GitHub Actions to Block pull_request_target Events by Default on December 2 2026
GitHub will restrict pull_request_target events in public repositories starting December 2, 2026, to prevent unauthorized access to pipeline secrets.
GitHub Actions will block pull_request_target events by default in all public repositories on December 2, 2026, unless an Actions event policy explicitly allows them. This enforcement was originally scheduled for November 2, 2026, and was pushed back by a month.
Because the trigger runs in the context of the base repository and accesses its secrets, executing untrusted code from a fork can compromise the pipeline or steal secrets. The default rule mitigates this risk while giving maintainers the option to permit necessary workflows.
The change applies to public repositories on GitHub Free, GitHub Team, and GitHub Enterprise Cloud, but excludes private repositories, internal repositories, and GitHub Enterprise Server. The rule currently runs in evaluate mode to show which runs it would block.
Before the permanent switch, GitHub has scheduled two brownout windows on November 9, 2026, from 16:00 to 18:00 UTC and November 16, 2026, from 16:00 to 18:00 UTC. During these windows, blocked attempts will produce failed runs with error annotations and will not execute, whereas between windows the rule reverts to evaluate mode with warnings.
Maintainers can check Insights before the first brownout to review affected workflow runs. You can either accept the default block or explicitly allow the trigger via an Actions event policy, and you can restrict permissions to specific workflows using workflow file targeting.