GitHub to block pullrequesttarget workflows by default from 2 December 2026
POLICYredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
From 2 December 2026, GitHub will block workflows triggered by pullrequesttarget in public repositories unless an applicable Actions event policy explicitly allows them. The change applies to GitHub Free, Team and Enterprise Cloud, but not to private or internal repositories or GitHub Enterprise Server. Brownout tests on 9 and 16 November, 16:00–18:00 UTC, will cause affected workflows to fail with an error annotation, and maintainers can allow specific workflow files instead of the whole trigger.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Review the workflows found, particularly any that check out untrusted pull request code or pass pull request data into shell commands.
- Create an Actions event policy, scoped to specific workflow files where possible, for any automation that still needs pullrequesttarget.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Socket Blog