How to Restrict Which Workflows Can Use a Runner

A runner group can be pinned to explicit workflow files by ref, so no ad-hoc or forked workflow can run on it.

Enable "Allow public repositories: off" and set the runner group to accept only named workflow files at a specific ref. Any other workflow is rejected.

Steps

• Open the runner group and enable selected-workflow restrictions.
• List each allowed workflow by full path and ref (e.g. @refs/heads/main).
• Keep the allowed list minimal and review it on change.

Allowed workflow reference format

# Configured in the runner group "Allowed workflows" setting:
my-org/deploy-infra/.github/workflows/deploy.yml@refs/heads/main
my-org/deploy-infra/.github/workflows/rollback.yml@refs/heads/main

Gotchas

• Pin to a ref; allowing any ref lets a branch-created workflow bypass review.
• This restricts scheduling, not what an allowed workflow does once it runs.

Related guides