Add recommendations for runner groups and labels

[konstruktoid]

This pull request makes several improvements to the documentation on securing GitHub Actions workflows. The most significant updates include adding new recommendations for segregating runners, enhancing repository ruleset guidance, and updating author attribution.

Enhancements to security recommendations:

• Added a new recommendation to segregate runners by using organizational runner groups and labels to separate high-privilege from low-privilege runners, reducing the risk of unauthorized access to sensitive resources. [1] [2]
• Expanded repository ruleset guidance by recommending the use of "Require workflows to pass before merging" to enforce organizational or enterprise-level workflow requirements prior to merging.

Documentation and metadata updates:

• Updated the authors list in the document metadata to include Thomas Sjögren (konstruktoid).
• Set the document draft status back to true, indicating it is not yet ready for publication.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the “Securing GitHub Actions Workflows” guidance by adding runner-segregation recommendations and expanding ruleset guidance, while marking the page as draft.

Changes:

• Set the page to draft: true and added an additional author.
• Added “Segregate runners” as a top-level recommendation and a dedicated section with implementation details.
• Added a repository ruleset recommendation to require workflows to pass before merging.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.