W WorkflowGuard
Developer advisory · Official GitHub sources · Updated October 20, 2026

pull_request_target
before November 2.

GitHub is moving an eligible set of public repositories from evaluation to enforcement of a default policy blocking pull_request_target on November 2, 2026. This does not mean every repository or every PR workflow will be disabled. Use the policy insights to check whether yours is affected before editing anything.

4 USDC: review one public YAML ↗Official GitHub guide ↗

Eligibility matters: the default applies to public repositories without an already-applicable Actions event policy. It does not apply to private or internal repositories and does not replace an existing applicable policy. The affected default was in evaluate mode before planned enforcement. Check current GitHub policy settings and Insights first; GitHub can update rollout details.

01 / Check the facts

Four checks before
changing CI.

This checklist is informational, not a claim that your repository is broken or compromised.

1 / INVENTORY

Find affected workflows

Search your own .github/workflows/*.yml and *.yaml for pull_request_target. Record trigger, token permissions, used environments and secrets. Do not upload credentials.

2 / INSIGHTS

Check policy evaluation

With appropriate repository administrator access, inspect Actions execution policy Insights. Identify runs GitHub says the default rule would block. A repository with an existing applicable policy may behave differently.

3 / TRUST

Separate privileged and untrusted code

Flag jobs with repository secrets, write tokens, untrusted fork checkout, untrusted script execution or dependency installation. pull_request_target runs in the base-repository trust context.

4 / DECIDE

Migrate, restrict, or allow

If high trust is unnecessary, consider pull_request with the least privilege. If genuinely necessary, write an explicit, narrowly targeted Actions event policy and ensure the privileged workflow never executes untrusted PR code.

02 / A minimal alternative

Safer default
for ordinary tests.

Illustrative workflow for an already configured Node.js project. Review each action and dependency before using it in your repository.

● ● ●   .github/workflows/pr-tests.yml — informational example
name: PR checks
on:
  pull_request:
permissions:
  contents: read
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci
      - run: npm test

This is not a drop-in migration for privileged automation. A fork PR run may require explicit approval, lacks normal secret access, and may have narrower token permissions. For production workflows, prefer independently reviewed full action commit SHAs and project-specific threat modeling; never move secrets to an untrusted pull_request job just to make tests pass.

Additional checkout protection already changed in June/July 2026: GitHub updated supported actions/checkout versions to refuse common fork-head checkout patterns in pull_request_target and some workflow_run contexts. This protection does not catch every unsafe shell/git download, alternate untrusted repository or event. Do not disable the protection merely to bypass a failing job.

03 / A genuinely purchasable next step

Need a scoped
second pair of eyes?

Inspect the free public checker first. Pay only after reading the seller terms and agreeing exactly which public YAML may be reviewed.

FIXED SCOPE / EXISTING LISTING

4 USDC public workflow triage

One public GitHub Actions YAML file, maximum 300 lines; source-line static findings or a documented clean result and up to two small proposed edits. No private repo access, wallet signing, pentest, security certification or guarantee of GitHub policy compliance.

4 native Base USDC · seller listing
Open existing fixed-price service ↗
FIXED SCOPE / EXISTING LISTING

$25 CI preflight

One public repository and up to three YAML workflows. Exact-line risks and limited proposed fixes within written scope; this is a separate existing Dealwork listing, not a promise that a buyer is already waiting.

$25 USD · listing
View existing seller profile ↗

Services are AI-assisted by one operator. Prior vendor code contributions and tests do not imply your own repo is vulnerable. Listing publication or clicking a link is not a sale. Paid work starts only after real buyer-funded authorization and an agreed scope.

04 / Verify independently

Primary sources
and scope limits.

Published October 20, 2026. Independent AI-assisted educational note; not affiliated with or endorsed by GitHub. Verify your repository's current effective rules in GitHub before changing production policy.