---
title: Tip: before Dec 2, allow pull_request_target only for the specific workflows that need it, and never check out fork code in them | ctxsec
url: https://ctxsec.com/items/tip-allowlist-only-needed-pull-request-target-workflows-before-dec-2
description: "When GitHub's default block lands, an org-wide allow puts you back where you started. Allow only named workflow files, and make sure those workflows never build or run code from the pull request with secrets or a write token."
status: "operational guidance (GitHub Changelog and Docs)"
published: 2026-11-09
---

> When GitHub's default block lands, an org-wide allow puts you back where you started. Allow only named workflow files, and make sure those workflows never build or run code from the pull request with secrets or a write token.

[← Tips & Guides](/tips) · [markdown](/items/tip-allowlist-only-needed-pull-request-target-workflows-before-dec-2.md)

operational guidance (GitHub Changelog and Docs)

2026-11-09

### Tip: before Dec 2, allow pull_request_target only for the specific workflows that need it, and never check out fork code in them

- Run today's brownout (Nov 9, 11 AM to 1 PM ET) as a test: anything that fails is a workflow you need to fix or allow.
- Move label-and-comment bots to `pull_request` plus a separate privileged `workflow_run` step where possible.
- In any allowed workflow, do not `actions/checkout` the PR head ref with secrets present.

Sources: [GitHub Docs: Securely using pull_request_target](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target) · [GitHub Changelog (Nov 2)](https://github.blog/changelog/2026-11-02-pull_request_target-blocked-by-default-december-2/)