Which workflows are affected?
GitHub now schedules the default pull_request_target block for 2 December 2026, one month after its earlier date. The change covers public repositories on Free, Team and Enterprise Cloud. Private and internal repositories, and Enterprise Server, are excluded.
The trigger runs in the base repository’s context and may access secrets. GitHub says executing untrusted fork code in that context creates a security risk. An applicable event policy can explicitly allow the trigger; this is not a blanket ban on pull requests or all Actions workflows.
Two November test windows
- 9 November 2026: 16:00–18:00 UTC.
- 16 November 2026: 16:00–18:00 UTC.
During these temporary enforcement windows, blocked attempts produce failed runs and an error annotation without executing the workflow. GitHub says the default rule returns to evaluation with warnings after each window, ahead of December enforcement.
Where to inspect the impact
Repository and organization administrators can find policies under Settings → Actions → Policies. Policy insights shows runs blocked, or which would be blocked in evaluation. Policies can target workflow files and layer across repository, organization and enterprise controls.
The documentation restricts creating custom Evaluate policies to Enterprise Cloud. That capability is distinct from GitHub’s scheduled default-rule evaluation period. Inspect the affected workflows and their trust boundaries before considering an exception.
This is a documentation check, not a test of your repository. See the GitHub profile for separately dated product and pricing details.