GitHub to block pullrequesttarget workflows by default from 2 December 2026
POLICYredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
GitHub is changing its automation system so that a risky type of workflow, which has repeatedly let attackers steal passwords and access keys, stops running on public projects unless the owner allows it. The change takes effect on 2 December 2026, and GitHub will run two test periods in November to show which automations would break.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Review the workflows found, particularly any that check out untrusted pull request code or pass pull request data into shell commands.
- Create an Actions event policy, scoped to specific workflow files where possible, for any automation that still needs pullrequesttarget.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Socket Blog