Prevent admin actions from being fired

I'd say this is a quite major issue since when enabling Publish Content in a fresh standard installation profile and preventing access to publishing/unpublishing a certain node type publishing and unpublishing actions still can be performed from the node_bulk_form header subform on the admin/content view.

I work around this by now by simply unsetting both options via hook_form_alter. This works as my editor role is not allowed to publish/unpublish any node at all.

  if (isset($form['header']['node_bulk_form']['action']['#options'])) {
    unset($form['header']['node_bulk_form']['action']['#options']['node_publish_action']);
    unset($form['header']['node_bulk_form']['action']['#options']['node_unpublish_action']);
  }