Quick background: we are using Azure DevOps, but migrating to GitHub enterprise for both code repos and deployments. In DevOps all files related to the deployment pipeline are located in the same project, but separate repo. This allows me to control who can modify pipeline files and developers are excluded.
I am having issues achieving the same in GitHub with Actions. There is a .github folder in the repo that I would like to protect. I tried using CODEOWNERS with rules and branch policies. It works, but not as clean as in DevOps. I would like to avoid requiring pull requests for any commit, which is so far the only way I was able to achieve what I want.

Please share how you designed this in your setup.