GitHub will block `pull_request_target` by default in public repositories

Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories unless an Actions event policy explicitly allows them. Enforcement was previously scheduled for November 2. Private and internal repositories are not affected. The trigger runs in the base repository's context with access to its secrets, which is why a workflow that runs untrusted fork code under it can leak them.

Two brownouts come first, on November 9 and November 16, each from 16:00 to 18:00 UTC. During those windows, blocked workflows fail with an error annotation and do not run. Insights shows which runs the rule would block.

Why it matters: If a public repository's automation reacts to fork pull requests through this trigger, the first failures arrive tomorrow. The changelog does not mention agents, so whether your agent-driven workflows use it is something to check in your own workflow files.