GitHub Actions Is Changing pull_request_target — Check Your Workflows Before December 2

<p><em>Developer roundup · November 1–8, 2026</em></p> <p>A contributor opens a pull request from a fork. Your workflow checks out their code and runs a test script. If that workflow uses <code>pull_request_target</code>, the script can run with access to the base repository’s secrets. That’s the risk behind a GitHub Actions default that changes on December 2. <a href="https://github.blog/changelo

Read the source →