GitHub will block pull_request_target events by default in public repositories

What happened

GitHub announced that starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories unless an applicable Actions event policy explicitly allows them. The enforcement date was previously scheduled for November 2, 2026, but has been moved to December 2. Private and internal repositories are not affected by this change.

Why GitHub is making this change

The pull_request_target trigger runs in the context of the base repository and has access to its secrets. When a workflow executes untrusted code originating from a fork, that code could potentially compromise the pipeline or steal secrets. This default blocking rule is intended to reduce this security risk while still allowing teams to explicitly enable workflows that require the trigger.

Brownout schedule and what to expect

Before permanent enforcement begins on December 2, GitHub will conduct two temporary brownout windows to help teams identify affected workflows. During these windows, pull_request_target workflow attempts blocked by the default rule in affected public repositories will create failed runs with error annotations and will not execute. After each brownout window ends, the rule returns to evaluate mode, which allows workflows to run with warnings instead of failing.

The brownout windows are scheduled for November 9, 2026 from 16:00–18:00 UTC and November 16, 2026 from 16:00–18:00 UTC.

How to prepare your workflows

Before the first brownout on November 9, you can use Insights to see which workflow runs would be blocked by the default rule. After identifying affected workflows, you have two options: keep the default rule in place to block pull_request_target, or explicitly allow pull_request_target in an applicable Actions event policy if your workflows depend on it. When allowing the trigger, you can use workflow file targeting to allow only specific workflows rather than all workflows.

To configure your policies, refer to GitHub's documentation on how to control workflow execution.

Scope of the change

This change applies to public repositories on GitHub Free, GitHub Team, and GitHub Enterprise Cloud only. GitHub Enterprise Server is not affected by this default blocking rule.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.