Only SIG Docs leads (chairs + tech leads) should be able to approve changes to workflows.
Writes into /.github/workflows can provide privilege escalation, so lock down access.