Workflow Execution Protections: Actor and Event Configuration [GA]

### Value Prop

Workflow Execution Protections give you fine-grained control over which GitHub Actions workflows are allowed to run—and who can trigger them. Using an allow-list approach built into repository rulesets, administrators can define trusted actors (specific users, roles, or apps like Dependabot and Copilot) and permitted events (such as `push`, `pull_request`, or `workflow_dispatch`). This means your organization can enforce consistent, centralized security policies across all repositories without relying on ad hoc, per-workflow configurations—reducing your attack surface and scaling governance as you grow.

### Expected Outcome

Today, workflows execute based on the workflow file present in the triggering commit, which means anyone with write access could inject malicious changes that run in CI. Workflow Execution Protections close this gap by evaluating enforcement rules *before* execution begins, blocking unauthorized actors and unexpected event triggers at the gate. The result: stronger supply-chain security, reduced risk of secrets exfiltration, and confidence that only trusted people and automation can initiate workflow runs—whether you're an enterprise managing hundreds of repositories or an open-source maintainer protecting your project from malicious contributions.