GitHub sets December 2 for a new default on public pull request workflows

GitHub says public repositories will block pull_request_target events by default starting December 2 unless an applicable event policy allows them. The trigger runs in the base repository context, where a workflow can access secrets.

GitHub says private and internal repositories are outside this change. The public repository rule starts in evaluation mode, with two temporary enforcement windows.

Audit workflows that use this trigger and separate trusted repository automation from jobs that execute fork code. Use GitHub’s evaluation results to identify affected workflows before granting an exception.