Actions: Limit self-hosted Runners to specific workflows on GHES

[github-product-roadmap]

Summary

This feature enables organizations to limit self-hosted runners to specific workflows.

Intended Outcome

Many organizations with self-hosted runners store tokens on the runner machines, and want to ensure that only selected workflows have access to those tokens. This feature enables organizations to automate this requirement.

When used in combination with reusable workflows, this feature enables organizations to require that specific security and compliance steps are executed in order to perform sensitive tasks, such as deploying to production.

How will it work?

Organizations will be able to select which workflows can access a runner group through the UI and API. Workflows that haven’t been selected, and which attempt to use a runner in the restricted group, will fail with a descriptive error message.