GitHub Actions Blocks pull_request_target by Default in Public Repos on December 2

On November 2, 2026, GitHub announced that the pull_request_target event will be blocked by default in all public repositories from December 2, after brownouts on November 9 and 16. Teams that depend on this trigger to reach base-repo secrets must explicitly allow it through an Actions event policy before the deadline.