GitHub will block pull_request_target in public repos by default from Dec 2, with a first two-hour brownout today, Nov 9, 16:00 to 18:00 UTC
- Use policy Insights to see which workflow runs would be blocked.
- Either keep the default block, switch the workflow to
pull_request, or allowpull_request_targetfor specific workflow files in an Actions event policy. - Applies to public repos on GitHub Free, Team and Enterprise Cloud.
Sources: GitHub Changelog: pull_request_target blocked by default December 2 · GitHub Docs: Securely using pull_request_target