GitHub to block pullrequesttarget workflows by default from 2 December 2026
- Severity
- Medium
- Sources
- 1
What happened
GitHub will block pullrequesttarget-triggered workflows in public repositories by default from 2 December 2026 unless an Actions event policy permits them, extending the June actions/checkout protections. Brownout enforcement windows on 9 and 16 November, 16:00–18:00 UTC, will produce failed runs with error annotations, and the default reverts to evaluation mode afterwards. Defenders should audit for pullrequesttarget usage, especially checkouts of untrusted fork code or attacker-controlled PR data passed to shell commands, and create workflow-level allow policies for required automation. Per the article, evaluation-mode policy insights are only available on Enterprise Cloud, which complicates assessment for smaller open source projects.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review the workflows found, particularly any that check out untrusted pull request code or pass pull request data into shell commands.
- Create an Actions event policy, scoped to specific workflow files where possible, for any automation that still needs pullrequesttarget.
Written by AI from the sources, checked against them