Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories, unless an applicable Actions event policy explicitly allows them.

pull_request_target runs in the context of the base repository and can access its secrets. If a workflow executes untrusted code from a fork, that code could compromise your pipeline or steal secrets. The default rule reduces this risk.

Scope: public only, private unaffected

This change applies to:

  • Public repositories on GitHub Free, GitHub Team, and GitHub Enterprise Cloud
  • Private/internal repositories are NOT affected
  • GitHub Enterprise Server is excluded

Every team using public repositories must review this change.

Brownout schedule: test twice in November

Before permanent enforcement on December 2, GitHub has scheduled two brownout windows:

Date Time (UTC) Status
November 9, 2026 16:00–18:00 First brownout
November 16, 2026 16:00–18:00 Second brownout

During each window, pull_request_target workflow attempts blocked by the default rule will create failed runs with an error annotation. The workflows won't execute. After each window, the rule returns to evaluate mode, emitting warnings.

Two migration options

Before the first brownout (November 9), choose one:

Option 1: Keep the default (block)

If no workflow depends on pull_request_target, no action is needed. The default rule remains.

Option 2: Explicitly allow in Actions event policy

If your workflows depend on pull_request_target, you must explicitly allow it in an Actions event policy.

# Check Insights for blocked workflows
# If you need to allow specific ones:
permissions:
  actions:
    write  # or appropriate scope

# Use workflow file targeting to allow only specific workflows

See the workflow execution control documentation for configuration details.

AI-generated PR workflows: special considerations

If your CI/CD pipeline automatically processes PRs from AI agents, pay special attention:

  • Code from forks: Code in PRs from AI agents lives in the fork. pull_request_target accesses the base repository's secrets, meaning fork code could access secrets.
  • Auto-merge risk: Workflows that automatically test and merge AI-generated PRs using pull_request_target may fail during brownout windows.
  • Audit checklist:
    1. Identify public repos using pull_request_target
    2. Review whether fork code can access repository secrets
    3. Identify workflows affected by brownout windows
    4. Determine which workflows to allow via workflow file targeting

What developers should check

When evaluating this change:

  • Scope: Applies to public repos only. Private repos and Enterprise Server are unaffected.
  • Brownout dates: Test affected workflows during Nov 9 and Nov 16, 16:00-18:00 UTC.
  • Use Insights: You can check which workflows the rule would block via Insights.
  • Workflow file targeting: To allow specific workflows, use workflow file targeting — not a blanket repository-level allow.
  • AI agent workflows: Verify whether workflows processing AI-generated PRs use pull_request_target.

This change reflects GitHub's security direction: blocking the combination of fork code and base repository high privileges by default. Identify and address affected workflows before December 2.