pull_request_target blocked by default from 2 Nov 2026 in public repos

pull_request_target in public repositories: blocked by default 2 Nov 2026, in 24 days. In a public repository with no Actions event policy, workflows triggered by pull_request_target stop running: GitHub's default workflow execution protection blocks the event. Private and internal repositories are exempt. The rule has run in evaluate mode since 17 Sep 2026, so its Insights show what it would block. The fix: If the workflow needs pull_request_target, allow it in an Actions event policy for the repository or organisation (or allowlist that workflow file); otherwise trigger it on pull_request. Check your workflows now, with nothing to install: grep -rn "pull_request_target" .github/workflows

$ grep -rn "pull_request_target" .github/workflows

Run it from the repository root; it needs nothing installed and sends nothing anywhere. It finds each name as written in your workflow files; a value set in another file and passed in (a matrix from JSON, a reusable workflow's input) needs a look of its own. The fix is in the first paragraph above. The dates come from this data.

The facts

What

pull_request_target in public repositories

Matches

Workflows triggered by pull_request_target in public repositories

Effect

Breaks a job

Announced

17 September 2026

Date

2 Nov 2026blocked by default 2 Nov 2026, in 24 days

After the date

In a public repository with no Actions event policy, workflows triggered by pull_request_target stop running: GitHub's default workflow execution protection blocks the event. Private and internal repositories are exempt. The rule has run in evaluate mode since 17 Sep 2026, so its Insights show what it would block.

The fix

If the workflow needs pull_request_target, allow it in an Actions event policy for the repository or organisation (or allowlist that workflow file); otherwise trigger it on pull_request.

actions-eol is a free tool from agentcheck, which runs scheduled checks of your endpoints and alerts you when an answer changes. Dates come from GitHub's own pages, read on the day shown; github.com only, since GitHub Enterprise Server keeps its own schedule.