GitHub Actions will block pull_request_target by default in public repositories from December 2
Official source · auto-listedOriginal title pull_request_target blocked by default December 2
From December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories unless an Actions event policy explicitly allows them; enforcement was first set for November 2. Two brownouts on November 9 and November 16, 16:00–18:00 UTC, will fail blocked runs ahead of time. Private and internal repositories are not affected.
Why it matters: Public repositories that rely on pull_request_target should use Insights to find affected workflows before November 9 and either allow or rewrite them, or their runs will fail during the brownouts.