GitHub blocks pull_request_target Dec 2: check your workflows

GitHub Actions will block pull_request_target by default in every public repository starting December 2, 2026. GitHub posted the date today. Enforcement was scheduled for November 2, so you got one month of extra time. Two brownouts come first, on November 9 and November 16. If a public repo you maintain uses the pull_request_target trigger and no policy allows it, those runs fail.

What actually happened

GitHub announced the new schedule on November 2. The block is a default rule in workflow execution protections. Until now, the rule ran in evaluate mode: it logged the runs it would block, and it blocked nothing.

The schedule:

• November 9, 2026, 16:00–18:00 UTC: first brownout. Blocked runs fail with an error annotation and do not execute.
• November 16, 2026, 16:00–18:00 UTC: second brownout.
• December 2, 2026: permanent enforcement.

Between the brownouts, the rule goes back to evaluate mode and workflows run with warnings.

Scope: public repositories on GitHub Free, Team and Enterprise Cloud. Private and internal repositories are not affected, and neither is GitHub Enterprise Server.

GitHub's reason is direct. pull_request_target runs in the context of the base repository, with access to its secrets. If that workflow checks out and runs code from a fork, the fork author's code runs with your secrets. That pattern is behind a long list of real CI compromises.

Why it matters for your business

If you have no public repos, skip this. If you do (an open-source plugin, a theme, an SDK for your API, a docs site), then this trigger is how many teams label PRs, post preview links or run checks on outside contributions. On December 2, those jobs stop.

You have two options, and GitHub lists both:

1. Keep the block. For most small teams, this is the correct answer. Move fork checks to the plain pull_request trigger, which runs without your secrets.
2. Allow it on purpose. Add an Actions event policy that allows pull_request_target only for the specific workflow files that need it. Then read those files. Make sure none of them checks out the PR head and runs it.

Before November 9, open Insights for each public repo and see which runs the rule would block. Do not wait for the brownout to tell you.

Sources: GitHub Changelog.