GitHub Actions workflow_dispatch failed: Event is not allowed to trigger workflows

Problem

A manually triggered workflow failed before any job started. GitHub reported an error similar to:

Event 'workflow_dispatch' is not allowed to trigger Actions workflows.
Workflow file: '.github/workflows/deploy.yml'.

The YAML was valid, workflow_dispatch was present, and the user had repository write access.

Root Cause

A GitHub Actions workflow execution policy blocked the event. These policies are configured separately from workflow YAML and normal GITHUB_TOKEN permissions.

Execution protections can restrict:

• which actors may trigger a workflow;
• which events may start it;
• which repositories and workflow files the rule targets.

Policies can exist at repository, organization, or enterprise level. Restrictions layer together, so a repository rule cannot weaken a broader organization or enterprise policy.

Confirm the Blocking Policy

Open the relevant repository, organization, or enterprise settings and navigate to the Actions Policies section. This is separate from the general Actions settings.

Check policy insights for the failed workflow. Match the repository, workflow path, actor, event, and evaluation result. If the policy is inherited, identify its owner before editing anything.

Do not start by changing permissions: in the workflow. Token permissions control what a running job can access; this failure occurs before a job receives a token.

Fix

The deployment workflow was intentionally manual, so the narrow fix was to allow workflow_dispatch only for the deployment workflow and approved release actors.

The policy scope became:

Repository: production application repositories
Workflow:   .github/workflows/deploy.yml
Event:      workflow_dispatch
Actors:     release team and approved automation

Ordinary contributors remained unable to start the deployment. Other workflows did not receive a broad manual-trigger allowance.

If the workflow does not need manual execution, remove the unused workflow_dispatch trigger instead of opening the policy.

Test Safely

Where GitHub Enterprise Cloud evaluate mode is available, test the adjusted rule in evaluate mode first. Policy insights will show what would be allowed or blocked without immediately disrupting runs.

Then verify:

1. An approved release actor can start deploy.yml manually.
2. A non-approved actor remains blocked.
3. Allowed CI events still run their intended workflows.
4. Unrelated workflows did not gain workflow_dispatch access.
5. Environment approvals and least-privilege GITHUB_TOKEN permissions still apply.

If the Error Names Another Event

Use the same process for push, pull_request, or pull_request_target: identify the policy and justify the specific event-workflow combination.

Be especially cautious with pull_request_target. It runs in the base repository context and can expose privileged resources if a workflow executes untrusted pull-request code. Do not broadly allow it just to clear an error.

The workflow execution protections guide explains a staged organization-wide rollout.

Lesson

When a GitHub Actions run fails before jobs start with “Event is not allowed,” debug the execution-policy layer before the YAML or token-permission layer. Grant the smallest combination of workflow, event, and actor needed.

Sources

• GitHub Docs: About Actions policies
• GitHub Docs: Control workflow execution