GitHub pull_request_target blocked by default December 2

Back to changelog

Retired

November 2, 2026 • 2 minute read

pull_request_target blocked by default December 2

Table of Contents

Why we're making this change

Brownout schedule

Prepare your workflows

Menu. Currently selected: Why we're making this change

Why we're making this change

Brownout schedule

Prepare your workflows

Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories, unless an applicable Actions event policy explicitly allows them. Enforcement was previously scheduled for November 2, 2026.

GitHub introduced this default rule through workflow execution protections. The rule initially runs in evaluate mode, so you can see which workflow runs it would block before enforcement begins.

Private and internal repositories aren’t affected.

pull_request_target runs in the context of the base repository and can access its secrets. If a workflow executes untrusted code from a fork, that code could compromise your pipeline or steal secrets. The default rule helps reduce this risk while letting you explicitly allow workflows that depend on the trigger.

Before permanent enforcement begins on December 2, 2026, we’ll temporarily enforce the default protection during two scheduled brownouts. These windows will help you identify affected workflows and update your policies before enforcement becomes permanent.

During each window, pull_request_target workflow attempts blocked by the default rule in affected public repositories will create failed runs with an error annotation; the workflows won’t execute. After each window, the default rule will return to evaluate mode, allowing workflows to run with warnings. Private and internal repositories aren’t affected.

Before the first brownout on November 9, use Insights to see which workflow runs the rule would block. From there, you have two options:

See how to control workflow execution to configure your policies.

This change applies to public repositories on GitHub Free, GitHub Team, and GitHub Enterprise Cloud, not GitHub Enterprise Server.