Have a public GitHub repository that uses pull_request_target? Put December 2, 2026 on your calendar. GitHub says this Actions event will be blocked by default unless an applicable event policy explicitly allows it.
It is a security-policy change, not a new YAML syntax requirement. And you can check whether it affects your workflows before enforcement begins.
What is changing?
- Now: The default policy is in evaluate mode. Affected runs can continue while policy insights show what would be blocked.
- November 9 and 16: Temporary enforcement tests run from 16:00 to 18:00 UTC on each date. Blocked workflows will fail with an annotation.
- December 2: Default enforcement starts for affected public repositories.
GitHub says the change covers public repositories on GitHub Free, Team, and Enterprise Cloud. Private and internal repositories, and GitHub Enterprise Server, are not included.
Check your workflows in one minute
From the root of your repository, search for the event:
grep -R -n 'pull_request_target' .github/workflows/This is a text search, not a security scan: it can also match comments. Review each matching workflow rather than assuming every match is vulnerable.
If you administer the repository, open Settings → Actions → Policies → Policy insights to inspect runs that the rule would block. GitHub recommends checking before the first November 9 brownout.
Should you allow the event?
First ask whether the workflow really needs pull_request_target. Ordinary build and test workflows can often use pull_request instead.
The risk is privilege: pull_request_target runs in the base repository’s context, with access to its token and potentially secrets. Checking out untrusted fork code and then executing it can expose those privileges.
If a trusted automation genuinely needs this trigger—for example, carefully designed pull-request labeling—an administrator can create an Actions event policy that explicitly allows it. GitHub supports targeting specific workflow files, which is safer than a broad exception.
The practical takeaway
Search, inspect policy insights, then decide. Do not turn on a blanket exception just to make a red CI check disappear. Even an allowed workflow still needs least-privilege tokens and careful handling of untrusted pull-request content.
Sources: GitHub’s November 2, 2026 announcement; GitHub Actions policy setup; GitHub security guidance for pull_request_target.