About Actions policies
Actions policies let you govern how GitHub Actions workflows run. You can configure them in the Policies section of your GitHub Actions settings (separate from the General settings).
Actions policies are available at the enterprise, organization, and repository levels. They currently contain one type of policy: workflow execution protections. GitHub plans to add more policies over time.
About workflow execution protections
关于操作策略
通过操作策略，可以控制工作流在组织和存储库中的运行方式 GitHub Actions 。 可以在设置的新 “策略 ”部分中 GitHub Actions 配置操作策略，这与现有的 常规 设置不同。
操作策略在企业、组织和存储库级别可用。
操作策略当前包含一种类型的策略：工作流执行保护。 GitHub 计划随着时间的推移添加更多策略。
关于工作流执行保护机制
使用工作流执行保护可以定义允许列表，该列表控制谁可以触发 GitHub Actions 工作流以及允许哪些事件运行它们。 工作流执行保护附带两种规则类型：事件和执行组件。 GitHub 计划随着时间的推移添加更多规则。
工作流执行保护基于 GitHub 规则集框架构建，因此你从规则集中已知道的目标也适用于此处。 可以使用规则集应用保护，并使用存储库自定义属性将其限定为特定存储库。 有关规则集的详细信息，请参阅 关于规则集。 These protections can disrupt several real-world attack patterns:
- Poisoned pipeline execution from pull requests. Restrict or prohibit
pull_request_target, including in public repositories where it is most often exploited. - Manual-trigger abuse. Limit
workflow_dispatchso untrusted identities cannot start workflows. - Untrusted-actor execution. Block low-trust identities from triggering workflows entirely.
- Misconfiguration exploitation. Apply central policy that overrides any single misconfigured workflow file.
When enforced, disallowed workflow runs will fail with an error. For example:
Event 'workflow_dispatch' is not allowed to trigger Actions workflows. Workflow file: '.github/workflows/0-welcome.yml'.
注意
GitHub has added a default policy that will block the pull_request_target event in public repositories. This policy will be enforced on November 2, 2026. See 安全地使用 pull_request_target.
Available rules
- Actor rules control who can trigger workflows, including individual users, repository roles, GitHub Apps, Copilot, and Dependabot. By default, every user with write access to a repository can trigger workflows. Actor rules let you separate who contributes code from who runs your CI, so you can grant a contributor write access without granting them the ability to execute workflows.
- Event rules control which events are permitted, such as
push,pull_request,pull_request_target, andworkflow_dispatch.
GitHub plans to add more rules over time.
Next steps
To configure workflow execution protections, see Controlling who can execute GitHub Actions workflows.
To manage policies programmatically, see REST API endpoints for GitHub Actions policies.