATs and SSH Keys GitHub Changelog ·
- SCIM User Responses Now Include profileUrl Attribute GitHub Changelog ·
- GitHub Copilot now offers budget increase requests GitHub Changelog ·
- Code scanning AI Scan no longer requires CodeQL default setup GitHub Changelog ·
- Enterprise Admins Can Now Enforce GitHub Advanced Security Configurations GitHub Changelog ·