GitHub plans default block on pull_request_target from 2 December

GitHub said on 2 November 2026, that its Actions service will block pull_request_target events by default in public repositories starting 2 December 2026, unless an applicable policy explicitly allows them. GitHub, the only source for the announcement, had previously scheduled enforcement for 2 November 2026.

The event can trigger an automated workflow in the context of the base repository, where it can access that repository’s secrets, GitHub said. If the workflow executes untrusted code from a fork—a separate copy of the repository—that code could steal secrets or compromise the pipeline, the company said. The default block is intended to reduce that risk.

What maintainers should check

Before the first temporary enforcement window, GitHub advises maintainers to use Policy insights to see which runs the rule would block. They can keep the default block or, if a workflow depends on the trigger, explicitly allow it in an applicable Actions event policy. An allowance can target specific workflow files.

Repository administrators, organization owners and enterprise owners can configure workflow execution protections. In a repository or organization, the policies are under Settings → Actions → Policies; at enterprise level, they are under Policies → Actions → Policies. Policy insights appears directly below the Actions policies page in the relevant sidebar.

The change covers public repositories on GitHub Free, GitHub Team and GitHub Enterprise Cloud. Private and internal repositories are unaffected, as is GitHub Enterprise Server.

Temporary enforcement before the permanent block

The rule initially runs in evaluate mode: it shows which runs would be blocked without stopping them. GitHub has scheduled two temporary enforcement windows, or brownouts, to help maintainers find affected workflows and update policies.