GitHub to block pull_request_target in public repos from December 2

GitHub has announced important updates to its GitHub Actions security policies, affecting open-source maintainers and developers globally. Starting December 2, 2026, the platform will block automation workflows using the pull_request_target event by default in public repositories. This change aims to mitigate significant security risks associated with unauthorized access to project secrets.

• Starting December 2, 2026, pull_request_target will be blocked by default in public repositories.
• The primary driver is the risk of executing untrusted code with access to repository secrets.
• Administrators can inspect affected workflows in advance using Policy insights.
• Changes apply to GitHub Free, GitHub Team, and GitHub Enterprise Cloud plans.

Security risks of the pull_request_target event The pull_request_target event is traditionally used to trigger automation when handling pull requests, including contributions originating from external forks. Developers frequently utilize it to automatically assign labels, add welcome comments, or manage contributor workflows. However, the inherent security risk arises because these workflows execute within the context of the main repository and retain access to critical project secrets and tokens. If such a workflow inadvertently processes or executes untrusted code from an untrusted fork, malicious actors could potentially steal secrets and compromise the entire CI/CD pipeline. The new policy is designed to dramatically reduce the attack surface for these types of exploits.

Test blockouts and rollout schedule Before enforcing the permanent restriction, GitHub is providing a transition period so developers can properly audit and adjust their configurations. The restriction is currently operating in an evaluation mode, allowing workflows to run while enabling administrators to identify potential disruptions via Policy insights. To validate readiness, GitHub will execute two temporary trial blockouts on November 9, 2026, and November 16, 2026, from 16:00 to 18:00 UTC. During these windows, affected workflows will not execute, and the system will generate failure log entries. The platform will revert to evaluation mode between tests until the permanent enforcement goes live on December 2.

Action items for developers and maintainers Public repository maintainers should review their repository settings under Policy insights prior to November 9 to identify affected workflows. If the pull_request_target event is not strictly necessary, developers should replace it with the safer pull_request event where applicable. If the event is indispensable, administrators must explicitly allow it through GitHub Actions security policies, optionally restricting permission to specific workflow files. GitHub emphasizes that explicitly granting permission does not eliminate underlying risks, and maintainers should continue to avoid executing untrusted code with privileged project tokens. Private repositories and GitHub Enterprise Server instances remain unaffected by this policy update.