GitHub Actions to Block pull_request_target by Default in Public Repos from December 2, 2026
Beginning December 2, 2026, the pull_request_target trigger will be blocked by default in all public repositories on GitHub Free, Team, and Enterprise Cloud plans, unless explicitly permitted, to mitigate security risks.
What changed?
Starting December 2, 2026, GitHub Actions will block the pull_request_target event trigger by default for all public repositories on GitHub Free, GitHub Team, and GitHub Enterprise Cloud. This event will only run if an explicit Actions event policy allows it. The change does not affect private, internal, or GitHub Enterprise Server repositories.
There will be two brownout windows on November 9 and November 16, 2026, during which blocked workflows will fail with an error annotation instead of running. After these brownouts and beginning December 2, the block will be enforced permanently.
Why does it matter to an everyday developer?
The pull_request_target event allows workflows to run in the context of the base repository, granting access to secrets and potentially sensitive operations. If exploited, untrusted code from a fork could compromise repository secrets or CI pipelines. The default block significantly reduces this risk but may cause existing workflows triggered by pull_request_target in public repositories to stop running unless explicitly permitted.
What can the developer do now?
Developers should identify if any public repository workflows rely on the pull_request_target trigger. Before November 9, use GitHub Insights to review affected workflows, as brownout periods will show which runs are blocked by the new rule. You may either keep the block or explicitly allow pull_request_target in your repository's Actions event policy. If only specific workflows require this trigger, use workflow file targeting to limit permission. Update configuration before December 2 to avoid integration failures.