A 2026 scan of the 1,000 most-starred public GitHub repositories found 269 that run at least one workflow using pull_request_target. Three recent GitHub changes determine whether those workflows break: the fork-code guard in actions/checkout, GitHub’s default block on pull_request_target for public repositories, and a December 2025 change that makes this trigger run the workflow file from the default branch. The scan flagged a small set of repositories whose patterns would hit the guard or bypass it. Those flags describe workflow files, not outages. The scan could not see the Actions policies that decide whether the trigger is allowed to run, so none of the counts below is a confirmed stoppage.
What the scan counted
The figures come from a 2026 scan report by Unite and Create For Life. The author selected the 1,000 most-starred public, non-fork, non-archived repositories through GitHub repository search on September 26, 2026. Of those, 809 contained workflow files, 9,328 files in total. The author read .github/workflows/*.yml and *.yaml on each default branch, ran a line-oriented YAML checker, and reviewed by hand the repositories behind the second and third counts. The report names no repositories.
As an Amazon Associate I earn from qualifying purchases.
| Measure | Count | What the count means |
|---|---|---|
Repositories with at least one pull_request_target workflow |
269 of 1,000 (26.9%) | Associated with 540 workflow files, according to the scan |
| Repositories where fork PR code is checked out in a privileged workflow under the new guard, with no condition keeping forks out | 9 of 1,000 (0.9%) | The author’s classification. These are the repositories expected to fail |
| Repositories checking out fork code in a privileged workflow pinned to a checkout version or commit that predates the guard | 3 | Not blocked by the guard. They keep fetching fork code without that protection |
Workflows that opt out with allow-unsafe-pr-checkout: true |
4 | Deliberate opt-outs. Overlap with the nine expected failures is not stated |
Repositories using git fetch ...pull/... or gh pr checkout in a privileged workflow |
9 | Described as paths that bypass the checkout guard |
The browser checker and the command-line tool used in the report agreed on the corpus, according to the report. The figures have not been independently reproduced.
Free tools Windows power users keep installed
One-click scans. No signup required.
The three changes behind the breakage
The table gives the dates that matter. The three H3 sections below explain what each change does.
#1 Best Overall
| Date | Change | Status on October 9, 2026 |
|---|---|---|
| December 8, 2025 | pull_request_target runs the default-branch workflow; environment branch protections are evaluated differently |
In effect |
| July 20, 2026 | Fork-code checkout protection applies to supported floating major versions of actions/checkout |
In effect |
| November 2, 2026 | Enforcement of GitHub’s default block on pull_request_target in affected public repositories |
Scheduled, 24 days after this article’s date |
The actions/checkout fork-code guard
Inside pull_request_target and the relevant workflow_run contexts, the guard protects checkout steps that point at a fork repository, a pull request head or merge ref, or a fork head or merge commit SHA. An affected step fails unless the workflow deliberately opts in:
with:
allow-unsafe-pr-checkout: trueTreat that input as a decision that needs a security review, not a fix. Two limits matter. The guard targets common checkout patterns; it does not stop every way of fetching and running untrusted code, so a workflow that runs git fetch or gh pr checkout sits outside its stated scope. And protection depends on how the action is referenced. A floating major reference receives the backport. A pin to an exact SHA, minor, or patch version does not change until someone updates it through the normal dependency process; Dependabot or an equivalent tool is one way to do that.
GitHub’s default block on pull_request_target
For public repositories, GitHub’s default policy blocks pull_request_target unless an applicable Actions event policy allows it. The policy is currently in evaluate mode, meaning it is not yet blocking workflows. Enforcement applies to affected repositories that were using the default policy before general availability. An explicit event policy that applies to the repository can allow the trigger. Such a policy can be set at the repository, organization, or enterprise level, and the scan had no visibility into any of them.
Default-branch execution and environment refs
pull_request_target now executes the workflow file from the repository’s default branch, whatever the pull request’s base branch. GITHUB_REF resolves to the default branch and GITHUB_SHA to that branch’s latest commit. Two things follow. A workflow that expected the base branch’s version of its own definition will run different code. And environment branch filters written against the earlier refs may stop matching, which can block a job that previously ran.
What the scan does and does not establish
- A flagged repository is a workflow pattern. Whether it actually fails depends on policies, permissions, and what the job does, none of which the scan could read.
- The scan read only default-branch workflow files. Repository, organization, and enterprise Actions policies were not visible to it.
- The nine expected failures and nine bypass repositories were classified by hand for the second and third counts. Pattern matching in text can miss references built indirectly, such as through reusable workflows, variables, or composite actions, so both misses and misclassifications are possible.
- The report does not state whether the nine expected failures overlap with the four opt-out workflows, or whether the nine bypass repositories also use the guarded checkout.
Checking your own repository
- List workflows that use the trigger:
grep -rln "pull_request_target" .github/workflows/ - For each file, check whether the job reads secrets or holds a write-capable token. Look for
secrets.references and thepermissions:block:grep -rn "secrets." .github/workflows/ - Record each checkout reference and whether it is a floating major, an exact SHA, or a minor or patch version:
grep -rn "actions/checkout" .github/workflows/ - Find any opt-outs:
grep -rn "allow-unsafe-pr-checkout" .github/workflows/ - Find fetch paths outside the guard, then search the composite actions and scripts the workflows call, because the fetch may live outside
.github/workflows:grep -rnE "git fetch.*pull/|gh pr checkout" .github/workflows/ - Open the repository’s Actions settings and review the policy insights GitHub shows for the
pull_request_targetevent. If an organization or enterprise manages Actions policy, check there as well. - Apply the decision table below to each flagged job.
Choosing a response
pull_request_target is a privileged event. It runs trusted workflow definitions from the base repository context and may have access to secrets and a write-capable token, so checking out and executing fork code can expose those privileges. GitHub’s security guidance states: “You must ensure the checked-out code is only ever inspected as data and never executed before using a pull_request_target event.” (GitHub Docs, Securely using pull_request_target.)
| Question | If yes | If no |
|---|---|---|
| Does the job need secrets or a write-capable token? | Keep the trigger only if the workflow genuinely needs those privileges. Review it, then explicitly allow the trigger under an applicable event policy | Move the job to pull_request, which GitHub documents for cases where elevated access is unnecessary. Limit token permissions and secrets |
| Does the job check out or download PR-controlled code? | Never execute that code with secrets. Inspect it only as data. Do not add the opt-out without review | The guard is not the issue here. Still check for other fetch paths from step 5 |
| Is the checkout reference a floating major version? | It receives the backport where supported | Update the exact SHA, minor, or patch pin through your dependency process |
| Does an environment branch filter depend on PR or previous refs? | Review it against the default-branch GITHUB_REF and GITHUB_SHA values |
The December 2025 ref change does not affect it |
Before November 2, 2026, a repository that keeps pull_request_target should have an explicit, reviewed event policy in place. Without one, a repository covered by the enforcement date will be blocked.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
