GitHub Actions to block pull_request_target events by default starting December 2, 2026
Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories, unless an applicable Actions event policy explicitly allows them. The changelog notes that enforcement was previously scheduled for an earlier date.
Why it matters
Workflows in public repositories that rely on pull_request_target will stop running by default after December 2, 2026, which can break CI, labeling, or PR automation unless an event policy is configured to allow it.
Who should care
Maintainers of public GitHub repositories, DevOps engineers, and developers who run GitHub Actions workflows triggered by pull_request_target.
What you can do
Audit your public repositories' workflows for pull_request_target triggers and either migrate them to safer event types or configure an Actions event policy that explicitly allows them before December 2, 2026.