GitHub Sets December 2 Deadline to Block pull_request_target by Default

GitHub announced an update to GitHub Actions security rules that will block automated workflows running on the pull_request_target event in public repositories by default. The change takes effect on December 2, 2026, after a one-month postponement from its original November 2 target.

The pull_request_target event allows automation—such as automated labeling or comment additions—to run when handling pull requests, including those originating from forks. The security trade-off is that these workflows execute in the context of the main repository and can access its repository secrets. If a workflow runs untrusted code from an external fork alongside those permissions, malicious actors can potentially exfiltrate secrets or compromise the CI/CD pipeline.

To prepare for the shift, GitHub is running a diagnostic evaluation mode and scheduling two temporary test blocks on November 9 and November 16, 2026, from 16:00 to 18:00 UTC. During these windows, affected workflows will fail and generate error logs instead of executing.

Repository administrators can check the Policy insights section in GitHub Actions settings to see which workflows are impacted. Developers have three main choices: replace the event with safer alternatives like pull_request where applicable, explicitly enable it in policies if truly necessary, or leave the new default block in place. GitHub emphasizes that explicitly allowing the event does not eliminate its underlying risks.

The restriction applies to all public repositories on GitHub Free, GitHub Team, and GitHub Enterprise Cloud plans. Private repositories, internal repositories, and instances of GitHub Enterprise Server are not affected by this default rule change.

Source: habr