Workflow access & approvals
Configure the audience, approval policy, and handling of untrusted requests separately from runner labels.
Open the guideHow it works
New workflows start with a restrictive policy. Choose who may request execution and when an authorized reviewer must approve; inspect source and destination before allowing a run.
Independent and GitHub-coordinated execution both use admission checks. Untrusted fork jobs require the supported disposable destination and approval path. Independent fork jobs receive no stored secrets or write tokens.
What you can do
Allowed audience
Select who can request a workflow run.
Execution review
Apply approval policy to the actual run.
Fork handling
Use supported restricted, disposable execution.
Explore more
Ship it your way.
Self-hosted and free, or managed on Openship Cloud — the same workflow either way.