GitHub Actions Execution Protections: pull_request_target November 2, 2026 Checklist

Work from the safest step to the harder repair.

1. Step 1. Inventory every repository that uses pull_request_target, workflow_dispatch and other privileged or manually triggered events. Record the workflow path, event, permissions block, secret access, checkout/build behavior and who is expected to trigger it.
2. Step 2. Open GitHub Actions policy Insights while the default pull_request_target rule is still in evaluate mode. Identify the exact workflows that would be blocked after enforcement rather than guessing from repository count alone.
3. Step 3. For each pull_request_target workflow, ask whether it actually needs that event. If it only needs to build or test untrusted pull-request code, prefer pull_request so the run uses the lower-trust pull-request context.
4. Step 4. If pull_request_target remains necessary for metadata, labeling, trusted commenting or another base-repository task, keep the privileged job narrowly scoped. Do not check out, build or execute code from the untrusted pull request while secrets or a privileged GITHUB_TOKEN are available.
5. Step 5. Use workflow-file targeting when policies need different behavior for specific workflow files. GitHub's GA release says policies can now target individual workflow paths rather than forcing one repository-wide rule.
6. Step 6. Use multiple small policies instead of one oversized ruleset when practical. GitHub's documentation recommends layering clearly defined policies across enterprise, organization and repository scopes.
7. Step 7. Keep the rule in evaluate mode long enough to observe legitimate workflows, then compare the observed block set with the intended policy before enforcement. Treat a clean evaluate period as evidence for this workload, not proof that every future event is safe.
8. Step 8. Where an explicit exception is required, allow only the needed event, actor and workflow path. Avoid broad exceptions that restore unrestricted trigger capability across unrelated workflows.
9. Step 9. Review workflow permissions separately from event policy. An allowed event still needs least-privilege GITHUB_TOKEN permissions, controlled secret access and normal branch/environment protections.
10. Step 10. Test representative workflows after changing policy: fork pull requests, same-repository pull requests, trusted maintainer actions, bots/GitHub Apps, Dependabot and deployment flows as applicable. Verify both allowed and intentionally blocked cases.
11. Step 11. For centrally managed environments, use the Actions policies REST API only after validating the policy in a small scope. Roll out progressively and preserve a documented rollback path in case legitimate workflows are unexpectedly blocked.
12. Step 12. Before November 2, 2026, recheck GitHub's live changelog and Actions policy documentation for any timing or scope changes, then record the final policy state and verification date.

Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.

Use evidence to decide the next move.

1. 1. Is the repository public and using GitHub's default pull_request_target policy? If yes, treat November 2, 2026 as the documented enforcement deadline for affected repositories.
2. 2. Does the workflow need to execute untrusted pull-request code? If yes, prefer pull_request or another lower-trust design instead of privileged pull_request_target execution.
3. 3. Does a trusted automation genuinely require pull_request_target? If yes, keep privileged operations isolated from untrusted code and explicitly scope the policy to the required workflow/event.
4. 4. Would one repository-wide rule break unrelated CI? If yes, use workflow-file targeting or layered policies instead of a broad exception.
5. 5. Do Insights and negative tests match the intended allow/block behavior? If no, remain in evaluate mode and fix the policy before enforcement.

A visual path from symptom to verified production.

Protect the working site first.

• Review event policy and workflow YAML together because trigger restrictions do not replace least-privilege workflow permissions.
• Use non-production repositories or a narrow repository set for the first enforcement test when organization-wide blast radius is material.
• Never print secrets, tokens, policy exports containing sensitive identifiers or private workflow data into public diagnostics.

Do not turn a repair into a larger outage.

• Do not simply disable the default policy to keep an old workflow working before reviewing whether the workflow executes untrusted code with privileged credentials.
• Do not assume private or internal repositories are covered by the same default pull_request_target block; GitHub says the default policy applies to public repositories.
• Do not treat evaluate mode as enforcement. In evaluate mode, workflows continue to run while Insights show what would be blocked.
• Do not weaken branch protection, environment approvals, token permissions or secret controls to work around an Actions trigger-policy failure.

Diagnose the exact failure before choosing a repair.

Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.

Platform scope

GitHub Actions · GitHub.com · public repositories · organizations · enterprises · Actions policies

Category

CI/CD security · Supply-chain security · GitHub Actions governance

Last updated

2026-09-26

Know the complexity before you edit.

Difficulty

Intermediate

Change risk

High

These labels describe implementation complexity and blast radius, not a guaranteed repair time.

Verify time-sensitive platform details at the source.

• GitHub Changelog — Workflow execution protections generally available (September 17, 2026)
• GitHub Docs — About Actions policies
• GitHub Docs — Securely using pull_request_target
• GitHub Docs — Controlling who can execute GitHub Actions workflows

Before you make the change

Continue from easy to harder.

• GitHub Actions Node 20 Removed: Node 24 Migration Checklist
• GitHub Actions Self-Hosted Runner Enforcement: September 25 Upgrade Checklist
• API Connected? Use This Go-Live Checklist Before You Press Publish