GitHub Actions v2026-09-17：执行保护正式可用
Workflow execution protections in GitHub Actions generally available
涉及 CI/CD 核心安全机制变更与强制生效日期。依赖 PR 触发器的开发者务必在 11 月 2 日前检查 Insights 并调整策略，否则流水线将被阻断。
Workflow execution protections for GitHub Actions, previously in public preview, are now generally available for GitHub Enterprise, organizations, and repositories.
GitHub Actions 的工作流执行保护功能此前处于公开预览阶段，现在已面向 GitHub Enterprise、组织及仓库全面可用。
Execution protections let you define an allowlist that controls who can trigger an Actions workflow and what events can start it. Actor rules cover the who, event rules cover the what, and actions evaluate both before a run.
执行保护功能允许你定义一个白名单，以控制谁可以触发 Actions 工作流以及哪些事件可以启动它。参与者规则涵盖“谁”，事件规则涵盖“什么”，而动作会在运行前对两者进行评估。
What’s new
新功能
Alongside the actor and event rules you’ve used in public preview, general availability adds:
除了你在公开预览阶段使用的参与者和事件规则外，全面可用版本还增加了以下内容：
- Workflow file targeting: Scope execution protection rules to specific workflow files rather than an entire repository, so a single repository can apply different policies to different workflows. For example, restrict deploy.yml to a designated team while leaving CI workflows open to all contributors.
- Insights: See how actions evaluate and enforce your rules across your enterprise, organization, and repositories. This enables you to audit policy impact and tune rules both before and after you enforce them.
- REST API: Manage execution protections programmatically at the enterprise, organization, and repository level. Create, read, update, and delete rules — including workflow path conditions — so you can manage Actions policy as code, keep rules consistent across hundreds of repositories, and wire enforcement into your existing governance tooling instead of clicking through settings.
- 工作流文件定位：将执行保护规则的范围限定到特定的工作流文件，而非整个仓库，从而使单个仓库可以对不同的工作流应用不同的策略。例如，限制 deploy.yml 仅由指定团队使用，同时让 CI 工作流对所有贡献者开放。
- 洞察分析：查看你的企业、组织和仓库中如何评估和执行规则。这使你能够在强制执行规则之前和之后审计策略影响并调整规则。
- REST API：在企业、组织和仓库级别以编程方式管理执行保护。创建、读取、更新和删除规则——包括工作流路径条件——从而让你能够以代码形式管理 Actions 策略，保持数百个仓库中规则的一致性，并将执行机制集成到你现有的治理工具中，而不是通过点击设置来操作。
Evaluate mode also carries over from the preview, so you can run rules in shadow mode and see which workflow runs would be blocked before you enforce them.
评估模式也延续了预览阶段的特性，因此你可以以影子模式运行规则，并在强制执行之前查看哪些工作流运行会被阻止。
New secure defaults
新的安全默认值
Vulnerabilities in pull_request_target workflows, such as Pwn Requests, are one of the most commonly exploited vulnerabilities in action workflows. pull_request_target runs with access to your secrets in the context of the base repository, so if code is executed from a fork, that untrusted code could poison your pipeline and exfiltrate secrets. We’re rolling out a default protection rule to limit the execution of pull_request_target events.
pull_request_target 工作流中的漏洞（如 Pwn Requests）是 Action 工作流中最常被利用的漏洞之一。pull_request_target 在基础仓库的上下文中运行并拥有访问密钥的权限，因此如果从分叉仓库执行代码，这些不受信任的代码可能会污染你的流水线并窃取密钥。我们正在推出一种默认保护规则，以限制 pull_request_target 事件的执行。
For public repositories that do not already have an applicable event policy, GitHub is introducing a default rule that disables pull_request_target. This default does not apply to private or internal repositories. It initially runs in evaluate mode, so you can see which workflow runs would be affected before enforcement begins.
对于尚未适用事件策略的公共仓库，GitHub 正在引入一条禁用 pull_request_target 的默认规则。此默认规则不适用于私有或内部仓库。该规则最初将以评估模式运行，以便你在强制执行开始之前了解哪些工作流运行会受到影响。
On November 2, 2026, we’ll automatically enforce the default rule for affected repositories that were using the default pull_request_target policy before general availability.
2026年11月2日，我们将自动对受影响仓库强制执行默认规则，这些仓库在正式发布前使用的是默认的 pull_request_target 策略。
To prepare for the roll out of this rule, you can view the results of the evaluate rule using Insights and see which workflow runs will fail once enforcement begins.
为准备实施此规则，您可以使用 Insights 查看规则评估结果，并了解在执行开始后哪些工作流运行将会失败。
From there you have two options: leave the rule in place to block pull_request_target, or explicitly allow pull_request_target in an applicable Actions event policy if your workflows still depend on the trigger. Specific workflows can be allow-listed using the new workflow file targeting.
此后您有两个选择：保留规则以阻止 pull_request_target，或者如果您的工作流仍依赖该触发器，则在适用的 Actions 事件策略中显式允许 pull_request_target。可以使用新的工作流文件定位功能对工作流进行白名单设置。
To get started, see About Actions policies, Control workflow execution, and the Actions policies REST API reference.
如需开始操作，请参阅关于 Actions 策略、控制工作流执行以及 Actions 策略 REST API 参考文档。
The post Workflow execution protections in GitHub Actions generally available appeared first on The GitHub Blog.
GitHub Actions 中工作流执行保护功能的正式发布首先出现在 GitHub 博客上。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力